Privacy policy
Pallara holds information about learners and staff at the institutions that use it. This explains what we hold, why, who else sees it, and what you can ask us to do about it.
Last updated 7 September 2026
The short version. We hold learner and staff information so your institution can run its programmes and meet its reporting obligations. We do not sell it, we do not use it for advertising, and we do not use learner information to train anybody's AI models. Each institution's data is isolated at the database level, not just in the interface.
Who this covers
Pallara is operated by PaaS HQ Limited (NZBN 9429053652676), 602 York Road, Midhirst 4394, New Zealand. This policy covers
pallara.app, the staff and student portals, the Pallara mobile app, and our
marketing site.
Two different roles. When your institution puts learner information into Pallara, your institution is the agency under the Privacy Act 2020 and we are its service provider — we act on its instructions, and privacy requests about a learner should go to the institution first. When we collect information about you directly — a demonstration enquiry, a support ticket, a billing record — we are the agency and this policy applies to us.
What we collect
Learner information, held for your institution
The categories depend on what the institution enables, and typically include: name and preferred name, date of birth, contact details and address, National Student Number, citizenship and residency status, ethnicity and iwi affiliation, disability information, prior education, enrolment and programme records, attendance, assessment submissions and results, fees and payment records, pastoral and wellbeing notes, and correspondence.
Several of these are collected because the Tertiary Education Commission, NZQA or the Ministry of Education require them for statutory returns. The Single Data Return, for example, mandates ethnicity, iwi affiliation, disability status, post codes and IRD number.
Staff information
Name, work contact details, role and permissions, authentication credentials, and a record of actions taken in the system.
Information we collect about you directly
Enquiry and demonstration requests, support correspondence, billing contacts, and basic technical information about your visit to our marketing site.
Technical and log information
IP address, browser and device information, pages and endpoints accessed, and timestamps. Important changes are recorded in a tamper-evident activity log to help authorised staff investigate activity.
Why we hold it, and on what basis
| Purpose | Detail |
|---|---|
| Delivering the service | Running enrolments, teaching, assessment, attendance, finance and communications for your institution. |
| Statutory reporting | Preparing and, where enabled, submitting SDR, ITR, NZQA results and NSI records on your institution's instruction. |
| Learner support | Attendance and progress signals that let staff intervene early. Every risk score is computed in code from real signals and is explainable. |
| Security and integrity | Authentication, access control, audit logging, fraud and abuse prevention. |
| Support and improvement | Diagnosing faults, and understanding which features are used. Aggregate only. |
| Billing and administration | Invoicing your institution and managing the contract. |
Artificial intelligence
Pallara includes a study tutor and tools for drafting, analysis and learner support. Your institution chooses the AI features and providers it uses.
- Information used. Depending on the feature, a model may receive your question, course content, attachments or selected institution records. This content can include personal information. Redaction reduces personal information in supported workflows, but is not a guarantee that every input is anonymous.
- Model training. We do not use your personal information to train or fine-tune models. Our data processing terms prohibit our sub-processors from doing so. Institutions configuring their own AI providers should check the provider's terms and settings before enabling a connection.
- Human oversight. AI suggestions and risk indicators support staff judgement. Changes to shared AI teaching guidance require approval. Other features return suggestions or act within the user's permissions; they do not all use a separate approval step.
Ask Your Data uses a model to plan a query from table and field names; the matching learner records are returned within Pallara rather than sent to that model. The staff assistant can send selected records to a model to prepare its answer. Only include information your institution has authorised for the feature and provider.
See our AI providers and data processing terms for more information.
Who else sees it
We do not sell personal information and we do not disclose it for advertising. We disclose it:
- To your institution — its authorised staff, under the permissions it sets.
- To government agencies on your institution's instruction — TEC, NZQA, the Ministry of Education and StudyLink, for the statutory returns your institution is required to make. Pallara does not initiate these; a person at your institution does.
- To sub-processors — the infrastructure and service providers listed on the sub-processors page, under contract, for the purposes stated there.
- Where the law requires it — a court order, statutory demand, or to prevent a serious threat to someone's life or health.
- On a change of ownership — with notice to your institution, and subject to the acquirer being bound by terms no less protective.
Where it is held, and for how long
Hosting locations. The standard managed service uses the following locations. Separate hosting arrangements are agreed with your institution.
| What | Where |
|---|---|
| Application servers | Sydney, Australia (DigitalOcean) |
| Primary PostgreSQL database | Sydney, Australia (DigitalOcean) |
| Uploaded files and documents | Cloudflare R2 |
| Email delivery, AI model providers | United States — see sub-processors |
Where information is sent overseas we take reasonable steps under information privacy principle 12 to ensure the recipient is subject to comparable safeguards, through contractual protections. Please discuss any data residency requirements with us during procurement so we can confirm suitable hosting arrangements.
Retention is set by your institution. Education records carry long statutory retention, and your institution decides how long each category is kept. Pallara supports document retention periods and legal holds. On termination we return or delete tenant data as set out in the terms of service. Audit logs are append-only and are retained for the life of the tenant.
How we protect it
Summarised here, in full on the security page: every tenant's data is isolated by PostgreSQL row-level security enforced in the database, not in application code; credentials and integration secrets are encrypted at rest; access is role-based and least privilege; all traffic is encrypted in transit; and every significant action is written to a tamper-evident log.
Your rights
Under the Privacy Act 2020 you may ask to see the personal information we hold about you and ask for it to be corrected. If we cannot correct it, you can ask that a statement of the correction you sought be attached to it.
If you are a learner or staff member at an institution using Pallara, ask your institution first — they hold the information and control it. We will help them respond. If you would rather come to us, write to [email protected] and we will pass your request to the institution and tell you we have done so.
We respond within 20 working days. There is no charge in ordinary cases.
If something goes wrong
If a privacy breach occurs that is likely to cause serious harm, we notify the affected institution without undue delay and support its notification to the Office of the Privacy Commissioner and to affected people, as required by the Privacy Act 2020. Our contractual notification timeframes are in the data processing terms.
Learners under 16
Some institutions enrol learners under 16. Where they do, the institution is responsible for any consent required. Pallara applies the same protections regardless of age, and the confidential records feature lets an institution restrict a record to named staff.
Complaints
Write to [email protected]. If you are not satisfied with our response you may complain to the Office of the Privacy Commissioner — privacy.org.nz, 0800 803 909.
Changes
We will update this policy as the platform changes. Material changes are notified to institution administrators before they take effect. The date at the top of this page is authoritative.