Education AI Limited
Privacy Notice for Users
This privacy notice (Notice) explains how Education AI Limited collects, uses and shares your personal data, and your rights in relation to the personal data we hold.
In this Notice, us, we and our all refer to Education AI Limited, and you and your refer to our users, including students, teachers, school administrators, and all other users of our services and those who interact with us in any other way.
About this Notice
We may modify this Notice at any time. Any major changes or updates will be notified directly to those affected wherever practicable. We have also published specific privacy statements for children to accompany this Notice, which have been prepared with reference to the ICO Age Appropriate Design Code.
Data controller and contact details
Education AI Limited, a company registered in England with company number 12492284, is a ‘controller’ of your personal data and is subject to the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, Privacy and Electronic Communications Regulations 2003 and any successor legislation or regulations governing data protection and privacy in the UK.
Please note that your school (whether you are a teacher or a student) is likely to be a controller independent of us in respect of your use of our services. This is because it is schools rather than individuals who are our customers and who ultimately connect us to you (our users). This also means that we sometimes process personal data for and on behalf of your school, in which case we are a ‘processor’ of that data and your school is the relevant controller.
If you have any questions about this Notice, or if you would like to exercise any of your legal rights in respect of your personal data, please contact our Data Protection Lead using the following details:
- Email: firstname.lastname@example.org
- Post: FAO Daniel Richardson, Education AI Limited, Unit 16, Barkat House, 116-118 Finchley Road, London NW3 5HT.
How we collect your information
We may collect your personal information in a number of ways, including:
- from the information you provide to us when you fill in forms on our website (for example, via our “Contact Us” form);
- when you correspond with us by phone, email, or by other means, including when you contact our support team;
- when you register for a subscription for our services or to receive marketing communications;
- [when you complete our surveys and questionnaires;]
- when you create individual administrator, teacher and student profiles to use our services or when that information is updated;
- when teachers or school administrators use our teacher platform (Staff Platform) or student platform (Student Platform) to prepare and teach lessons, progress activities, track student progress, create their own curriculum, and otherwise when interacting with our curriculum;
- when students use our Student Platform to complete activities, lessons, use our learning tools, and otherwise when interacting with our curriculum;
- from the information provided to us through cookies when you browse our website, Staff Platform and Student Platform (please see our Cookies Policy);
- [from third-party social media platforms when you engage with us through these platforms, depending on your privacy settings on that platform;]
- in various other ways as you interact with us.
The types of information we collect
Registration. In order to use our services as a school client you will need to register your school. In order to do so, we require the following details from the account administrator:
- the registrant’s full name;
- email address;
- job role;
- school name and address.
Individual Accounts. Once registered, the account administrator will need to enter the details of teachers and students to provide them with individual access to our platforms. In order to do so, registered users will need to provide the following details:
- teachers: full name, title, email address, school and job role;
- students: full name and email address, school and class.
This will enable teachers to access the Staff Platform and Student Platform, explore content, assign tasks and review progress. It will enable students to access our Student Platform and have their performance tracked for analysis by their teacher. By adding any third party student or teacher details to the account, you are confirming that you have the necessary authority to do so.
Our ‘tenancy’ system
Our Platform/s are structured in such a way that each school account sits within its own secure ‘tenancy’. Once the tenancy is established, day to day administration of, and access to, individual users’ accounts resides with the school administrator. We do not access the information held within these tenancies other than in the context of the ‘pseudonymised’ performance data processing explained below.
Other personal information. In addition to the above, we may collect, use, store and process the following personal information about you, where relevant:
- Usage data about how you use our website and our services, including which lessons, activities and other parts of our curriculum are engaging and effective, the answers provided by students to the questions when completing activities on our Student Platform and the length of time taken to respond in each case. This information is required to enable us to provide statistical feedback to teachers on the engagement and performance of students, and so that we can understand how our services are being used. We collect this data on a ‘pseudonymised’ basis, which means we only process this information with reference to a numerical ‘object identifier’. That means it can be linked to an individual – but only where linked to a separate identifier. This is held separately and is only accessible by the school administrator within the specific tenancy. We do not hold this information in such a way that we can link the object identifier to an individual student, we simply see which tenancy (ie school profile) the object identifier belongs to.
- Technical data gained from your use of our website, including your internet protocol (IP) address, cookie identifier, browser type and version, time zone setting, browser plug-in types and versions, operating system, platform and geographic information [where this information is provided by you in our surveys or available from your social media posts on our social media sites];
- Website and marketing data such as which website pages you visited, how you navigated to our website, and how long you spent browsing our website and engagement with our direct marketing emails (such as whether the email was opened and if you opened hyperlinks within the email); and
- Correspondence data such as personal information provided by you in correspondence with us, including your request, our reply and your contact information in order to increase the efficiency of our business and to track our communications with you.
Please note that student names are only visible to users registered in the same class (and their teacher/s). We do not store any student’s biographical data or contact information [outside the school’s tenancy – which is accessed and managed by the school account administrator] and we will not proactively contact students.
Our legal basis for using your information
Where we have a contractual relationship with you
We will process your personal data where it is necessary for the performance of a contract with you or to take steps at your request prior to entering into a contract. In this respect, we use your personal data to carry out our obligations arising from any contracts entered into with you or the school with which you are associated.
We also process your personal information because it is necessary for our or a third party’s legitimate interests. Our legitimate interests include the provision of education services and developing / providing education tools in a user focused, efficient and sustainable manner, in accordance with all relevant legal rights and obligations. In this respect, we may use your personal data to:
- enable you to participate in our services;
- advertise and market our services – where you are a school account administrator (unless we provide material directly to you under contract, or in situations where it is required or appropriate to gain your consent);
- notify you about changes to our subscriptions and services;
- process enquiries, feedback, complaints, analyse our services and manage our internal record-keeping in relation to the same;
- for our internal purposes, such as quality control, site performance, system administration and to evaluate the use of your website and services, so that we can provide you with enhanced services;
- develop further education tools and refine our curriculum; and
analyse and improve the services we provide, including improving our website, Staff Platform and Student Platform and processing feedback.
We may also process your personal information for our compliance with our legal obligations. In this respect and if required, we may use your personal data to:
- comply with legal and regulatory obligations, e.g. safeguarding requirements;
- deal with legal claims and requests, including those made under data protection law, or requests for formal disclosure by competent authorities;
- administer and maintain such records as may be required by UK regulations and legislation from time to time.
We may process your personal information where we have your specific consent to do so (for example, where we have sought and obtained your consent to send you direct marketing by email or to set non essential cookies via our website). If you have given your consent and you wish to withdraw it, please contact us using the contact details set out above or click the “unsubscribe” link in the emails we send.
Sharing information with third parties
For the purposes referred to in this Notice and relying on the bases for processing as set out above, we may share your personal data with certain third parties, particularly technology subcontractors whom we engage to assist us in providing our services. Principally we use the secure cloud storage system provided by Microsoft (‘Azure’) for our Platforms. We may disclose limited personal data to a variety of other recipients including our professional advisers, where it is necessary for us to obtain their advice or assistance.
International transfers of data
Our servers – and those we use of Microsoft’s – are all hosted in the UK and therefore as a matter of course we do not routinely transfer personal information outside the United Kingdom and / or European Economic Area (EEA). Should any data need to be transferred outside the UK / EEA, we will consider whether any additional measures are required in order to give adequate protection for the information when it is transferred.
How long your information is kept
We may retain your personal data only for so long as is necessary to deliver our services to you, and to protect our legal interests or as otherwise stated to you when your data is collected.
We typically retain your personal data for 6 months after your agreement with us for the provision of services has expired or been terminated. However, some data may be retained for longer than this, for example, in order to defend legal claims.
Under the UK GDPR you have the following rights in relation to our processing of your personal data:
- to obtain access to, and copies of, the personal data that we hold about you;
- to require us to correct the personal data we hold about you if it is incorrect;
- to require us to erase your personal data in certain circumstances;
- to require us to restrict our data processing activities in certain circumstances (and, where our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before its withdrawal);
- to receive from us the personal data we hold about you which you have provided to us, in a reasonable format specified by you, including for transmitting that personal data to another data controller;
- to object, on grounds relating to your situation, to any of our processing activities where you feel this has a disproportionate impact on your rights;
- to complain about the processing of your data to the UK data protection regulator – the Information Commissioner’s Office (ICO) (www.ico.org.uk). The ICO does recommend that you first try and resolve the complaint with us.
Please note that the above rights are not absolute, and we may be entitled to refuse your requests where exceptions apply. For example, if we have reason to believe the personal data we hold is accurate or we can show our processing is necessary for a lawful purpose set out in this Notice.
Date of last update: April 2022