EducationCity Privacy and Data Policy for Schools

Being an online organisation and with digital technology at the heart of everything we do, online safety for our customers is paramount, especially as the majority of our users are students of primary school age. EducationCity complies with the General Data Protection Regulation (GDPR).

In-Product Data Collection and Use

EducationCity provides a personalised experience for its users. Account information for EducationCity users including administrators, teachers and students are password-protected so that only the user, account administrators and teachers have access to this personal information. By requiring users to log in, students using EducationCity can access the relevant content and their progress can be monitored.

We recommend that you do not disclose your password to anyone to keep your data secure. EducationCity will never ask you for your password when contacting you by phone or email. EducationCity automatically logs users out after one hour of inactivity if they are logged in as an individual user. When you have finished using EducationCity, we recommend that you log out. This is to ensure that others cannot access your account information if you share a computer with someone else or are using a computer in a public place such as a library.

EducationCity enables teachers and administrators to create and set up their own account. This allows teachers to upload and manage their own classes, set work and monitor progress with added security. To create an account on EducationCity the following information is required.

Teachers and Administrators

We ask teachers and administrators to input the following in order to create an account:

• Title
• First Name
• Last Name
• Email Address
• Username
• Password
• Role (optional)

Students

When creating a new student account, we require a teacher or administrator to enter or upload the following information:

• First Name
• Last Name
• Username
• Password
• Class
• Unique ID (optional)
• Academic Level (optional)
• Date of Birth (optional)
• Gender (optional)

Any work completed by a student (when logged in) is saved and stored against their profile and made available for the student and teachers to review and analyse within the EducationCity product.

For the purposes of a Home Educator’s subscription, we will also require the following details of the main account holder in order to manage the subscription:

• Name
• Email
• Full Address (including Postcode & Country)
• Contact Number

At all times, within the definition of the General Data Protection Regulation (GDPR), the school (or home educator) and its employees retain the status of Data Controller for the data stored on our cloud service. The data obtained from the school’s systems always remains in the ownership of the school, or that of the individual (employed) users. EducationCity shall be the Data Processor for the purposes of the GDPR.

Data Sharing, Retention and Storage

EducationCity has a strict policy of not sharing any information about students with anyone outside the organisation. EducationCity will not share data with third parties and we will never sell user information or data collected from our website.

Sub Processors

EducationCity uses sub processors to facilitate communications and support of your subscription. We remain the data processor of your data and these sub processors only process your data in accordance with our strict instructions. We periodically audit our sub processors to ensure they comply with GDPR and our contract. We currently use the following sub processors:

• Marketo (www.marketo.com) – provides marketing services that allow us to manage teachers’ and administrators’ communication preferences, including delivery and tracking of email campaigns.

Security and Protection of Your Information

All remote access to the EducationCity web application is conducted over HTTPS, an encrypted web link secured using TLS (Transport Layer Security). This is the same method used by banks and commercial entities to secure sensitive data from interception.

Data Deletion

EducationCity stores data for its users. To ensure that EducationCity does not hold user information in perpetuity, it has set criteria for the deletion of unused data. This information will be deleted daily based on the below data types:

• Users – EducationCity holds data for Teacher, Student and Admin user accounts. If these accounts are left inactive for two years they will be deleted. The definition of inactive is if the user has not logged in (via any route) for two years.
• SuccessTracker – Any saved score data will be deleted after five years on a rolling basis. Even if the student is still active, we will only hold five years’ worth of results per child; if more is required, the export data feature should be used. If a student is deleted as a result of being inactive for two years, all score data held for that student is also deleted. Data to be deleted includes Activity, Assessment and PlayLive scores, and Revision Journals.
• MyCity – If a Teacher or Admin user is deleted due to being inactive for two years, or a Teacher or Admin user is deleted via the user interface/front end, then their MyCities become ‘un-owned’. Any MyCities that contain no content will be deleted after two years. No MyCities will be deleted for an active user.

Usage Statistics

Usage statistics of EducationCity at school level will be stored in EducationCity’s subscriber management system and will be kept in perpetuity. No personal/user level information can be extracted from this data.

External Data Storage

EducationCity stores data on secure database servers, located in the UK. The servers are housed on Amazon Web Services (AWS), trusted and used by many of the country’s leading organisations. Remote access to the data is limited to the tools needed by the IT support staff to maintain and operate the servers and is restricted to known users (identified by usernames and secure keys) connecting from known locations (IP addresses).

Data Backup

EducationCity’s backup procedure allows for storage for typically up to nine days and includes a full backup at the end of every working day, which is stored securely off-site.

Transfer of Data Outside of the European Economic Area

All data entered and saved on the EducationCity product is stored and backed up on secure database servers within the UK. Any email communication with us will go through our corporate email system (Microsoft 365).

Access to Information

The General Data Protection Regulation gives you the right to access information held about you. Your right of access can be exercised in accordance with the regulations.

EducationCity Employees

To ensure that the user receives the best customer care, EducationCity’s staff have access to user data (dependent upon their role). Staff access is controlled via documented System Access Requests and is only granted on a need-to-know basis.

Marketing Data Collection and Use

On our website, we request personal information in the following areas:

• Mailing List – Your email address in order to send you relevant news and updates.
• Support – Your title, first name, last name, email address, school name, postcode, job role and telephone number. We use this information to link your question to your school account so that we can contact you with a relevant and timely response.
• Free Trial – Your title, first name, last name, email address, school name, postcode, country, job role and telephone number. We use this information to either link you to your school account or set up a new school account in order to provide you with trial access.
• Web Form Fills – Including but not limited to your first name, last name, work email address and school details. We use this information to provide you with relevant information about our products and/or services.
• Webinar Registrations – Including but not limited to your first name, last name, email address and school details. We use this information to send you details about the webinar and for further communication regarding our products and/or services.

You can update your account information by calling the team on +44 (0)1572 725080. This is available to the account administrator or head teacher only. The administrator has control of all users in its school and can add/change/delete on request.
Data kept for marketing purposes can be changed at any time by clicking on the unsubscribe link on any email from us or from within the product. Alternatively, you can email marketing@educationcity.com to update your information.

EducationCity and Cookies

A cookie (also called a HTTP cookie, web cookie or browser cookie) is a small piece of data sent from a website and stored in a user’s web browser while the user is browsing that website, which is subsequently sent back to the same website by the browser.
To function, a cookie asks permission to be placed on your computer’s hard drive. Once you agree, the file is added and will subsequently recognise you when you return to a particular site and/or help EducationCity analyse its web traffic.

How EducationCity Uses Cookies

EducationCity uses cookies to provide you with the best possible experience on our website and to identify critical details such as account, user and curriculum identification on our product. In addition to this, we use cookies from Google Analytics, Hotjar and Marketo to record your usage of the website anonymously. This helps us analyse data about webpage traffic and improve our service in order to tailor it to customer needs. We use this information for statistical analysis purposes only, to influence our development plans.

Overall, cookies help us provide you with a better product, by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.

Visiting EducationCity could result in one or several of the following types of cookie being set:

Cookie Name	Category	Description	Provider
osano_consentmanager	Essential	Stores the user’s current consent status including expiration of consent and unique consent identifier.	Osano
__gwtCookieCheck	Essential	Checks if the visitor’s browser accepts cookies.	Google LLC
^RT$	Essential	Placed by Akamai to improve website security and performance.	Akamai Technologies Inc
^_ga*	Analytics	Associated with Google Universal Analytics to provide website usage analytics.	Google LLC
ln_or	Analytics	Registers statistical data on users’ behavior on the website.	Edmentum Inc
^_hj*	Analytics	Set by Hotjar to better understand users’ actions and improve user experiences.	Hotjar Ltd
^_fb*	Marketing	Placed by Facebook to store last visit and to deliver a series of advertisement products such as real time bidding from third party advertisers.	Facebook Inc
^_mkto*	Marketing	Allows a website to link visitor behaviour to the recipient of an email marketing campaign, to measure campaign effectiveness.	Marketo Inc

How to Control and Delete Cookies

EducationCity relies on cookies to authenticate its users and provide you with the correct content. Should you wish to control the cookies that are set, stop them being used or delete them altogether, you can do but restricting or preventing any cookies may negatively affect your experience of the site.

All the latest browsers allow you to change your cookie settings. This is usually within the Settings section of the browser menu but accurate information for each browser can be found by clicking on the links below:

• Cookie settings in Google Chrome
• Cookie Settings in Microsoft Edge
• Cookie settings in Safari (desktop)
• Cookie settings in Safari (mobile)

To find out more about cookies and their various uses on the Internet, visit: www.ico.org.uk/for-the-public/online/cookies/

Your rights in connection with personal information

Under certain circumstances, by law you have the right to:

• Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
• Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your personal information to another party.
• If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact the Data Protection Officer in writing.

No fee usually required

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

Contact Us

You may contact us at any time via email (customerservice@educationcity.com) or post. Our postal address is: EducationCity, Pera Business Park, Nottingham Road, Melton Mowbray, Leicestershire, LE13 0PB, UK.