Effective Date: July 31, 2017
Our ClassFlow Student Data Privacy Pledge
The privacy of personally identifiable student information is very important to us. We are honored that our customers choose ClassFlow as a trusted educational service provider and we strive to live by high data privacy and security standards. When we have access to the personal information of students, we commit to the following data privacy principles:
- We collect, store, process, and share student personal information only for the purpose of providing our Service or as authorized by a school or parent.
- We collect only as much student personal information as is needed to provide our Service.
- We will clearly and transparently disclose our data policies and practices.
- We do not share or sell student personal information with third parties for marketing purposes.
- We do not disclose student personal information for behavioral targeting purposes.
- We do not use student personal information for behavioral targeting purposes except to a parent with their express and explicit consent.
- We will maintain a comprehensive data security program designed to protect the types of student data collected within ClassFlow.
- We will delete or de-identify student personal information when it is no longer needed or at the direction or request of a school.
“ClassFlow” or the “Service” is provided by Promethean Limited (“Promethean,” “we,” “us,” or “our”). We are a limited company registered in England and Wales with our registered office at Promethean Limited, Promethean House, Lower Philips Road, Whitebirk Industrial Estate, Blackburn, Lancashire, BB1 5TH, United Kingdom.
“You” or “your” means a User of the Service. An “Individual User” as used in these Terms may be a teacher (or administrator), student, or parent using the free ClassFlow Service. Where applicable, “you” or “your” also means a school or school district or other educational institution otherwise known as an “Enterprise User” using the ClassFlow for Schools Service with whom the User is associated either as a student, teacher, or parent of a student, and is authorized by the Enterprise User to use the Service (an “Authorized User”). The term “User(s)” as used herein will refer to all users of the Service: Individual Users, Authorized Users, and Enterprise Users.
Table of Contents:
- What Information Do We Collect?
- How does Promethean Share Information with Others?
- Is Information About Me Secure?
- Retention and Deletion of Personal Information
- Communications Preferences
- Can I Access, Correct, or Delete Personal Information?
- Where does my Data Go?
- Children’s Privacy
2. What Information Do We Collect?
2.1 The Personal Information we collect depends on whether you are a teacher, a student, or a parent.
a. Information about Schools, Teachers, and Administrators:
We ask for certain information when a Teacher or School Administrator registers for a ClassFlow account or corresponds with us online, including first and last name, email address, user name and password, and any additional information you voluntarily provide in your ClassFlow profile, which could include, but is not limited to, your school affiliation and location, what grade level and subject matter you teach, your position within the school, and the type of devices your students use (collectively, “School Data”). We may also collect School Data if the school sends us a message, a teacher posts content or Resources to our website or through our Service, or responds to emails and surveys. We use this information to operate, maintain, and provide the features and functionality of the Service, to analyze and improve our Service offerings and functionality, and to communicate with our Schools and users.
b. Information about Students:
See “How Promethean Shares Information With Others” below for more information on the limited ways in which we share School Data and Student Data. See “Children’s Privacy” below for more information about how we collect and use the personal information of children under 13.
c. Information about Parents and Guardian:
We ask for certain Information when a parent or guardian registers for a ClassFlow account or registers to use an associated application. This includes but is not limited to a first and last name, email address, user name and password, and any additional information the parent or guardian voluntarily provides, which could include, but is not limited to the name and location of your child’s school and what your relationship is with the child (parent, grandparent, guardian etc.). We use this information to operate, maintain and provide the features and functionality of the Service, to analyze and improve our Service offerings and functionality, and to communicate with you.
2.2 Information Collected Through Technology:
We automatically collect certain types of usage information when you visit our website or use our Service. When you visit the Service, we may send one or more cookies (a tracking device) to your computer that uniquely identifies your browser and lets us help you log in faster and enhance your functionality and navigation through the site. A cookie may also convey information to us about how you use the Service (e.g., the pages you view, the links you click, and other actions you take on the Service). We may collect log file information from your browser or mobile device each time you access the Service. Log file information may include anonymous information such as your web request, Internet Protocol (“IP”) address, browser type, browser language, information about your mobile device, referring / exit pages and URLs, number of clicks and how you interact with links on the Service, domain names, landing pages, pages viewed, and other such information. We may employ clear gifs (also known as web beacons) which are used to anonymously track the online usage patterns of our Users. In addition, we may also use clear gifs in HTML-based emails sent to our non-student users to track which emails are opened and which links are clicked by recipients. The information allows for more accurate reporting and improvement of the Service. We may also collect analytics data, or use third-party analytics tools, to help us measure traffic and usage trends for the Service. Although we do our best to honor the privacy preferences of our visitors, we are not able to respond to Do Not Track signals from your browser at this time. To understand exactly what cookies are used on our free ClassFlow Service and what cookies are used on the ClassFlow for Schools Service, you may review our ClassFlow Cookies Policy.
When you access our Service by or through a mobile device, we may receive or collect and store information about your mobile device such as your mobile carrier, device type, model and manufacturer, mobile device operating system brand and model, and, depending on your mobile device settings, your geographical location data at the city, state, or country level. We receive this information in the aggregate so that we can monitor broad trends and usage statistics.
We use or may use the data collected through cookies, log file, device identifiers, location data and clear gifs information to: (a) remember information so that you will not have to re-enter it during your visit or the next time you visit the site; (b) provide custom, personalized content and information, including targeted content relating to our Service; (c) provide and monitor the effectiveness of our Service; (d) monitor aggregate metrics such as total number of visitors, traffic, usage, and demographic patterns on our website and our Service; (e) diagnose or fix technology problems; (f) investigate fraud or misuse of the Service and (g) otherwise to plan for and enhance our Service. We do not allow third party advertising networks to collect information about Students, Teachers or Parents who are logged into our Service.
3. How Does Promethean Share Information with Others?
We share data within the Service as needed to perform the Service. For example, Student Data and School Data will be shared with the teacher, school administrator, and parent authorized to receive Student Data for an educational purpose. Sharing within the Service will depend on the settings and functionality selected by the school or teacher. Promethean only shares Personal Information with third parties in the limited circumstances, described below. WE NEVER SHARE OR SELL STUDENT DATA WITH THIRD PARTIES FOR MARKETING PURPOSES OR ADVERTISEMENTS. We never share or sell Personal Information about teachers, administrators or parents with third parties for marketing purposes or advertisements unless you give us your consent to do so.
a. If you are a teacher or administrator and you choose to upload Resources to the ClassFlow Marketplace (whether for a fee or for free), a profile will automatically be created for you. All of the information you input into your profile, will be publicly available to other teachers who are ClassFlow account holders and to anyone who comes across your Resource in an off-line search of the Marketplace or in a search via a search engine such as Bing or Google. You are required to fill in the fields for first and last name in the profile, but you may use a pseudonym instead of your actual first and last names if you do not want your real name publicly associated with your profile. You will also have the choice to include other information about yourself by completing the other optional fields on the profile page. This information will also be publicly available in connection with your profile. Please do not populate the optional fields if you do not want that information made publicly available. See ClassFlow Marketplace Terms and Conditions.
b. We may disclose your Personal Information as required or authorized by law or when we believe that disclosure is necessary to comply with a judicial proceeding, court order, or legal process served on us; to enforce or apply our Terms of Service, Acceptable Use Policy, or other agreements (including to disclose Personal Information to law enforcement, your school, or your employer); or protect the rights, property, or safety of Promethean, our employees, our Users, or others.
d. We may share Personal Information with certain trusted third party companies and individuals to perform tasks on our behalf, but strictly for the purpose of carrying out their work for us, for example, to help us provide the Service, enhance the Service, to increase the Service’s functionality and user-friendliness, and improve your experience using the Service. By way of example, we us Amazon Web Services to host the Service on their servers; we use Google Analytics to help us track user behavior, user traffic, visitor traffic, and provide system analytics; we use Pardot as our marketing automation service which we use to record user interactions with the Service; and we use Intercom for marketing automation, to obtain user feedback, provide customer support, contact users about features within the Service, and conduct live chats within the Service. The Intercom service, however, is not activated (turned on) for Student accounts. To be clear, Students will not be contacted via Intercom, and Students will not have live chat functionality available to them within their account.
e. We may also share information with others in an aggregated and anonymous form that does not reasonably identify you directly as an individual. For example, we provide analytics and usage information through our ClassFlow for Schools Service, such as providing reports to Schools for the purpose of determining how often Users use or don’t use the Service, which features Users use the most or use the least, and which resources Users access, all for the purpose of improving the Service, increasing the functionality and user-friendliness of the Service and improving the School’s and the User’s overall experience using the Service.
f. How Student Data is shared: In addition to the actions described above, Promethean may facilitate the sharing of Student Data with third parties through the Service, though only when instructed and authorized to do so on behalf of the School. For example, some elements of our Service enable Schools to interact with parents, students, administrators and other teachers for the benefit of the student’s education. Promethean does not facilitate the sharing of any Student Data with third parties on or through the Service except on behalf of the School after the School has authorized such data sharing.
4. Is Information About Me Secure?
Data security is very important to Promethean. Promethean maintains strict administrative, technical and physical procedures to protect information stored in our servers. Access to information is limited (through user/password credentials and two factor authentication) to those employees who require it to perform their job functions. We use industry standard SSL (secure socket layer technology) encryption to transfer Personal Information. Other security safeguards include but are not limited to data encryption, firewalls, and physical access controls to buildings and files. You can help protect against unauthorized access to your account and Personal Information by selecting and protecting your password appropriately and limiting access to your computer and browser by signing off after you have finished accessing your account.
5. Retention and Deletion of Personal Information:
a. We will retain your information for as long as your account is active or as needed to provide you the Service, or as described below. If you wish to cancel your account, please contact us info@ClassFlow.com.
b. If you are an Enterprise User, during the term of your ClassFlow For Schools subscription, we will retain or destroy any Personal Information held within your ClassFlow for Schools account in accordance with the School’s specific policy or instructions relating to the retention and destruction of School Data with the exception that we may retain and use certain Personal Information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.
c. If you contributed to the ClassFlow Marketplace, you were required to create a profile. When you close your ClassFlow account, your profile will remain visible to the public on the ClassFlow Marketplace unless you remove your Resources from the Marketplace prior to closing your account. If you do not want your personal information in your profile to remain visible, you should remove the optional information in your profile, and replace your actual first and last name with a pseudonym prior to closing your account.
d. Student Data. Promethean will promptly delete or de-identify Student Data upon request or instruction by the School or Teacher within thirty (30) days of such request or instruction. Please contact us at privacy@ClassFlow.com to request account deletion. We will retain, delete, or de-identify Student Data according to our policies below:
(i) ClassFlow for Schools Accounts. Upon expiration or termination of a School’s ClassFlow for Schools subscription, all data, including Student Data, within the School’s unique ClassFlow Subdomain will be maintained by Promethean for a period of ninety (90) days, during which time the School will have access to the ClassFlow Subdomain for the purpose of accessing the Student Data and the School Data and/or reinstating the School account. Unless subject to specific terms in our agreement with a School, all of the data within the school’s unique ClassFlow Subdomain, including Student Data, will be de-identified such that it is permanently irretrievable or destroyed within ninety (90) days following termination or expiration of the subscription term, or earlier upon the School’s request. Unless otherwise specified in the terms of our agreement with a School, for any student account that the student does not log into for a period of twelve (12) months, all Student Data in each such account will be de-identified so that the Student Data in each such account is permanently irretrievable. We may maintain anonymized or aggregate Student Data, including usage data, in a form that does not reasonably identify a particular individual, for analytics purposes.
(ii) Free ClassFlow Accounts. Individual teachers who set up class rosters using their free ClassFlow account are responsible for deleting those classes from their ClassFlow accounts once the classes end. When the class is deleted, the class code for the class is disabled and a Student will not be able to log into the Service using that class code. If the Student is not associated with another class roster, the Student’s account will be disabled. When an individual teacher terminates his or her free ClassFlow account, all Student accounts that were established at the direction of that teacher will also be disabled unless the Student is using the same account at the direction of another teacher(s) who maintains a current ClassFlow account. Promethean will also disable a Student account established on the free ClassFlow Service if the student has not logged into the account for more than twelve (12) months. All Student Data in each disabled account will be de-identified so that the Student Data in each such disabled account is permanently irretrievable. After a student account has been de-identified, a student may create a new account in the future only if the student creates a new ClassFlow account and enters a valid class code provided by a teacher. Information associated with a student’s former account that has been de-identified cannot be retrieved or made available to the student via any new student account. We may maintain anonymized or aggregate Student Data, including usage data, in a form that does not identify a particular individual, for analytics purposes.
If you are a teacher using the free ClassFlow Service and you wish to cancel your account you must contact us at info@ClassFlow.com. Once an account is closed, the Teacher will no longer have access to any materials saved in the account. However, we may retain and use your Personal Information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements and to communicate with you. We will take reasonable steps to securely de-identify or destroy such information when it is no longer needed for those requirements.
6. Communications Preferences.
As part of the Services, if you are a teacher/administrator or parent you may receive from Promethean emails or other types of communications relating to your use of the Service or your user profile. You acknowledge and agree that by using the Service, Promethean and its trusted third party companies on behalf of Promethean may send you email, contact you, or engage in other communication that we determine relates to your profile or use of the Service. For example, we may email you to send updates, a newsletter, or other news regarding the Service or to simply send you notifications. You will always have the option to unsubscribe from receiving these emails by clicking on the “unsubscribe” button within the body of the email. Please note that you are not permitted to unsubscribe or opt-out of non-promotional messages regarding your account, such as account verification, change or updates to features of the Service, or technical and security notices.
Communications with Students. Promethean may send email notifications or otherwise communicate with students only on behalf of and at the direction of the school, teacher, or district. We may, in limited circumstances, also send certain Service-related messages to students, such as account verification or technical and security notices.
7. Can I Access, Update, Correct, or Delete Personal Information?
You may access, correct, update, or delete your Personal Information in your profile by making the change on your account profile page or contacting privacy@ClassFlow.com.
Please be advised that requesting removal of or not providing certain information may result in your not receiving notification of updates to the Service or other valuable information regarding your use of the Service. Failure to provide information requested by Promethean or removing certain information may mean that you are not able to access relevant features of the Service and may even result in your not being able to use the Service at all.
If you are using the ClassFlow for Schools Service that is integrated with a school SIS, any request to access or make changes to or delete Personal Information including Student Data must be made by the School within the SIS. Once the changes are made within the SIS, the changes will automatically appear within the ClassFlow for Schools Service.
If you are using the ClassFlow for Schools Service and the School is not integrating its SIS with the Service, any request to access, make changes to or delete Personal Information including Student Data must be made by the School’s designated User Administrator. The User Administrator will be provided access to the School’s Authorized Users’ profile pages in order to update, correct, or delete the information contained therein.
If you are an individual teacher using the free ClassFlow Service, any class rosters that you have created containing Student Data must be deleted from your ClassFlow account once those classes have ended. Student Data associated with the Teacher’s account on the free ClassFlow Service is controlled by the teacher or school. If you have a question about reviewing, modifying or deleting Student Data from a teacher’s account, please contact the teacher or school directly or you may contact Promethean at privacy@ClassFlow.com.
EU Users: Accessing, Correcting, and Deleting your Personal Information: If you are an EU resident, you have certain rights in relation to your Personal Information: (i) the right to be informed about how your Personal Information is being used; (ii) the right to access the Personal Information we hold about you; and (iii) the right to request the correction of inaccurate Personal Information we hold about you and to request the blocking or deletion of your Personal Information where the processing does not comply with local data protection laws. To exercise any of the above rights, or if you have any questions relating to your rights, please contact us by using the details set out in the “Contacting Us” section below. Please provide as much information as you can about the Personal Information you are enquiring about. We will respond to your request within thirty (30) days (or less, if required by law). If you ask us to correct, update, delete, or change the Personal Information we hold about you, we will do so if we are satisfied that this is required. If we decide not to change your Personal Information in the manner you have requested, we will advise you of this in writing and how you can complain if you are not satisfied with our decision. If you request a change to your Personal Information and we do not make that change, you may request that we note on our records that you requested a change to your Personal Information that was not made and the reasons that change was not made.
Please contact us at privacy@ClassFlow.com if you have questions about accessing, correcting or deleting your Personal Information.
8. Where does my Data Go?
a. You acknowledge and agree that Promethean will store and process Personal Information in various data centers around the world, including the United States, and that your Personal Information may not be stored or processed only within the country in which it was collected unless and except to the extent required by law. If you are located in the European Union (the “EU”) or other regions with laws governing data collection and use that may differ from U.S. law, please note that we may transfer information, including personal information, to a country and jurisdiction that does not have the same data protection laws as your jurisdiction. As such, Promethean has entered into standard EU model contract clauses with its intragroup companies with which it shares Personal Information to ensure that the transfer of personal data of EU citizens outside the European Economic Area is safeguarded in the same way the data is required to be safeguarded in the EU. You warrant and agree that Promethean may transfer and process your Personal Information in the United States or any other country in which Promethean or its parent, subsidiaries, affiliates, or service providers maintain facilities. If applicable, you further warrant and agree that you have obtained all necessary consents from your students or Authorized Users for Promethean to process such Personal Information in the United States and elsewhere in the world.
b. You are responsible for understanding and complying with the local data protection and data privacy laws where you reside. By using ClassFlow, you consent to your Personal Information being sent to and stored at the applicable location as outlined herein.
9. Children’s Privacy
Promethean does not knowingly collect any information from children under the age of thirteen (13) unless and until a School or teacher has provided appropriate consent and authorization for a student under thirteen (13) to use the Services and for Promethean to collect information from such student. Please contact us at firstname.lastname@example.org if you believe we have inadvertently collected personal information from a child under thirteen (13) without proper consents so that we may delete such information as soon as possible.
11. For California Users
|As related to California AB 1584 (Buchanan) Privacy of Pupil Records: 3rd-Party Digital Storage & Education Software (Education Code section 49073.1), we agree to the following:
1. Pupil records obtained by Promethean from a Local Educational Agency (an “LEA”) continue to be the property of and under the control of the LEA. The LEA, retains full ownership rights to the information in the personal information and education records it provides to ClassFlow.
2. ClassFlow users may retain possession and control of their own generated content by signing into and accessing their ClassFlow account and downloading (or updating) their information within ClassFlow. Pupils have access to and control of their own information and pupil-generated content subject to the limitations imposed by the pupil’s teacher. For example, if a pupil completes an assessment using Promethean’s ClassFlow Service and submits the assessment to the teacher within ClassFlow, the pupil may only retain possession and control of (or change answers to) the assessment if permitted by the teacher.
3. Parents, legal guardians, or eligible pupils may review personally identifiable information in the pupil’s records and correct erroneous information by contacting their educational institution. Additionally, ClassFlow users may access, correct, update, or delete personal information in their profile by signing into ClassFlow, accessing their ClassFlow account, and making the appropriate changes, or by contacting us directly within ClassFlow by clicking on the question mark (“?”) in the top right hand corner of a ClassFlow page, or submitting your request to us at email@example.com.
4. We are committed to maintaining the security and confidentiality of pupil records. Towards this end, we take the following actions: (a) we limit employee access to pupil data to only those employees with a need to such access to fulfill their job responsibilities; (b) we conduct background checks on our employees and, specifically, upon all employees that may have access to pupil data; (c) we require employees to sign confidentiality agreements prior to being granted access to any sensitive data; (d) we conduct regular employee privacy and data security training and education; and (e) we protect personal information with technical, contractual, administrative, and physical security safeguards in order to protect against unauthorized access, release or use.
5. In the event of an unauthorized disclosure of a pupil’s records, we will (1) promptly notify the LEA unless specifically directed not to provide such notification by law enforcement officials; and (2) enact the response plan and procedures described in the Promethean Data Breach Incident Response Plan that is available to the LEA upon request.
7. We will not use any personal information within a pupil’s records in ClassFlow to engage in targeted advertising.
8. We will delete or de-identify pupil personal information when it is no longer needed, upon expiration or termination of our agreement with an LEA with any deletion or de-identification to be completed according to the terms of our agreement with the LEA, or at the direction or request of an LEA (school).
9. We will work with the educational institution to ensure compliance with FERPA by providing parents, legal guardians and pupils with the ability to inspect and review their pupil records within ClassFlow and the means to correct any inaccuracies therein.
a. If you are an Australian resident and you are not satisfied with how we have resolved your complaint, you can contact the Australian Federal Privacy Commissioner to make a complaint. For more information, go to www.oaic.gov.au.
©2017 Promethean Limited. All Rights Reserved.