Positive Test Plan for GBPA

Part 1: Privacy Policy

Last Edited: 23rd May 2018

1. 1. Introduction
   1. 1.1. We are committed to safeguarding the privacy of the users of our services. Our services include and will hereby be referred to as ‘Our Services’ (our websites used to promote eSchools services and tutorial resources, specifically http://www.eschools.co.uk/ and https://academy.eschools.co.uk/), ‘School Websites’ ( designed by eSchools and populated by individual schools themselves) and ‘Platforms’ (individual online services that provide teachers, learners, parents and governors with information, tools and resources) as well as our smartphone app. This policy sets out how we will treat your personal information across these services.
2. 2. Collecting personal information on Our Services
   1. 2.1 We may process or temporarily store the following kinds of personal information:
      • information about your computer and about your visits to and use of Our Services (including but not limited to, your IP address, geographical location, browser type and version, operating system, referral source, length of visit, page views and website navigation paths)
      • information contained in or relating to any communications that you send to us or send through our website (including, the communication content) via online forms
      • any other personal information that you choose to send to us via online forms
   2. 2.2 Before you disclose to us the personal information of another person, you must obtain that person's consent to both the disclosure and the processing of that personal information in accordance with the terms of this policy.
   3. 2.3 eSchools websites may request cookies to be set on your device. We use cookies to let us know when you visit our websites, how you interact with us and to enrich your user experience. You can adapt your cookie preferences, although please note that blocking some types of cookies may impact your experience on our websites and the services we are able to offer. We will not, without your express consent, supply your personal information to any third party for the purpose of their or any other third party's direct marketing. For further information on how you can manage and set your cookie preferences, please see our Cookie Policy.
   4. 2.4 Information submitted through the online contact form on a school website is processed via eSchools, and passed directly to the school in question. This data is held by eSchools for 30 days (or in the case of failed messages, 90 days) before deletion. Once passed to the school this data is held by them and subject to that school’s privacy policy.
   5. 2.5 Schools are also able to add analytics tools and can therefore gather information on visits to and use of their website (including but not limited to, IP address, geographical location, browser type and version, operating system, referral source, length of visit, page views and website navigation paths). Individual visitors can manage their preferences through cookie preferences, as mentioned in 2.4.
   6. 2.6 Session IP addresses are retained to monitor and safeguard against improper usage of our services.
   7. 2.7 Content on the platform (added by staff, governors and students) and website content is added directly by School Users. This information is only used for to display on the platform in the way the user intends and is not used for any other purposes by eSchools. At a time when a school ceases to use our services the content is removed within a 14 day period as detailed in our agreement with the school.
   8. 2.8 Some of our services require the school to provide access to information they require for use with those services. For example a school using our communication tool, Letters Home, which enables schools to contact parents by email regarding important school information. In this situation a school will provide eSchools with access to the email address(es) they wish to send their communication to. Schools have granular access to ensure only the required data is shared and accessed by eSchools. The data is frequently updated to ensure that eSchools only retains up-to-date data.
3. 3. Using your personal information
   1. 3.1. We may use your personal information to:
      • administer our services
      • enable your use of our services
      • troubleshoot and problem solve
      • send you email notifications that you have specifically requested. You can manage your preferences at anytime through your eSchools dashboard.
      • keep our services secure, safeguard against improper use of our services and prevent fraud.
      • 1. 3.1.1. For the purposes of providing you access to your eSchools platform and app (ie. forgotten password/login)
        2. 3.1.2. By registering for updates, School Staff/Governors are able to subscribe to our regular communications.
        3. 3.1.3. We will use any contact details supplied in an online form for the purposes explicitly detailed in said form. For example troubleshooting and problem solving or the provision of live online training as explicitly requested by you, the user.
   2. 3.2. We will not, without your express consent, supply your personal information to any third party for the purpose of their or any other third party's direct marketing.
   3. 3.3. eSchools understands our obligation to be mindful about the data we process and only process data that is required to fulfil our obligations in providing our services; to a school who enters into an agreement to use our services and you, the user.
   4. 3.4. We will not pass your information to third parties; except for the purpose of fulfilling our services to a school who enters into an agreement to use our services and you, the user or where we are required to do so by law.
4. 4. Disclosing personal information
   1. 4.1 We may disclose your personal information to, any of our employees, officers, insurers, professional advisers, agents, suppliers or subcontractors insofar as reasonably necessary for the purposes set out in this policy.
   2. 4.2 We may disclose your personal information:
      • to the extent that we are required to do so by law;
      • in connection with any ongoing or prospective legal proceedings;
      • in order to establish, exercise or defend our legal rights (including providing information to others for the purposes of fraud prevention and reducing credit risk);
      • to any person who we reasonably believe may apply to a court or other competent authority for disclosure of that personal information where, in our reasonable opinion, such court or authority would be reasonably likely to order disclosure of that personal information;
      • to the school in the case of improper use on the platform by individuals.
   3. 4.3 Except as provided in this policy, we will not provide your personal information to third parties.
5. 5. International data transfers
   1. 5.1. Data directly collected by eSchools may be stored and processed in and transferred between any of the countries in which we operate in order to enable us to use the information in accordance with this policy. Any third party we use is within the EEA or they hold a sufficient accreditation (i.e. Privacy Shield) as in line with requirements under the GDPR. No other third party are permitted to access the school’s data.
   2. 5.2. Personal information that an individual adds to our websites may be available, via the internet, around the world. We cannot prevent the use or misuse of such information by others.
6. 6. Retaining personal information
   1. 6.1. This Section 6 sets out our data retention policies and procedure, which are designed to help ensure that we comply with our legal obligations in relation to the retention and deletion of personal information.
   2. 6.2. Personal information that we process for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.
   3. 6.3. Data collected through analytic cookies will be retained for 26 months. Individual visitors can adapt the data collected through cookie preferences, as mentioned in 2.4.
   4. 6.4. Notwithstanding the other provisions of this Section 6, we will retain documents (including electronic documents) containing personal data:
      • To the extent that we are required to do so by law;
      • If we believe that the documents may be relevant to any ongoing or prospective legal proceedings; and
      • In order to establish, exercise or defend our legal rights (including providing information to others for the purposes of fraud prevention and reducing credit risk). Data will no longer be kept after the termination of the contract with the school.
7. 7. Security of your personal information
   1. 7.1. We will take reasonable technical and organisational precautions to prevent the loss, misuse or alteration of your personal information.
   2. 7.2. We will store all the personal information you provide on our secure (password- and firewall-protected) servers. The web service we employ has a broad range of accreditations and certifications and the data centres used ensure the data stays within the EEA.
   3. 7.3. eSchools use a Secure Sockets Layer (SSL) which creates a secure connection uses two keys to encrypt data in transit. Despite this, you acknowledge that the transmission of information over the internet is inherently insecure, and we cannot guarantee the security of data.
8. 8. Amendments
   1. 8.1. We may update this policy from time to time by publishing a new version on our website.
   2. 8.2 You should check this page regularly to ensure you are aware of any changes to this policy.
9. 9. Your rights
   1. 9.1. You may instruct us to provide you with any personal information we hold about you.
   2. 9.2. We may withhold personal information that you request to the extent permitted by law.
   3. 9.3. You may change your cookie preferences at any time as referenced in 2.4.
   4. 9.4. School Staff/Governors who subscribe to our Newsletter may manage their preferences at anytime through their eSchools dashboard.
10. 10. Third party websites
    1. 10.1 Our website includes hyperlinks to, and details of, third party websites.
11. 11. Updating information
    1. We will only provide communication about the eSchools platform to school staff/governors who can manage their preferences at anytime through their eSchools dashboard.

Part 2: Cookie Policy

Last Edited: 23rd May 2018

1. This Cookie Policy explains how eSchools use cookies and similar technologies in our Services. It explains what these technologies are and why we use them, as well as your rights to control their use.
2. What are cookies?

   Cookies are small data files that are placed on your computer or mobile device when you visit a website. Cookies are widely used by online service providers in order to (for example) make their websites or services work, or to work more efficiently, as well as to provide reporting information.

   Cookies set by the website owner or service provider (in this case, eSchools) are called “first party cookies”. Cookies set by parties other than the website owner are called “third party cookies”. Third party cookies enable third party features or functionality to be provided on or through the website or service you are using (such as advertising, interactive content and analytics). The third parties that set these third party cookies can recognise your computer both when it visits the website or service in question and also when it visits certain other websites or services.

3. Why do we use cookies and other tracking technologies?

   We use first party and third party cookies for several reasons. Some cookies are required for technical reasons in order for our Services to operate, and we refer to these as “essential” cookies. Other cookies enable us and the third parties we work with to track and target the interests of visitors to our Services, and we refer to these as “advertising” or “analytical” cookies. For example, the embedding of YouTube and Vimeo videos, as added by individual schools will require “advertising” cookies to be enabled in order to successfully play them. Schools that, for example, opt to track visitor data using Google Analytics will require “analytical” cookies to be enabled in order to do so. These third party cookies are used to tailor content and information that we may send or display to you and otherwise personalise your experience while interacting with our Services and to otherwise improve the functionality of the Services we provide. We also enable schools to employ cookies and similar tracking technologies in connection with their use of our Services in order to allow them to track visitors to and interactions with, their school website.

4. How eSchools Uses Cookies

   eSchools websites may request cookies to be set on your device. We use cookies to let us know when you visit our websites, how you interact with us and to enrich your user experience. The cookies differ depending on the information. You can adapt your cookie preferences, although please note that blocking some types of cookies may impact your experience on our websites and the services we are able to offer. We will not, without your express consent, supply your personal information to any third party for the purpose of their or any other third party's direct marketing.

5. User Embedded Content

   Our Services allows schools to embed code which may potentially contain cookies. Please note embedded content, if displayed on one our websites, has been added by the school and not by eSchools. The embedded content added by the school may require additional cookies or tracking technologies to be enabled in order to function.

6. How can I control cookies?

   You have the right to decide whether to accept or reject cookies. Be aware that cookie preferences are set on a per device basis; therefore you may need to set your preferences on each device you use.

7. Initial cookie pop-up banner: You can exercise preferences about what cookies are served on our Websites by selecting your preference from this modal which appears upon visiting an eSchools website/login screen and dashboard. You can also change your cookie preferences by clicking on the link on the footer of any page. The banner will reappear annually (August 31st to coincide with the academic year) to confirm your settings.

8. Browser Controls: You can set or amend your web browser controls to accept or refuse cookies. If you choose to reject cookies, you may still use our Websites though your access to some functionality and areas of our Websites may be restricted. As the means by which you can refuse cookies through your web browser controls vary from browser-to-browser, you should visit your browser’s help menu for more information.

9. Disabling Most Interest Based Advertising: Most advertising networks offer you a way to opt out of Interest Based Advertising. We will not, without your express consent, supply your personal information to any third party for the purpose of their or any other third party's direct marketing. If you would like to find out more information, please visit http://www.aboutads.info/choices/ or http://www.youronlinechoices.com.

10. Mobile Advertising: You can opt out of having your mobile advertising identifiers used for certain types of Interest Based Advertising, by accessing the settings in your Apple or Android mobile device and following the most recent published instructions. We will not, without your express consent, supply your personal information to any third party for the purpose of their or any other third party's direct marketing.

11. How often will you update this Cookie Statement?

    We may update this Cookie Statement from time to time in order to reflect, for example, changes to the cookies we use or for other operational, legal or regulatory reasons. Please therefore re-visit this Cookie Statement regularly to stay informed about our use of cookies and related technologies. The date at the bottom of this Cookie Statement indicates when it was last updated.

12. Where can I get further information?

    If you have any questions about our use of cookies or other technologies, please email us at support@eschools.co.uk.