Privacy Policy

Introduction

This privacy policy for Lumio^® (“Privacy Policy”) forms part of the Terms agreed upon between you and SMART. This policy explains how SMART works with you to protect your information.

By using Lumio you are consenting to SMART's collection, retention, use and disclosure of certain information as necessary to provide Lumio to you. If you do not agree, you must not use Lumio.

Data Types

It is important to remember that customers and users are two distinct groups:

Customers are typically an organisation (e.g., district, school, company) and not a personally identifiable individual. The identifiable information we require is from the customer for transactional purposes. The customer shall not provide SMART with personally identifiable information unless permissible by law and the customers’ policies.

Users (e.g., teachers, students) are generally not the ones who purchased or set up the account (e.g., IT administrators) and only access Lumio because the customers’ IT administrator has granted them access. As such, SMART’s exposure to personally identifiable information only comes from how the customer operates when providing e-mail addresses and names of users to SMART and from user created Content. If you have a concern as a user about your PII you must demand the customer provide only non-identifiable information to SMART and you as a user must only create Content with no PII in it.

We collect two types of data, depending on your interaction with us:

“Non-Personal Data” means aggregated non-identifiable information, which may be made available or gathered via your access to and interactions with our services. We are not aware of the identity or other identifiers of the individual from which the Non-Personal Data is collected. The Non-Personal Data being collected may include aggregated usage information (meta-data), as well as technical information transmitted by your device, such as the type of browser or device, type of operation system, device settings and technical software data, etc.

“Personal Data” or “personal information” means individually identifiable information, namely information that identifies a natural person (not a corporation) or may, with reasonable effort, be used to identify a natural person.

We do not knowingly collect or process any Personal Data constituting or revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data or data concerning a person's health (“Special Categories of Personal Data”).

The Customer is responsible for obtaining consent and authorization for a student to use our products and services from their parent or guardian. We do not knowingly collect any information from children. Where a customer instructs us to collect personal information from children, we collect, use, process and retain such information solely to provide the educational services on behalf of the customer and for the purpose of providing Lumio.

INFORMATION WE COLLECT

We collect and use information to allow us to provide our products and services to you. We collect information from you when you sign up for an account or voluntarily provide additional information.

We also collect information about the navigation pages users visit within Lumio using cookies and third-party analytics tools. This information includes information about the device(s) you use to access the websites including unique device identifiers, IP address, operating system, browser and cookies. Depending on your device settings, we may also collect information about your geographical location. A list of cookies is provided at the end of this policy.

We collect data when you:

• use Lumio;
• create an account or make a purchase;
• request support;
• register for or participate in an online class, exam, certification, training, webcast or other event;
• request information or materials;
• participate in surveys or evaluations;
• submit questions, comments or crash reports; or
• submit content or posts on our forums or other interactive webpages.

HOW WE USE YOUR INFORMATION

We use the personally identifiable data we collect solely for the purpose of providing Lumio to you. We may share this data with third-party service providers to provide our services to you. All providers contracted by SMART are contractually bound to keep your personal data secure and use it only for necessary service delivery.

In addition to processing your personal data for the purposes of providing our services and facilitating correspondence, we may also process your data based on legitimate interests/lawful basis. These interests or basis include but are not limited to improving our services, managing our business operations and sending you information about our products, services and offers that may be of interest to you, provided you have opted in or not opted out of receiving such communications.

We do not sell your data and we do not share personal data with third parties without your informed consent, which is the purpose of this document. We share your information in accordance with this agreement and a list of the third parties we share data with to provide our services to you are detailed below.  Data is not shared between sub-processors unless explicitly stated.

YOUR RIGHTS

You have the right to control how your personal information is used. You may have the right to request access to, rectification of or erasure of personal information we hold about you. You also may have the right to object to or restrict certain types of use of your personal information. If you wish to exercise any of these rights, please contact privacy@smarttech.com.

Please note that many of these rights are not absolute. In some circumstances, we are not legally required to comply with your request because of relevant legal exemptions.

DATA RETENTION AND DELETION

SMART will only keep personal data for as long as required to provide the service or as required for tax and legal reasons. SMART adheres to an internal document retention policy to ensure this. SMART will respond to customer requests to delete personal data within 30 days.  Users (teachers and students) must contact their school (i.e., our customer) to make this request to SMART on their behalf.

All student and teacher created content stored within a teacher’s account can be deleted by the teacher without contacting SMART.  Customers (not users) may request deletion of their SMART account at any time by e-mailing privacy@smarttech.com or contacting our support department.  Non-paying accounts are deleted after two (2) years of inactivity.

In some cases, we may not be able to remove the information or continue to provide services following removal of such information, in which case we will let you know why.

Right of Notification

If SMART becomes aware of a personal data breach, it shall without undue delay and where feasible, no later than 72 hours after having become aware of it, notify the affected customer and the supervisory authority (if it was for data where SMART was the Data Controller) in accordance with Article 33 of the GDPR, unless the data breach is unlikely to result in a risk to the rights and freedoms of natural persons. SMART’s communication of a breach shall be in clear and plain language and contain a minimum of:

1. Contact details of the Data Protection Officer or other contact person,
2. A description of the nature of the breach,
3. Likely consequences of the breach,
4. Advice on steps data subjects can take to protect themselves and
5. The measures SMART has taken or proposes to take to address the breach.

Data Security

SMART's business processes are designed and applied to appropriately safeguard your personal information, having regard to the sensitivity and use of that information. Nevertheless, such security measures may not prevent all loss, misuse or alteration of personal information provided to SMART and SMART is not responsible for any damages or liabilities relating to any such security failures. By using our services, you understand that there is a risk that data and communications, including e-mail and other electronic communications, may be accessed by unauthorised third parties when communicated over the Internet. The foregoing does not affect any liability which cannot be excluded or limited under applicable law.

If you have any questions or concerns regarding the security measures applied to collection, use or disclosure of your personal information please contact us at privacy@smarttech.com.

If you are using a service that involves third party elements (e.g., embedded videos in your lessons), please review the policies of such third-party service providers as they relate to security and data protection.

Encryption

We employ a variety of safeguards designed to protect personal information against loss, misuse and unauthorised access or disclosure.

We use cloud services to provide several state-of-the-art security measures, including the same end-to-end 256-bit TLS encryption used by all major banks to secure your data. We do not store or handle any of your login credentials, including passwords, as these are managed by single-sign-on (SSO) identity providers.

For further information regarding how SMART protects your data, click here.

CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time to reflect changes to our products and services, our operations or to meet new legal and regulatory requirements. Any material amendments will be communicated to customers 30 days in advance and become binding once posted online.

PRODUCT USER DATA COLLECTED AND PROCESSED

This section outlines what data is collected and processed from our customers and the four types of Lumio users:

• guest (not signed-in)
• student (signed-in)
• teacher (signed-in)
• account administrator (signed-in via the SMART admin portal)

Remember, SMART only receives information because you provide it; you are the data controller. In this way, customers and users are obligated to comply with their local laws and customers are responsible for any obligations they owe to their users with respect to their personally identifiable information.

CUSTOMER DATA COLLECTED AND PROCESSED

This section outlines what data is collected, processed and disclosed from customers (purchasers, prospects and SMART’s authorised channel partners). Customer data is almost always non-personally identifiable business contact information. You can request data and account deletion at any time through our Customer Support team. However, we retain all data relevant to purchases and financial transactions until it is no longer required by applicable law. The term “identifiable” used in the below chart does not necessarily mean personally identifiable information.

THIRD PARTY CODE IN OUR SOFTWARE

Portions of Lumio use third-party open-source code. To find out more information about third-party code in Lumio and its licences visit our Lumio Third-Party Code Attribution page.

COOKIES

SMART and some of its processors use cookies to provide Lumio to you. Cookies are small files that are placed on your computer or device. Most web browsers allow some control over cookies through the browser settings. Blocking all cookies will, however, have a negative impact upon the usability of Lumio. Thus, you may prefer to accept cookies and then delete them later or upon exiting your session.

If you have any questions or concerns related to this Privacy Policy or the processing of your Personal Data, you may contact our privacy team as follows:

By e-mail to our Data Protection Officer: privacy@smarttech.com