**Effective date:** August 2026 **Last updated:** August 2026 ## 1. About NDC Coding NDC Coding is an educational coding environment provided through NDC Fine Arts for authorized students and staff of Christ The Redeemer Catholic Schools (“CTR Catholic Schools”). NDC Coding provides students with a browser-based programming workspace in which they can create, edit, test, and publish coursework as part of teacher-directed educational activities. This Privacy Policy explains what personal information is used by NDC Coding, why it is used, how it is protected, and how Google Account information is handled when Google is used for authentication. NDC Coding is an educational service. It is not an advertising service, social network, or public consumer application. ## 2. Governing Privacy Requirements NDC Coding is operated in accordance with applicable privacy requirements and CTR Catholic Schools policies and administrative procedures, including: - Alberta's **Protection of Privacy Act (POPA)**; - **CTR Catholic Schools Board Policy 29 — Managing Division Information, Access, and Privacy**; - **Administrative Procedure GEN 02 — Access to Information Act / Protection of Privacy Act**; - **Administrative Procedure STU 39 — Personal Mobile Devices and Social Media**; and - **Administrative Procedure GEN 27 — Guidelines for Artificial Intelligence Use by Staff and Students**. These requirements establish expectations for the appropriate collection, use, disclosure, retention, safeguarding, and disposal of personal information and for the responsible use of technology within CTR Catholic Schools. ## 3. Information Used by NDC Coding NDC Coding collects or processes only information reasonably necessary to provide and secure the educational service. ### Google authentication information When a user signs in with Google, Google and the authentication service may provide basic identity information associated with the user's Google Account, including: - the user's Google Account email address; - a unique account identifier used as part of authentication; and - basic profile information, such as the user's name, where supplied as part of the authentication process. NDC Coding currently uses the authenticated **email address** to verify eligibility for access and to identify the user's coding workspace. For example, an authorized school email address may be used to derive a corresponding local workspace name. ### Technical and security information NDC Coding and its infrastructure providers may process limited technical information necessary for operation and security, including: - authentication date and time; - Internet Protocol (IP) address; - browser or device information; - session and security information; and - server and application logs used for security, troubleshooting, and system administration. ### Student-created information Students may create and store programming files, web pages, assignments, and related educational material within their assigned workspace. Students should not intentionally place personal information belonging to themselves or others into source code, web pages, or other files unless specifically directed to do so for an approved educational purpose. ## 4. Why Personal Information Is Used Personal information used by NDC Coding is limited to purposes related to the operation of the educational service, including: - authenticating authorized students and staff; - determining whether a user is permitted to access NDC Coding; - creating and identifying an individual coding workspace; - delivering teacher-directed programming and web-development instruction; - maintaining the security and integrity of the service; - diagnosing technical problems; - preventing unauthorized access or misuse; and - meeting applicable educational, legal, security, and records-management requirements. Personal information will not be used for an unrelated purpose except where authorized or required by law. ## 5. Google User Data NDC Coding uses Google OAuth solely to provide secure user authentication. NDC Coding **does not request access to or read the contents of**: - Gmail; - Google Drive; - Google Classroom; - Google Calendar; - Google Contacts; - Google Photos; or - other documents, messages, files, or private content stored in a user's Google Account. NDC Coding does not receive or store a user's Google password. Authentication information is processed by Google and the authentication infrastructure used by NDC Coding. The NDC Coding application receives only the authenticated identity information required to determine whether the user may access the service and which workspace belongs to that user. Google user data obtained through authentication is used only to provide, administer, secure, and support NDC Coding. NDC Coding does not: - sell Google user data; - rent Google user data; - use Google user data for advertising; - use Google user data for behavioural profiling or targeted marketing; - transfer Google user data to data brokers; - use Google user data to train artificial-intelligence models; or - use Google user data for purposes unrelated to the educational service described in this policy. Use of information received from Google APIs will comply with the **Google API Services User Data Policy**, including applicable Limited Use requirements. ## 6. Service Providers NDC Coding uses third-party infrastructure where necessary to provide authentication, networking, security, hosting, and related technical services. These services currently include **Google**, for user authentication, and **Cloudflare**, for identity and access control, secure network access, and related security services. These service providers may process limited personal or technical information as necessary to provide their services and are also subject to their own privacy and security obligations. Personal information is not disclosed to third parties for advertising or commercial marketing. Information may otherwise be disclosed only where permitted or required by applicable law or CTR Catholic Schools policy. ## 7. Storage, Retention, and Disposal NDC Coding retains personal information and student-created files only as long as reasonably necessary for educational, operational, security, legal, or records-management purposes. Information no longer required will be deleted, securely disposed of, or anonymized as appropriate and in accordance with CTR Catholic Schools' records-management and privacy requirements. Authentication and security logs may be retained for a reasonable period where required to investigate technical problems, attempted unauthorized access, security incidents, or other legitimate operational concerns. ## 8. Security Reasonable administrative and technical safeguards are used to protect NDC Coding and the information processed through it. These safeguards include authentication, access controls, encrypted network connections, restricted administrative access, security logging, and server-level protections appropriate to the nature of the service. No Internet-connected system can guarantee absolute security. Actual or suspected privacy incidents will be handled in accordance with CTR Catholic Schools' privacy-management and incident-response requirements. ## 9. Cookies and Session Information NDC Coding, Google, and Cloudflare may use cookies or similar browser storage where necessary to authenticate users, maintain secure sessions, and operate the service. NDC Coding does not intentionally use advertising or behavioural-tracking cookies. ## 10. Student Mobile Devices and Social Media Use of NDC Coding does not replace or override **CTR Catholic Schools Administrative Procedure STU 39 — Personal Mobile Devices and Social Media**. Students must follow teacher and school directions regarding when and how personal devices may be used for educational activities. NDC Coding is not a social-media service and does not provide social-network profiles, feeds, or similar social-media functionality. ## 11. Artificial Intelligence NDC Coding does not require the use of generative artificial intelligence as part of its Google authentication or normal workspace-provisioning process. Where artificial-intelligence tools are used in connection with programming instruction or student work, their use remains subject to **CTR Catholic Schools Administrative Procedure GEN 27 — Guidelines for Artificial Intelligence Use by Staff and Students**. In particular, students must not upload personal information to AI services and may only upload student work to such services when permitted by their teacher and CTR Catholic Schools requirements. Introducing new AI functionality that materially changes how personal information or student work is processed may require additional notice, review, or changes to this Privacy Policy. ## 12. Access and Correction Individuals may have rights under Alberta's Protection of Privacy Act to request access to personal information held about them and to request correction of inaccurate or incomplete personal information. Requests or questions concerning personal information may be directed to the school or to: **Access to Information and Privacy Coordinator** Christ The Redeemer Catholic Schools #301, 23 Riverside Drive P.O. Box 1318 Okotoks, Alberta T1S 1B3 Phone: 403-938-8076 Email: [[email protected]](mailto:[email protected]) ## 13. Privacy Questions and Concerns Questions about NDC Coding's operation may be directed to the NDC Coding administrator or appropriate school administration. Questions, concerns, or complaints regarding the collection, use, disclosure, protection, retention, or disposal of personal information may also be directed to the CTR Catholic Schools Access to Information and Privacy Coordinator using the contact information above. ## 14. Changes to this Policy This Privacy Policy may be updated when NDC Coding's features, authentication methods, service providers, or information practices change, or when applicable legal or CTR Catholic Schools requirements change. The current version will remain publicly available at this location, and the effective or last-updated date will be shown at the top of the policy.