Here is the reply I was sent back.
GDPR Compliance Overview - Renaissance Learning
Thank you for reaching out. If you haven’t already, please start with our GDPR informational page (GDPR Compliance Overview - Renaissance Learning), which should answer a number of your questions. We do not send out a detailed sheet of our security measures, but I will see what we can put together for you. I’m copying in REDACTED, who can get you a copy of your current Terms and Conditions with Renaissance Learning. You’ll also want to talk the individual at your school who oversees the relationship with Renaissance Learning, as he or she will also know exactly what data elements we collect. The list can vary slightly from school to school. Additionally, you should be receiving a copy of our GDPR-ready contract addendum. If you have not received that, our main contact at your school likely already has.