Sumdog Privacy Policy

Updated June 2023

This Privacy Notice tells you what Personal Information we collect, what we do with it, who can access it, and your rights in relation to your Personal Information. It forms part of Sumdog’s Terms of Use.

This Privacy Notice applies to Users and website visitors from the EU, Europe, and internationally (excluding the USA). To read the Privacy Notice for Users and website visitors from the USA, please click the US flag in the top right of this page.

All capitalised terms are defined in Annex A.

Who we are

Sumdog Ltd is a company incorporated and registered in Scotland with company registration number SC167331. Our registered office is 43 Queensferry Street Lane, Edinburgh, EH2 4PF, Scotland, United Kingdom.

Depending on the circumstances, Sumdog Ltd may process Personal Information either as a Processor or as a Controller, as defined in the UK GDPR and the EU GDPR.

· Sumdog Ltd as a Controller

Sumdog Ltd is the Controller of, and responsible for Personal Information relating to,:

Parent Users, Sumdog Families and Student Users where a Parent User has registered for a Sumdog parent login and Parent User, Sumdog Family and Student User data is processed in connection with that account.
Business contact details of personnel at local authorities / schools engaged in the management and administration of their Sumdog account.
Visitors to the Sumdog website who do not log-in to a Sumdog account.

· Sumdog as a Processor

Sumdog Ltd is the Processor of Personal Information relating to:

Teacher Users and Student Users in respect of Sumdog Schools.

In such circumstances Sumdog will process Personal Information on behalf of the relevant local authority / school and at the direction of the local authority / school in accordance with the terms of this Privacy Notice and the applicable contract between Sumdog Ltd and the local authority / school.

The principal purpose of this Privacy Policy is to tell you about the Personal Information we handle as a Controller and the rights which you have in relation to that Personal Information. However, this Privacy Policy also tells you about the Personal Information which we handle as a Processor in relation to Teacher Users and Student Users in respect of Sumdog Schools.

Information you give us

Teacher Users

When you sign up for Sumdog as a Teacher User, you will provide your:

· first and last name

· email address and password

· school name and address

· role (optional)

If you sign up via Google SSO, you will not share your password with Sumdog.

Teacher Users will provide the following Student User information:

· first and last name

· class

· school year

Teacher Users will be able to access the Student User information in their Sumdog School.

Teacher Users are responsible for inviting and accepting other Teacher Users who wish to join a Sumdog School. It is the responsibility of the Teacher User inviting and accepting other Teacher Users to identify that such other Teacher Users are allowed to access the Personal Information stored in the Sumdog School.

Teacher User accounts need to be confirmed by email, unless using Google SSO.

Parent Users

When you sign up for Sumdog as a Parent User, you will provide your:

· first and last name

· email address and password

· payment details

Parent Users will provide the following Student User information:

· first and last name

· date of birth

· school login details (if applicable)

Parent Users will be able to access children’s information in their Sumdog Family.

Parent Users will be asked the child’s date of birth so we can place them at the correct level in the Sumdog curriculum. Parent Users may invite other parents or guardians to their Sumdog Family by entering their names and email addresses.

Payment details are held by our Third Party payment provider and are not accessed by Sumdog Ltd.

Parent User accounts are confirmed by credit/debit details input at sign up.

Student Users

Student User accounts are created by a teacher, parent, or guardian. Student User logins are created by Sumdog when the Student User accounts are set up. Whilst using Sumdog, Student Users will not be asked to input anything that by itself is considered Personal Information.

When a Parent User or Teacher User submits any Personal Information relating to a Child User, the Parent User or Teacher User represents that they have the authority to do so and agrees to us using the Personal Information in accordance with this Privacy Notice and Cookie Policy.

Student Users can choose the gender and visual appearance of their on screen avatar. They can also specify profile details in the old interface, such as their favourite Sumdog game.

If we’re informed that we have collected Personal Information from anyone under 18 without permission, we will delete that Personal Information as quickly as possible. If you believe that this has happened, please contact us at privacy@sumdog.com.

If you don’t provide Personal Information

You can choose not to give us Personal Information. However, this may prevent you from using most parts of Sumdog. If not do not sync with Sumdog via your MIS system, you are able to pseudonymise some Personal Information, such as names, without losing access to Sumdog.

Information we collect from you

When you use Sumdog, we collect the following information automatically:

· technical information, such as your operating system and your IP address

· usage data, such as the last time you logged in

· educational progress data, such as your accuracy and place in the curriculum, if you are a Student User

Some of the information that we collect from Student Users may be accessed by the Parent Users in their Sumdog Family, or the Teacher Users linked to their Sumdog School.

We also use analytics software to help us understand how Sumdog is used. For example, to help us optimise our email communication, we may use customised links, or small images called web beacons. These allow us to understand how our messages are received by our Users.

When you use our website, Sumdog employs Cookies. For information on the Cookies that we use, please view our Cookie Policy, found here: Cookie policy .

When you use our website, you may be asked to input your email address to access content. You must be 18 years of age or older to use this form. When accessing this content, we will automatically collect what you are interested in and we may email you with customised content.

How we use your Personal Information

We may use your Personal Information which we collect for the purposes and on the legal bases below. We may process your Personal Information for more than one lawful ground depending on the specific purpose for which we are using your Personal Information. We have also identified what our legitimate interests are where appropriate.

· Provide the Sumdog Service. We use your Personal Information to provide the Sumdog Service to you. This includes arranging access to your account, entering contests and ensuring continued access, including auto-rostering through a Third Party. We do this to fulfil our contract with you or where necessary for our legitimate interests to keep our records updated, develop the Sumdog Service and grow our business.

· Personalise Sumdog for you. Sumdog is an adaptive educational tool. Therefore, Student User Personal Information will be used to match their input to their educational progress on Sumdog. We also ensure the content on our website is presented in the most effective manner for you and your computer. It is in our legitimate interests to provide you with a personalised service to tailor the Sumdog Service to your needs, study how you use the Sumdog Service and to develop the Sumdog Service.

· Support and improve the Sumdog Service. This includes responding to debugging errors, improving our processes, developing new products and features. We may request feedback from you or conduct research on the educational impact of our Services. These are in our legitimate interests to keep our website updated and relevant, to improve the Sumdog Service, to develop our business and to inform our marketing strategy. Your Personal Data will be aggregated or anonymised to create statistical or demographic data which we may use to improve and promote the Sumdog Service. Aggregated data is not considered Personal Information as this data will not directly or indirectly reveal your identity.

· Analytics. We may use data analytics to improve our website, the Sumdog Service, marketing, customer relationships and experiences. This is necessary for our legitimate interests to define types of customers for our Sumdog Service, to keep our website updated and relevant, to develop our business and to inform our marketing strategy.

· Communicate with you. We may need to communicate with you about your account. We may also need to provide you with the information, products and services that you request from us. This may be to provide you with customer support, tell you about a new feature, inform you of changes to our Terms of Use or notify you at the end of your trial period. This will be to perform our contract with you or because it is necessary to comply with a legal obligation. Where we have not entered into a contract, it is within our legitimate interests to contact you (to develop the Sumdog Service and grow our business). We will not communicate with Student Users.

· Purchase and payment. We may need to use your Personal Information to process your order. This is to fulfil our contract with you. It may also be necessary for our legitimate interests (to recover debts due to us).

· Marketing. We will contact you for marketing purposes by electronic means when we are permitted by law to contact you, or you have consented. You are able to update your marketing preferences at the bottom of emails we send you and within your Sumdog account. Please note, you are not permitted to opt out of non-promotional account related updates, such as account verification, renewal reminders, order confirmations, changes to your Sumdog Service or security notices, unless you delete your account entirely. We will not send you unsolicited or Third Party marketing. We may use Cookies to send you relevant information. We may also use your information to measure or understand the effectiveness of the Sumdog advertising we serve to Teacher Users and Parent Users, as well as to deliver relevant website content and advertising to you. This is necessary for our legitimate interests to study how Teacher Users and Parent Users use the Sumdog Service, to develop the Sumdog Service, to grow our business and to inform our marketing strategy.

· Prevent abuse and misuse of the Sumdog Service. We will identify and, where necessary, act against improper or illegal use of the Sumdog Service. This is in our legitimate interests to keep the Sumdog community safe. We reserve the right to terminate your account if your use of Sumdog violates our Terms of Use. This includes if you enter offensive, inappropriate, or objectionable content on our website. If you are a Student User, we may share this information with your school. If you are a Teacher User we may share this information with your school and with the police. If you are a Parent User, we may share this information with the police.

· Comply with legal obligations. Please note we may process your Personal Information without your knowledge or consent where it is required or permitted by law.

The Sumdog Service is intended to help students with their education and development, and to help their educators, parents, and guardians support this. When processing Personal Information our legitimate interests are directed at this intention.

We will only use your Personal Information for the purposes for which we collected it, unless we need to use if for another reason and that reason is related to the original purpose. If we need to use your Personal Information for an unrelated purpose, we will notify you and explain the legal basis for doing so.

We do not sell or rent Personal Information.

Disclosures of your Personal Information

We may share your Personal Information with trusted Third Parties, including Third Party Service Providers and other entities in the eEducation Albert group.

eEducation Albert AB (publ)*

Ampd AB

ARPU Management AB

Strawbees AB

Kids MBA SAS

Swedish Film AB (subsidiary of APRU Management)

Sumdog Inc

We ensure our agreements with Third Party Service Providers are governed by a written contract. This ensures Third Party Service Providers will provide the same or higher level of protection for your Personal Information. We only permit Third Party Service Providers to process Personal Information for specified purposes and in accordance with our instructions.

Why we might share your Personal Information with Third Party Service Providers

We will share your personal information with Third Party Service Providers where required by law, where it is necessary to administer the working relationship with you, where you have given explicit permission or where we have another legitimate interest in doing so.

We may use Third Party Service Providers in keeping with the purposes set out in the section How we use your Personal Information and, in particular, to help in the following circumstances:

· Providing the Sumdog Service (administration)

· Purchase and Payment (eg: international sales requests from a country where we work with a partner)

· Marketing / External communications

· Use of the Sumdog Service

· Auto-rostering (for subscribed school accounts)

· Analytics

· Professional advisory services (including lawyers, bankers, insurers, auditors and accountants who provide legal, banking, insurance, audit and accounting services)

· HM Revenue & Customs, regulators and other authorities who may require reporting of processing activities in certain circumstances.

Why we might share your Personal Information with other Third Parties

We may share your Personal Information with other entities in our eEducation Albert group as part of our regular reporting activities on company performance, in the context of a business reorganisation or group restructuring exercise, for system administration, data storage, select marketing purposes and data hosting.

We may share Student User first name, last initial, class and school as part of a contest leader board. This may mean sharing with other schools in your area. Please note, Student User names can be pseudonymised as long as you do not sync with Sumdog via your MIS system.

We may also share Student User first name and last initial as part of individual game leader boards. This may mean sharing with other schools.

We may share your Personal Information with Third Parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this Privacy Policy.

International Transfers

Your information is stored and processed on our servers and those of our Service Providers.

For security reasons, payment card details are not held by us and are stored instead by our payment Service Provider. This will involve a transfer of Personal Information outside the UK.

Where we share your Personal Information within our eEducation Albert group, this will involve a transfer of Personal Information outside the UK.

When you use the Sumdog Service, we transfer the Personal Information collected about you to our servers in the EEA. This is to provide the Sumdog Service. Your information is encrypted in transit to our servers and at rest.

We may have to transfer your Personal Information to our Third Party Service Providers, who are either based in the UK, the EEA, or the United States of America depending on your location.

To ensure your Personal Information receives an adequate level of protection, we require our Service Providers to protect it in a way that respects the EU GDPR and the UK GDPR. Whenever we transfer your Personal Information out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

· We will only transfer your Personal Information to countries that have been deemed to provide an adequate level of protection or Personal Information.

· We use certain Third Party Service Providers we may use specific contracts approved for use in the UK which give Personal Information the same protection it has in the UK.

These safeguards are monitored in accordance with the appropriate laws and are kept up to date. If you require further information about these protective measures, please write to our Data Protection Officer.

Automated decision-making

Automated decision-making is used as part of the Sumdog Service. Student User educational progress data helps our algorithms automatically decide the levels of questions that Student Users are asked to answer. This enhances the experience of Sumdog as a learning tool. Teacher Users and Parent Users are able to reset the level of student diagnostics.

Student Users may also see messages encouraging them to play Sumdog for longer.

Teacher Users may see messages encouraging them to reset student diagnostics or set a challenge.

Regular checks are carried out to ensure the automated decisions the Sumdog Service makes are working correctly.

Automated decision-making is also used as part of our website service. This helps us customise the email journey for Teacher Users who sign up.

We do not anticipate the automated decisions within Sumdog or the Sumdog website will impact our Users in a legal, or similarly significant, manner.

How long we keep your Personal Information

Keeping your Personal Information

Except as otherwise stated below, we store your Personal Information for as long as the relevant Sumdog account exists or until we no longer need your information to provide you with the Sumdog Service or otherwise fulfil the purposes for which we collected it.

We may need to keep your Personal Information for longer than above to comply with our legal, regulatory, tax, accounting or reporting obligations, or to resolve complaints, disputes or enforce or defend our agreements. For example, if you have opted out of marketing communications, we will store your request indefinitely so that we can respect the request in future.

The following information will not be deleted:

· After a request to delete a Sumdog Family, the Student User accounts will not be deleted if they are also linked with a Sumdog School.

· After a request to delete a Sumdog School, the Student User accounts will not be deleted if they are also linked with a Sumdog Family.

Backups are taken every day and kept for only as long as there is a business need for them.

We may also use aggregated data that has been derived from your information after you have deleted it. However, this will not be in any way that might identify you personally.

We will not attempt to re-identify any User once they have been deleted.

Deleting your Personal Information

If you sign up as a Teacher User, and you do not confirm your email address within 30 days of signing up, we will automatically delete your information.

If you are a Teacher User without a Sumdog subscription and you have not logged on in 12 months, you may be sent a notification email to log in to keep your account active. Inactive accounts may be deleted after 15 months.

If you sign up as a Parent User, and you do not subscribe within 30 days of signing up, we will automatically delete your information.

We reserve the right to terminate your account if your use of Sumdog violates our Terms of Use. This includes if you enter offensive, inappropriate, or objectionable content on our websites. We may, however, retain a record of the fact that we have terminated your account as a result of a breach of our Terms of Use.

Inactive accounts may be deleted. We will make reasonable efforts to contact you using either Parent User or Teacher User email addresses before we do so. Student Users may be deleted at the same time as their linked Parent User or Teacher User. Upon deletion, your personal information will be anonymised. Usage data will be kept, aggregated in a way that no individual could be identified and may be used for research to improve the Sumdog Service.

Parent Users or Teacher Users may ask us to delete Personal Information held in a Sumdog Family or Sumdog School linked to their account at any time by contacting us as described below. We will do this within 30 days of your request.

How we keep your information safe

Sumdog maintains a reasonable and appropriate security programme designed to prevent your Personal Information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

Our security measures include data encryption in transit and at rest, firewalls, multi factor authentication for systems, malware protection, regular staff training and physical access controls. Sumdog also holds the Cyber Essentials certification.

On your web browser, you’ll see a padlock beside the Sumdog web address (www.sumdog.com). Clicking the padlock gives you the details of our security certification. The security certification for our marketing website can be viewed in the same way (learn.sumdog.com).

In addition, we limit access to your personal information to those employees, agents, contractors and other Third Parties who have a business need to know. They will only process your Personal Information on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Our security policies are reviewed on an annual basis to ensure they are kept up to date. Changes are approved by senior management.

Parent Users and Teacher Users are responsible for using their best efforts to select and protect their login details, including restricting access to your Sumdog account, and logging off after using Sumdog.

Our Service Providers that handle payment data maintain the relevant Payment Card Industry (PCI) compliance levels.

Third Party Advertising

Sumdog does not carry paid advertisements for anyone else.

Social Features

Sumdog has no social features that allow Student Users to communicate freely.

Student Users can add friends using a unique code. They can then see each other’s avatar, school, coin total, animal rank and send them gifts for their Sumdog house or garden. Student Users can remove friends at any time.

Your Rights in respect of Personal Information held by Sumdog about you

It is important that the Personal Information we hold about you is accurate and current. Please keep us informed if your Personal Information changes during your relationship with us.

Where the UK GDPR and the EU GDPR apply, by law you have the right to:

· Request access to your Personal Information. This enables you to receive a copy of the Personal Information we hold about you and to check that we are lawfully processing it.

· Request correction of the Personal Information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

· Request erasure of your Personal Information. This enables you to ask us to delete or remove Personal Information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your Personal Information where you have successfully exercised your right to object to processing (see below), where we have processed your information unlawfully or where we are required to erase your Personal Information to comply with law. Note, however, that we may not always be able to comply with your request for erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

· Object to processing of your Personal Information where we are relying on a legitimate interest (or those of a Third Party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your Personal Information for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.

· Request the restriction of your Personal Information. This enables you to ask us to suspend the processing of Personal Information about you, (i) if you want us to establish its accuracy or (ii) where our use of the data is unlawful but you do not want us to erase it, (iii) where you need us to hold the data even if we no longer require it as you need to establish, exercise or defend legal claims or (iv) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

· Request the transfer of your Personal Information to you or another party. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

· In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose (such as electronic marketing or photographs), you have the right to withdraw your consent for that specific processing at any time. We will then no longer process your information for the purpose(s) you originally agreed to, unless we have another legitimate basis for doing so.

If you want to exercise any of these rights, please contact the Sumdog Data Protection Officer in writing. We will try to act on your request within one month. Occasionally it could take us longer than month if your request is particular complex or you have made a number of requests. In this case, we will notify you and keep you updated.

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that Personal Information is not disclosed unlawfully.

We will only require a fee if your request is clearly unfounded, repetitive or excessive. Sumdog Ltd reserves the right to refuse to comply with your request in these circumstances.

Updating this Privacy Notice

We may change this Privacy Policy from time to time and we will provide you with a new privacy notice by email when we make any substantial updates. We may also notify you in other ways about the processing of your Personal Information.

Data Protection Officer

We have appointed a Data Protection Officer to oversee compliance with this Privacy Notice. If you have any questions about this Privacy Notice or how we handle your Personal Information, please contact the data protection officer at privacy@sumdog.com.

Alternatively, please write to Sumdog Ltd, 43 Queensferry Street Lane, Edinburgh, EH2 4PF, UK or call +44 (0)1312261511.

Data Protection Impact Assessments on Sumdog

If you are completing a DPIA on Sumdog for your school, we have a DPIA Information Sheet. This can be used alongside this Privacy Notice to complete a DPIA on Sumdog. Please contact our Data Protection Officer at privacy@sumdog.com for this information.

The Information Commissioner’s Office

If the use of your Personal Information is subject to the UK GDPR, you have the right to lodge a complaint about how we handle your personal information with the Information Commissioner’s Office / the ICO. You can call the ICO’s helpline on +44 (0)303 123 1113. See also Contact us.

How to contact us

If you have any query regarding this Privacy Notice or your Personal Information on Sumdog, please e-mail privacy@sumdog.com. Alternatively, please write to Sumdog Ltd, 43 Queensferry Street Lane, Edinburgh, EH2 4PF, UK or call +44 (0) 131 226 1511.

If the use of your Personal Information is subject to the EU GDPR, for example because you are resident in the EEA, and you have any query regarding this Privacy Notice or your Personal Information on Sumdog please contact the Sumdog EU GDPR Representative at eEducation Albert AB, Polhemsplatsen 5, 411 11 Gothenburg, Sweden.

Annex A - Definitions

Controller - Controllers maintain control over the purposes and means of processing personal data.

Cookies - A cookie is a small text file that is downloaded on to your computer when you visit a website.

Cyber Essentials - Cyber Essentials is a UK government backed scheme that ensures a set of technical controls, which guard against common cyber threats.

Data Protection Officer - DPOs monitor internal compliance and act as a contact point for data subjects.

EEA – the European Economic Area.

Parent User - A user who has registered for a Sumdog parent login.

Personal Information - Information which allows an individual to be identified.

Privacy Notice - This Sumdog privacy notice.

Processor - Processors act for and on the instructions of a Controller.

Service Provider - Any website or other Service delivered by Third Parties. These are either integrated into the Sumdog Service or our processes to make certain content, products, and/or features available to you.

SSO - Single sign on. Sumdog uses this feature with Google as a login option for Teacher Users.

Student User - A user who is registered for a Sumdog student login.

Sumdog Family - A family account on Sumdog, set up by a Parent User.

Sumdog School - A school account on Sumdog, set up by a Teacher User.

Sumdog Service - Any Sumdog Service that is available on our platform.

Teacher User - A user who has registered for a teacher login or a user of our website who accesses content as a teacher/educator.

Third Party - A person or group besides you and Sumdog.

User, you, your - any person or entity that uses Sumdog.

We, our – Sumdog Ltd.