Science Surgery – Data Protection Policy
Updated 1 April 2020
We take data security and user privacy very seriously. This Policy outlines how we use and store information supplied to us by the School and their users. The Policy is compliant with the EU’s General Data Protection Regulation (GDPR) and UK’s Data Protection Act. By registering and using the Software the School is deemed to have accepted the provisions set out in this Policy. Science Surgery reserves the right to revise or supplement this Policy to reflect changes in the law our business or technology. Any such changes will be subject to prior notification and acceptance by the School.
Definitions
The following definitions apply to words used in this Policy;
We, Us, Our or Science Surgery – means Science Surgery.
School, You or Your – means the school, college or similar educational institution registered with Science Surgery for use of its Software. Where a School consists of a number of entities or branches each entity or branch shall be deemed as an individual School unless otherwise agreed in writing by Science Surgery.
Administrator – means the member of staff appointed and authorised by the School for registration with Science Surgery and for administrating the application and use of the software.
User – means a teacher or member of staff employed by the School a student enrolled at the School a parent or guardian of such student authorised by the School to use the Software..
Registration – means registration with Science Surgery of the School and its nominated Administrator
Personal Data – means information relating to or about an individual person that can identify that person or data uploaded by the School or a user which is specific to that user.
Software – means the software provided by Science Surgery for which access is granted to the User
Upload – means any /all information uploaded by the School or its Users onto Science Surgery’s Software
Security
We are committed to ensuring that your information is secure with us. All information you send or receive is transferred to our secure servers by TLS 1.2 encryption, or by email.
For additional security we use User IDs and passwords. Data cannot be accessed without the User’s ID and password.
The information is stored on Science Surgery’s secure servers in data centres in London provided by Amazon Web Services (AWS). AWS datacentres are compliant with the international information security standard, ISO 27001. You agree to the transfer to and storage of all data with AWS.
For more information about AWS security, please visit this webpage: https://aws.amazon.com/security/
For more information about AWS’s ISO 27001 certification, please visit this webpage: https://aws.amazon.com/compliance/iso-27001-faqs/
Whilst we take all reasonable measures to safeguard users’ personal data. Users acknowledge that the transmission of information via the internet is not completely secure and, for this reason, we cannot guarantee the security of personal data transferred from or to users via the internet. Any email transmission is at the School’s own risk. If you have any particular concerns about your information security or possible data breach or loss please contact us at: [email protected].
Data Collection
Visitors to Science Surgery may request a demonstration of our platform. We ask these visitors to provide an email address and telephone contact number, so that we can respond to organise the demonstration. If for any reason the visitor does not wish to be contacted in this way, they are able to contact [email protected].
We collect and store only that information required for the performance of our contracted obligations. That information to be used by the School to further the educational needs of the student, in particular, for teachers and students to use the Science Surgery platform for online homework and revision and for the monitoring and analysis of students’ progress (see below; ‘Information we store about individual students’ performance’).
Data will not be sold or passed to third parties except that, if needed to solve a specific software issue with a particular user, information restricted to school name, user’s name and email address may be sent to our software developer.
As set out in our Terms and Conditions that schools agree to, we process data relating to Teacher, Student and Parent Users as detailed in this Privacy Policy and we do so on behalf of schools and other similar organisations. As such we are the ‘data processor’ and the School is the ‘data controller’ as defined under the GDPR.
The Lawful Basis for Processing this Data
We process Users’ personal data in order for Science Surgery to fulfil its Contract with the School and its Users, ie for teachers and students to be able to use the Science Surgery platform for online homework and revision and tracking of progress.
Cookies
Cookies are small text files stored on our system that enable the user’s device or browser to be recognised. They typically contain anonymous information such as a unique, randomly generated ID. We do this in the interest of improving the user experience of Science Surgery.
Registration
At the time of Registration we record names, email address and telephone numbers of the School and the Administrator. This is used to send information about our services, to give advice on the use of our software and to enable effective communication with the School. The Information is accessible only to the Administrator. It is not accessible to students. We do not store schools’ bank or credit card information. The School can unsubscribe from our general communications by contacting us using the details listed on [email protected]. If the school unsubscribes, important information relating to the school’s account will continue to be sent by email.
Information we collect about Users
To use the Software the School uploads the students’ names, class, year, science target grades, tier (Foundation or Higher), pathway (Combine or Separate Science) and an identification number (ID) eg: UPN or Admissions number unique to each student.
If the school decides to upload student’s school email addresses in order to provide students with the ability to manage their own Accounts, if so then when their detail are first uploaded they will receive an email with their log in details. An email may also be sent if a Student with an associated email address requests a password reset on their own behalf.
Users email addresses are accessible only to the Administrator, teacher, individual student, Science Surgery and, if necessary, our software developer.
Schools are responsible for ensuring that they are legally entitled and have sought consent wherever necessary, to pass on to Science Surgery details of Users (Administrators, Teachers and Students) names and email addresses on the basis that they are doing so to further the educational needs of the Student Users.
Whilst we take all reasonable measures to safeguard personal data the security of email transmissions to or from users via the internet cannot be entirely guaranteed. Any transmission is at the School’s own risk. If you have any particular concerns about your information, please contact us at: [email protected]
Information we store about individual students’ performance
In order for the teacher to monitor, track and analyse individual students’ progress and to identify areas of weakness we record such information as marks given for answers to questions, internal school test and examination results, individual targeted tasks created by the teacher, etc. We also record the time spent by each student completing each test or task, the time last logged in, etc.
Automated email reminders are sent to each student one day before the due date for submission of each task and to the teacher and Administrator recording which students have not yet completed the set task.
Sharing of Information
All data including Personal Data is accessible to the Administrator and where applicable to authorised LEA personnel. Teachers granted authorisation by the Administrator have access to student data.
Names and school email addresses of teachers so authorised by the Administrator shall be issued to Science Surgery in order to facilitate access by those teachers to student data.
Students have access to see only their own progress data. The software will not allow for communication between the students.
Science Surgery shall have access to all information uploaded onto its software by the school. Employees of the company who developed and maintain the software platform shall, if needed to solve a specific software issue, also have access to the limited data as specified above (see ‘Data Collection’).
How long we keep personal data
Personal data and will be held on our secure server for a minimum of three months after expiration of the licence period or earlier cancellation of the software Licence. Your access to that data will cease after that time following which the data will be deleted from our records.
Upon specific written instruction from the Administrator we will, within 48 hours, delete any school, student or personal data uploaded by the School or the users.
Links
Except for ‘Youtube’ and official awarding bodies in England and Wales we will not insert links to other third party web sites. Science Surgery does not accept any liability for third party embedded or linked to content.
Rights and Obligations
The School owns all rights to the data and is responsible for ensuring that all users have been informed of and consented to the transfer, processing and use of their personal data. Users are responsible for ensuring that information provided to us is accurate, complete and up-to-date.
Under EU data privacy rules users have the right to;
- know what information we hold about them
- obtain a copy of their personal data held by us.
- withdraw their consent to our holding or processing their personal data
- restrict or require deletion of any of their personal data held on our system
- correct any inaccuracies in their personal data
- know how we process and use their personal data
If any user has a concern or complaint about our holding or use of their data or any other data related matter they should, in the first instance, refer the matter to us either by email ([email protected])
If the matter is not suitably resolved the Administrator or User may lodge a complaint with the UK supervisory body, The Information Commissioner’s Office at https://ico.org.uk/.
Serious incidents such as data breaches
Should any school suffer a serious incident we will work closely with them to ensure it is resolved and minimize its impact.
Customer Surveys
The School may occasionally be asked for comment on the accessibility, use or content of the Software. The School has no obligation to supply such information but any information supplied may be stored by Science Surgery for future improvement of its Software. Information may also be collected by Science Surgery from visits to its website in order to understand more about how the website is used and to improve its function.
Governing law
This privacy policy shall be exclusively governed by the laws of England and Wales and shall be subject to the exclusive jurisdiction of the court of England and Wales.[/vc_column_text]