Data Protection Policies for Curriculum Warehouse

---

Effective Date: August 22, 2026 Last Updated: August 23, 2026 Curriculum Warehouse, operated by NJ Data Diva LLC, is designed with security, client separation, and responsible data handling as core platform principles. This Security & Data Protection Policy outlines the administrative and technical practices employed to ensure robust data protection policies for the information processed through Curriculum Warehouse, promoting privacy protection and maintaining website security measures. This policy should be read in conjunction with the Curriculum Warehouse Terms of Service, Privacy Policy, Terms of Use, Student Data Scope, Subprocessors, and Service Level Agreement. While no online service can guarantee absolute security, Curriculum Warehouse utilizes commercially reasonable safeguards to reduce risk, protect client environments, and ensure a timely response to any arising security concerns.

1.1 Private Platform Infrastructure

The private Curriculum Warehouse application is built and hosted using services from Google Cloud Platform and Firebase, which include Firebase Hosting and the associated Google Cloud/Firebase infrastructure, ensuring robust privacy protection for all data. 

The private Platform currently leverages managed cloud infrastructure for functions that may include:

- application hosting;

- authentication;

- database services;

- file storage;

- server-side processing;

- backup and recovery processes; and

- related Platform operations. 

Client curriculum information and private Platform data are securely maintained within the Google Cloud/Firebase environment, adhering to stringent data protection policies.

1.2 Public Website Hosting

The public Curriculum Warehouse marketing and legal website at curriculumwarehouse.com is hosted and managed through GoDaddy, employing website security measures to protect user information.

The public website is distinct from the private Curriculum Warehouse application, ensuring that GoDaddy does not serve as the primary hosting environment for Client curriculum data or the private Curriculum Warehouse Platform.

1.3 United States-Based Infrastructure

Primary Curriculum Warehouse Platform data is hosted on United States-based Google Cloud infrastructure, complying with applicable data protection policies.

Relevant Platform services operate within U.S.-based Google Cloud infrastructure based on Platform configuration and the technical requirements of the applicable Google Cloud/Firebase service, ensuring privacy protection.

1.4 Physical Infrastructure

Curriculum Warehouse does not independently run physical data centers. 

Physical infrastructure protections for the private Platform are managed by the respective cloud infrastructure provider, which includes critical website security measures. Google Cloud enforces physical and environmental security controls within its data-center infrastructure, covering:

- physical access;

- facility security;

- monitoring;

- restricted infrastructure access; and

- other physical protections maintained by Google.

2.1 Encryption in Transit

Curriculum Warehouse employs robust data protection policies, utilizing encrypted HTTPS connections to safeguard information transmitted between supported user browsers and Platform services. 

Transport encryption is facilitated through industry-standard TLS protocols, which are supported by the applicable hosting infrastructure, ensuring strong website security measures.

2.2 Encryption at Rest

Platform information stored through the relevant Google Cloud services is protected using Google Cloud's default encryption-at-rest infrastructure, aligning with our commitment to privacy protection. 

Google Cloud encrypts customer content at rest within applicable services, leveraging AES-256 encryption at the storage layer where supported by the relevant Google Cloud service.

2.3 Encryption Key Management

Curriculum Warehouse currently relies on Google-owned and managed encryption keys associated with Google Cloud's default encryption infrastructure unless specifically configured otherwise. 

It is important to note that Curriculum Warehouse does not assert that Clients independently control or have access to the underlying cloud-provider encryption keys.

3.1 Supported Authentication

Curriculum Warehouse may support authentication through:

Google Workspace;

Microsoft 365;

Firebase Authentication; and

other supported authentication providers as Platform functionality evolves, ensuring robust website security measures.

3.2 Single Sign-On

Where a Client uses Google Workspace or Microsoft 365 Single Sign-On (“SSO”), authentication occurs through the applicable identity provider, aligned with strong data protection policies. 

Curriculum Warehouse does not receive or store the user's Google Workspace or Microsoft 365 password, further enhancing privacy protection.

3.3 Non-SSO Accounts

Where Firebase Authentication is used, authentication credentials are managed through the applicable authentication service, prioritizing user security. 

NJ Data Diva LLC personnel do not have access to users' plain-text passwords, thus upholding strict website security measures.

3.4 Client Responsibility

Clients remain responsible for:

determining who should receive Platform access;

maintaining appropriate identity-provider settings;

configuring access so that only authorized professional users receive Platform access;

disabling or modifying access when personnel leave or change responsibilities;

protecting local credentials and accounts;

and notifying Curriculum Warehouse of suspected compromised or unauthorized access.

Students are not intended to be Authorized Users of the private Curriculum Warehouse Platform. 

Additional information regarding unintended student authentication is provided in the Curriculum Warehouse Student Data Scope and Privacy Policy, which complements our commitment to privacy protection.

4.1 Role-Based Access

Curriculum Warehouse implements role-based access controls, which are crucial for data protection policies, designed to limit Authorized Users to information and functions appropriate to their assigned access.

Current Client-level Platform roles include:

- Admin;

- Supervisor;

- Editor; and

- Viewer.

An account may also be placed in an Inactive state to enhance privacy protection by preventing ordinary Platform access.

A separate Corporate Admin role is reserved for authorized NJ Data Diva LLC personnel who require Provider-level access for legitimate Platform administration, configuration, support, security, maintenance, recovery, or related operational purposes.

4.2 Database-Level Access Controls

Platform access controls prioritize robust website security measures that are enforced through backend and database security logic rather than relying solely on what is visible within the user interface.

4.3 Client Separation

Curriculum Warehouse employs a multi-Client architecture designed specifically to separate each Client's private Platform environment, reinforcing data protection policies. Ordinary Client users are not authorized to access another Client's private curriculum environment. Access-control rules, Client identifiers, authentication information, and Platform permissions are utilized to restrict Platform requests to the appropriate Client environment.

4.4 Provider Administrative Access

Authorized NJ Data Diva LLC personnel with Corporate Admin or other Provider-level administrative access may access Client environments where reasonably necessary to:

- configure Client environments;

- provide technical support;

- troubleshoot Platform issues;

- maintain Platform security;

- perform authorized migration or recovery work;

- investigate suspected misuse or security incidents;

- maintain system and data integrity; or

- operate and maintain the Platform.

Provider-level access is not intended for routine evaluation of Client personnel.

5.1 Platform Activity and Audit Records

Curriculum Warehouse generates system and audit records associated with specific Platform activity to ensure compliance with data protection policies.

Depending upon Platform functionality, these records may include:

- authentication and login events;

- session dates and times;

- active session duration;

- administrative actions;

- curriculum changes;

- publishing or approval activity;

- exports or downloads;

- security-related events; and

- other system-generated Platform interactions.

Such information may assist with:

- account administration;

- session management;

- security investigations;

- troubleshooting;

- identifying unauthorized activity;

- curriculum workflow accountability;

- operational visibility;

- usage analysis;

- system performance;

- support requests; and

- Platform improvement efforts in alignment with privacy protection initiatives.

5.2 Active Session Duration

Curriculum Warehouse may track the duration of active Platform sessions to enhance website security measures.

Active session duration may be used for purposes including:

- session management;

- operational visibility;

- Platform administration;

- usage analysis;

- troubleshooting;

- security; and

- Platform improvement.

Active session information is intended to describe activity within Curriculum Warehouse and is not designed as a payroll, attendance, or employee timekeeping system. Therefore, it should not be relied upon as the sole measure of an individual's:

- attendance;

- hours worked;

- productivity;

- compensation eligibility; or

- job performance.

5.3 Client Administrative Visibility

Depending upon Platform configuration, assigned roles, and permissions, certain audit and activity records may be made available to authorized Client administrators. The Client is responsible for its use of such information in accordance with applicable law, Board policy, employment agreements, collective bargaining obligations, and internal procedures, ensuring it aligns with established data protection policies.

5.4 Provider Access to Activity Information

Authorized NJ Data Diva LLC personnel may access audit, session, and security information only where reasonably necessary to:

- operate and secure the Platform;

- administer Client environments;

- troubleshoot technical issues;

- respond to Client support requests;

- investigate suspected security incidents or misuse;

- maintain system integrity; or

- satisfy applicable legal obligations related to privacy protection.

5.5 Scope of Monitoring

Curriculum Warehouse does not monitor a user's browsing, communications, device activity, or online activity outside of the Curriculum Warehouse Platform. Detailed information regarding Platform activity, active session duration, audit records, and their use is provided in the Curriculum Warehouse Privacy Policy, further emphasizing the commitment to data protection policies.

6.1 Backup Processes

Curriculum Warehouse employs backup processes that align with data protection policies to safeguard Client curriculum information against risks such as accidental deletion, corruption, Platform failure, or other potential data-loss events.

The backup architecture may involve provider-managed cloud backup capabilities and Curriculum Warehouse-controlled backup or recovery processes, ensuring robust privacy protection for sensitive information.

6.2 Recovery

When technically feasible and suitable, Curriculum Warehouse utilizes available backups or recovery mechanisms to restore information after incidents like accidental deletion, data corruption, Platform failure, or other recoverable data-loss events. Depending on the nature of the event, recovery may necessitate Provider or developer-level administrative support, highlighting the importance of comprehensive website security measures.

6.3 Client-Specific Recovery

The Platform's Client-separated architecture is designed to facilitate recovery operations that can, where technically feasible, target specific Clients, courses, curriculum areas, or other limited datasets without intentionally altering unrelated Client data.

6.4 Recovery Limitations

While backup and recovery systems significantly reduce the risk of data loss, they cannot guarantee that every item of information will be retrievable in all circumstances. Unless expressly specified in a Client-specific agreement, Curriculum Warehouse does not promise a particular recovery-point objective, recovery-time objective, backup-retention period, or historical restoration window. Clients are encouraged to maintain their own copies of information for archival, records-management, or legal-retention purposes, in line with best practices for data protection.

7.1 Security-Oriented Development

Curriculum Warehouse incorporates robust security considerations into Platform development and maintenance as part of its data protection policies.

Security-related development practices may include:

- review of authentication logic;

- role and permission testing;

- review of database security rules;

- client-isolation testing;

- dependency and configuration review;

- investigation of reported vulnerabilities;

- security-focused code review; and 

- remediation of identified security issues to enhance privacy protection.

7.2 Platform Updates

NJ Data Diva LLC may implement security updates, configuration changes, infrastructure improvements, dependency updates, or other technical changes when reasonably necessary to protect the Platform or Clients through effective website security measures.

Emergency security changes may be implemented without advance notice when delay could materially increase security or operational risk.

7.3 Security Assessments

Curriculum Warehouse may conduct internal reviews or utilize technical tools and qualified external resources to evaluate Platform security, aligning with our data protection policies.

Unless expressly stated otherwise, Curriculum Warehouse does not represent that NJ Data Diva LLC or Curriculum Warehouse itself currently holds an independent SOC 2 or ISO certification.

Curriculum Warehouse benefits from the security and compliance controls maintained by its cloud infrastructure providers, which enhance its data protection policies. Google Cloud upholds independent certifications, attestations, and audit programs that pertain to various aspects of its infrastructure and services, including key programs like SOC 2 Type II and ISO/IEC 27001. These certifications and attestations specifically apply to Google Cloud and the Google services covered within their respective audit scopes. It is important to note that these should not be viewed as independent certification of NJ Data Diva LLC or Curriculum Warehouse itself. For further details regarding privacy protection and the website security measures in place, additional information about Google Cloud's security and compliance can be found in Google's published resources.

9.1 Provider Response

If NJ Data Diva LLC discovers or confirms unauthorized access to Client data, Curriculum Warehouse will notify the affected Client without unreasonable delay, following our data protection policies and in accordance with applicable law.

Where applicable law requires notification immediately following discovery or establishes another notification deadline, that requirement will take precedence. Nothing in this Policy is intended to extend a shorter notification period required by applicable law.

The initial notice may be based on the information reasonably available to Curriculum Warehouse at the time of notification. Additional information regarding privacy protection may be provided as the investigation progresses.

Curriculum Warehouse will make commercially reasonable efforts to:

- investigate the incident;

- contain and mitigate further unauthorized access or harm;

- identify the nature and scope of the affected information;

- remediate identified vulnerabilities where reasonably possible;

- cooperate with the affected Client regarding reasonable incident-response needs and website security measures.

9.2 Investigation and Mitigation

Curriculum Warehouse will make commercially reasonable efforts to:

- investigate the incident;

- identify the nature and scope of the affected information;

- contain or mitigate the incident;

- remediate identified vulnerabilities where reasonably possible;

- cooperate with the affected Client regarding reasonable incident-response needs related to data protection policies.

9.3 Client Security Events

Clients should promptly notify Curriculum Warehouse if they become aware of:

- compromised credentials;

- unauthorized Platform access;

- suspicious account activity;

- compromised Client identity-provider systems;

- unintended student authentication or unauthorized student access; or

- any other security event that may affect Curriculum Warehouse’s commitment to privacy protection.

9.4 Protective Suspension

NJ Data Diva LLC may temporarily restrict an affected account, user, Client environment, or portion of the Platform when reasonably necessary to prevent:

- unauthorized access;

- malicious activity;

- data manipulation;

- further security harm; or

- material interference with Platform integrity, all in light of the established website security measures.

Where reasonably feasible, restrictions will be limited to the scope and duration reasonably necessary to address the identified risk.

10.1 Shared Responsibility

Security is a shared responsibility crucial for data protection policies.

Curriculum Warehouse is accountable for commercially reasonable safeguards within the Platform and Provider-controlled systems, ensuring a comprehensive approach to privacy protection.

Clients and Authorized Users maintain responsibility for the security of systems and configurations that fall outside Curriculum Warehouse's control, including:

local networks;

computers and mobile devices;

browsers;

identity-provider accounts;

email accounts;

passwords and authentication credentials;

Client-managed permissions;

SSO and access configuration; and

internal administrative procedures.

10.2 Security Questions and Reviews

Clients may reach out to NJ Data Diva LLC with reasonable security questions or requests for additional technical information regarding our data protection policies.

Where appropriate, Curriculum Warehouse may provide further security documentation to authorized Client representatives, ensuring transparency in website security measures.

Sensitive information about:

detailed Platform architecture;

database security rules;

credentials;

administrative security configurations;

recovery procedures;

institutional testing;

vulnerability information; or

any other data whose disclosure could pose a security risk

will remain confidential and not be publicly disclosed.

10.3 Related Service Providers

Third-party providers may aid in the operation of Curriculum Warehouse or related business services, reinforcing our commitment to privacy protection.

The current Curriculum Warehouse Subprocessors page identifies relevant providers and distinguishes between:

the Google Cloud/Firebase infrastructure used for the private Platform;

GoDaddy services utilized for the public Curriculum Warehouse Website;

appropriate communication service providers; and

Client-selected identity providers.

10.4 Changes to This Policy

NJ Data Diva LLC may revise this Security & Data Protection Policy as Platform architecture, infrastructure, security practices, technology, service providers, or applicable requirements change.

Updates will be published within the Curriculum Warehouse Terms & Policies center with a revised “Last Updated” date, ensuring that our website security measures are current and effective.

Material changes will not intentionally diminish the overall security protections of the Platform during an active Client term without a legitimate technical, legal, operational, or security reason.

10.5 Contact

Security inquiries or concerns about potential security issues may be directed to:

NJ Data Diva LLC

Curriculum Warehouse

Email: jackie@curriculumwarehouse.com

Website: curriculumwarehouse.com