Student Privacy is our priority.
In compliance with Enhancing Digital Security and Trust Act, 2024 (EDSTA), we do not store student information.
For students participating in our fieldtrips or inschool sessions, no student logins are required. Teachers submit an attendance list of studetns attending days events, and receive certificates for teh students.
We keep those lists for 3 years for compliance reasons.
Online Learning | Student Privacy & Data Security Protocol
For online learning, there is a different process.
1. Online account creation and distribution
- For online learning, Flashpoint receives each student’s first initial and last name from the teacher or school.
- A username is created from the first initial and last name, with a number added where necessary to distinguish duplicate usernames. A random password is assigned to each account.
- Flashpoint sends account credentials to the teacher, who distributes the credentials to the appropriate students. Students do not provide personal email addresses to Flashpoint.
- Usernames constructed from names can identify students and are treated as personal information, even when full first names are not used.
2. Certificates and learning records
When a personalized certificate is required, the teacher provides student first and last names, or an attendance sheet containing those names, for certificate preparation. Where no certificate is required, full first names are not needed for certificate issuance; however, account usernames still contain a first initial and last name.
Flashpoint reports tracking course completion only, rather than quiz scores, detailed learning analytics or time spent in courses. Student-related records are retained for three years and then eliminated, according to Flashpoint’s stated policy. The exact deletion process and the point at which the three-year period begins should be documented.
3. Data hosting and technical safeguards
Flashpoint reports that its online platform, hosting, servers and stored information are located in Canada. It reports use of HTTPS encryption, encrypted databases, password hashing, backups and administrator access restrictions. Specific vendors, configurations, encryption standards, backup retention and independent verification have not yet been supplied.
Flashpoint reports that the portal does not use third-party analytics, embedded external services or other third-party integrations that receive student information. This statement should be checked against hosting, email delivery, content delivery, support tools and technical logs before final approval.
4. Authorized access and privacy incidents
Authorized student-record access is reported as limited to Carmen Reis, CEO, and Natalie Martines, Manager of Operations. Flashpoint confirms that it has a privacy/security incident response procedure. Notification timelines, escalation contacts and written incident-response steps have not yet been provided for review.
5. Other delivery formats
In-person training and field trips: Flashpoint reports that no individual student names are required for these delivery formats. This document does not otherwise describe their operational or privacy procedures.
6. Items to verify before submission
- Confirm the legal name of the hosting provider, location of production and backup data, and any subprocessors.
- Confirm exactly which records are kept for three years (account details, passwords or hashes, names, certificates, completion status, backups and logs), the retention start date and deletion method.
- Confirm how student name lists and credentials are transferred to teachers, including whether email attachments or secure transfer are used.
- Confirm whether students can change passwords, how lost credentials are reset, and whether account access ends after course completion.
- Confirm whether access logs, IP addresses, device identifiers or cookies are collected automatically by the portal or hosting infrastructure.
- Document procedures for access/correction/deletion requests, security incidents, school-board notification timelines and the responsible privacy contact.
- Verify whether teacher-supplied attendance sheets contain extra information and whether that information is removed or minimized.
- Review the final wording with the relevant school board; this document does not independently establish compliance with EDSTA, MFIPPA, PIPEDA or board-specific requirements.
School-board summary
Flashpoint Training uses teacher-mediated account provisioning for online SHSM learning. Student emails are not required. Accounts use a first-initial/last-name username and a random password distributed through the teacher. Full student names are obtained from teachers when personalized certificates are needed. Flashpoint reports tracking only course completion, retaining relevant records for three years, using Canadian hosting and security safeguards, and restricting student-record access to designated staff. Further technical and operational details remain subject to verification.
Contact: hello@flashpointtraining.com | www.flashpointtraining.com