Educake Data and Privacy Policy

EDUCAKE PRIVACY POLICY

This website and app is operated by EDUCAKE LTD

We take your privacy very seriously and we ask that you read this privacy policy carefully as it contains important information on:

We may change this privacy policy from time to time. You should check this policy occasionally to ensure you are aware of the most recent version that will apply each time you access our website and app.

Who are we?

EDUCAKE LTD ('we' or 'us') are a 'data controller' for the purposes of the Data Protection Act 2018, the UK General Data Protection Regulation and any subsequent UK data protection legislation and we are responsible for, and control the processing of, your personal information.

Who does this privacy policy apply to?

This privacy policy applies to any individuals whose personal information we process during the course of business, which includes:

Whilst we also process personal data of students who engage with our website, app and services, we do this as a processor on behalf of that student’s School. This means that the School is the controller and as such this policy does not apply to students who use our app and services. Please see ‘How do we use Students’ Personal Data’ below.

If you are unsure how this policy applies to you, please contact us (see ‘How to contact us’ below) and we will be happy to help.

How do we use students’ personal data?

We process personal data of students who engage with our app and services. We do this as a processor on behalf of that student’s School. This means that the School is the controller and we only process students’ personal data in accordance with the School’s instructions.

As such, should a student (or their parent on their behalf) wish to enforce their rights in respect of how we process their data, this should be directed to their School who will instruct us accordingly. Still, we understand that it is important for you understand how and why we process students’ personal data. We have a ‘Student Privacy FAQs’ which provides you with further information about how we process students’ personal data and why: www.educake.co.uk/aboutus/student-privacy-faq

What information do we collect and process?

Personal information provided by you

During the course of accessing our website, app, using our products and services, contacting us, providing services to us, or otherwise dealing with us, you may provide us with a range of personal data which we will use in the course of our business. This personal information may include:

Information we collect automatically

Our website, app and services may collect certain information about you automatically (such as your IP address, MAC address and IMEI number, browser type and version, operating system, geo-location data based on your IP address).

Personal information provided by third parties

Occasionally we may receive information about you from other sources (such as our suppliers, customers, or group companies), which we will add to the information we already hold about you in order to help us operate our business effectively.

Personal information about other individuals

If you give us information on behalf of someone else, you confirm that the other person has appointed you to act on his/her behalf and has agreed that you can:

How we use your data and our legal basis for processing your data

We may process your data for a variety of reasons, including because:

In some instances, we will rely on your consent to process personal data and where we do this, it will be flagged to you at the time.

Our main processing activities for personal data, and the legal basis on which we perform those activities are:

Prospective customers/marketing recipients:

We will process your personal data in order to contact you in relation to our products and services and keep a record of our communications (e.g. sales telephone calls, quotations and offers).

Our legal basis for doing so is our legitimate interests, which allows us to market our products and services to individuals provided there is a business case for doing so and our interests do not override the rights of the individuals in question. If you wish to object to direct marketing, you may do so by contacting us.

Customer/users:

We will process your personal data in order to provide our products/services to you and to provide you with information and updates regarding the same. Our legal basis for doing so is that the processing is necessary for the performance of a contract. We will also keep a record of your data and use it for related purposes, including account management, customer support, and audit purposes, on the basis that we have a legitimate interest in doing so.

We may also contact you in relation to our other products and services. Our legal basis for doing so will be the same as for prospective customers, as set out above.

Suppliers, service providers etc.:

We will process your personal data in order to receive goods and/or services from you and to manage our relationship, including making payments to you, dealing with accounts issues, placing orders etc. Our legal basis for doing so is that the processing is necessary for the performance of a contract.

Other processing activities

Monitoring and recording communications

We may monitor and record communications with you (such as telephone conversations and emails) for the purpose of preventing unauthorised access and modifications to our services, training, fraud prevention, and/or quality assurance. We may also retain copies of communications and details provided to us by you, for example support requests, account queries, complaints, for internal account management and auditing purposes. This is done on the basis of legitimate interests and to comply with our legal and regulatory obligations.

Storage of your information and who your information might be shared with

We store your personal data on servers in data centres in Ireland, provided by Amazon Web Services (AWS). AWS datacentres are compliant with the international information security standard, ISO 27001.

For more information about AWS's ISO 27001 certification, please visit this webpage:
https://aws.amazon.com/compliance/iso-27001-faqs/

As your personal data is stored outside of the UK, we have Standard Contractual Clause (SCC) in place as part of our agreement with AWS. For further information regarding AWS, please see here:
https://aws.amazon.com/compliance/gdpr-center/brexit/

We may disclose your personal data to:

We also may disclose your personal data our agents and service providers, to the extent that they require access to the data in order to provide goods/services to us, in which case they will be bound by a contract requiring them to process personal data in accordance with the requirements prescribed by data protection law. Some of these agents and service providers may be based outside of the UK (or require the transfer of your personal data outside of the UK). In such cases, we only work with suppliers that transfer to territories which the UK has determined provides an adequate level of protection or otherwise ensure appropriate safeguards are in place to protect your personal data. In particular:

Keeping your data secure

We will use technical and organisational measures to safeguard your personal data, for example:

While we will use all reasonable efforts to safeguard your personal data, you acknowledge that the use of the internet is not entirely secure and for this reason we cannot guarantee the security or integrity of any personal data that are transferred from you or to you via the internet. If you have any particular concerns about your information, please contact us (see ‘How to contact us’ below).

What can I do to keep my information safe?

If you want detailed information from Get Safe Online on how to protect your information and your computers and devices against fraud, identity theft, viruses and many other online problems, please visit www.getsafeonline.org. Get Safe Online is supported by HM Government and leading businesses.

Transfers of your information out of the UK

We may transfer your personal data outside of the UK. We will only do this if appropriate safeguards are place in accordance with data protection legislation. For example, where relevant, we have entered into Standard Contractual Clauses (SCC) that will safeguard your privacy rights and give you remedies in the unlikely event of a security breach.

How long do we keep your personal information?

We keep your personal information for as long as we need to for the purposes for which it was collected or (if longer) for any period for which we are required to keep personal information to comply with our legal and regulatory requirements.

What rights do you have?

You are responsible for ensuring that information you provide to us is accurate, complete and up-to-date. You can review and change your information by contacting us.

You have a number of rights in relation to your personal data, these include the right to:

If you would like to exercise any of your rights or find out more, please visit our Data, Privacy and GDPR Help Page (here: https://help.educake.co.uk/en/collections/102774-data-privacy-and-gdpr) for details of how you can manage your data through your account or contact us.

Changes to this Privacy Policy

We may change this Privacy Policy from time to time, and if we do so we will highlight any changes to these pages. If you continue to access or use our services after notified changes have come into effect, you will have agreed to the revised policy.

How to contact us

Please contact us if you have any questions about this privacy policy or the information we hold about you. If you wish to contact us, please send an email to support@educake.co.uk or write to us at FAO: Educake Ltd, 30 St. Giles, Oxford, England, OX1 3LE or call us on 01865 800 808

Use of cookies

For information on the cookies we use and how to control your cookie settings, please visit our Cookie Policy www.educake.co.uk/aboutus/cookiepolicy.