ALEF EDUCATION CLIENT PRIVACY PROMISE

Alef Education respects its Client’s and their associated End User’s privacy and is committed to protecting their Personal Data. This privacy policy informs Alef Education’s Clients and associated End Users of how Alef Education Process their Personal Data.

This privacy policy applies to Personal Data which is Processed by Alef Education in providing its Services to Clients and describes Alef Education’s privacy practices in connection with such Processing.

Depending on the specific Services being used or specific interactions a Client or End User has with Alef Education, there may be different or supplemental privacy policies that describe and govern how Alef Education use Personal Data. Those different or supplemental privacy policies apply to that specific Service a Client or End User is using or those specific interactions they have with Alef Education. Visitors of our website www.alefeducation.com should refer to our website privacy notice available here.

Certain defined terms are used in this privacy policy and for ease of reference these are set out below:

The following principles summarise Alef Education’s commitment under this privacy policy:

• Alef Education only Processes Personal Data for Education/School purposes (including, but not limited to use relating to instruction, administration and development and improvement of Services intended for Education/School use).
• Alef Education does not use Personal Data for behavioral targeting of advertising.
• Alef Education does not sell Personal Data or pass any children’s Personal Data to any unauthorised third parties (see section 9 below for details of authorised third parties).
• Alef Education follows security best practices to protect Clients and their End Users’ Personal Data including ensuring that the most privacy friendly options are set by default.
• Alef Education comply with the Family Educational Rights and Privacy Act of 1974 (FERPA) and the Children’s Online Privacy Protection Act of 1998 (COPPA).
• Alef Education are proud signatories of the Student Privacy Pledge. Details of the Pledge can be found here

This privacy policy is provided in a layered format so you can click through to the specific areas set out below:

1. Contact details
2. Disclaimer
3. Changes to the privacy policy
4. The data Alef Education collect about Clients and their End Users
5. If a Client fails to provide Personal Data
6. How is the Personal Data collected?
7. Purposes for which Alef Education use Personal Data
8. Consent
9. Disclosures of Personal Data
10. International transfers
11. Data security
12. Data retention and requests for deletion
13. Additional information for certain jurisdictions

1. Contact details

If you have any questions of feedback about this privacy policy, please contact privacy@alefeducation.com. End Users of Clients should check with that Client (normally a school or other educational institution) if they have any questions regarding how their Personal Data may be Processed.

2. Disclaimer

SOME LAWS (LIKE THE EUROPEAN GENERAL DATA PROTECTION REGULATION 2006/679 (GDPR) DISTINGUISH BETWEEN A “CONTROLLER” AND A “PROCESSOR” (OR SIMILAR TERMS). WHERE ALEF EDUCATION IS PROVIDED PERSONAL DATA IN ITS CAPACITY OF PROVIDING SERVICES TO ITS CLIENTS, THEN ALEF EDUCATION WILL ONLY PROCESS THAT PERSONAL DATA IN ACCORDANCE WITH THE INSTRUCTIONS OF ITS CLIENTS AND ALEF EDUCATION WILL THEREFORE ACT AS A PROCESSOR IN RESPECT OF SUCH PERSONAL DATA. ALEF EDUCATION’S CLIENT WILL BE THE CONTROLLER OF THAT PERSONAL DATA FOR THAT PURPOSE AND WILL BE RESPONSIBLE TO ITS END USERS FOR THE WAY IN WHICH THEIR PERSONAL DATA IS PROCESSED AS THE CONTROLLER. END USERS OF CLIENTS SHOULD THEREFORE CHECK WITH THAT SCHOOL/ORGANIZATION WHO ARE A CLIENT IF THEY HAVE ANY QUESTIONS REGARDING HOW THEIR PERSONAL DATA IS PROCESSED IN COMPLIANCE WITH APPLICABLE LAWS. IN PARTICULAR, CLIENT END USERS WHO SEEK ACCESS TO THEIR PERSONAL DATA, OR WHO SEEK TO CORRECT, AMEND, OR DELETE INACCURATE PERSONAL DATA SHOULD DIRECT THEIR REQUESTS TO THE SCHOOL/ORGANIZATION WHO ARE ALEF EDUCATION’S CLIENTS. CLIENTS MAY BE ABLE TO REMOVE AND UPDATE PERSONAL DATA AND DATA WITHOUT ALEF EDUCATION’S INVOLVEMENT.

3. Changes to the privacy policy

Alef Education keeps its privacy policy under review. This version was last updated on 15 June 2020.

Alef Education will inform its Clients prior to making any changes to this privacy policy which Alef Education believe will materially impact their rights. As a Client, if you object to any changes you must notify Alef Education within 14 days by email: privacy@alefeducation.com. If a Client continues to use the Services after they have received notice of changes to this privacy policy, they will be deemed to have accepted the changes. Historic copies of this privacy policy are available upon request from privacy@alefeducation.com.

4. The data Alef Education collect about Clients and their End Users

Alef Education may Process different kinds of Personal Data relating to its Clients and their End Users which Alef Education have grouped together as follows:

• Contact Data: Alef Education take contact data which includes but is not limited to first name, last name, job position, address, phone number and email address of a Client’s account managers, administrators and any other representatives who Alef Education correspond with. Where a Client requires Alef Education to contact parents/guardians of student End Users, Alef Education will also take contact details including but not limited to first name, last name, address, phone number and email address of the parents/guardians provided by the Client. The Client is responsible for ensuring the accuracy of Contact Data that it provides to Alef Education.
• End User Account Data: Alef Education create user accounts to access Services in accordance with a Client’s instructions. Where End User accounts are created in accordance with Client instructions, Alef Education collect personally identifiable information about them including but not limited to their first names, middle names, surnames, gender, usernames, email addresses, password and school enrolled at. This information is normally provided by Clients for Alef Education to access the Services, but it may be entered by End Users themselves or populated from the End User’s account with a third party sign-in service, such as their Google account.
• Profile Data: Alef Education collects Client and End User’s data in respect of their use of the Services. This mainly comprises of information relating to student’s enrollment, participation and progression using the Services, such as school test results (where provided by the Client), diagnostic tests and survey results, performance results from using the Services, and End User interests and preferences when using the Services. This data may also comprise information that is uploaded by the End User (including but not limited to their avatar, photos, drawings, files, notes, hyperlinks, and other learning records). Alef Education regularly add types of information that can be uploaded, and these are all considered Profile Data under this privacy policy. If an End User is permitted by the Client to allow Alef Education to access microphone or video recordings on their device, Alef Education may also collect video and voice recordings.
• Communications Data: Alef Education collect messages that are sent and received by End Users using the Services, and Alef Education also collect any information that a Client or End User send to Alef Education directly through communications, such as emails or phone logs.
• Log Data: When a Client or End User uses the Services, Alef Education receive log data such as their internet protocol (IP) address, log-in data, browser type and version, time zone setting and location, browser plug-in type and version, operating system and platform, device information and other technology on the devices used to access the Services.

Alef Education also collect, use and share aggregated data such as statistical or demographic data for any purpose. Aggregated data could be derived from Personal Data but is not considered Personal Data as this data will not directly or indirectly reveal an individual’s identity. For example, Alef Education may aggregate Log Data to calculate the percentage of users accessing a specific feature of the Services, and this aggregated data may be shared with third parties. However, if Alef Education combine or connect aggregated data with Personal Data so that it can directly or indirectly identify an individual, Alef Education treat the combined data as Personal Data which will be used in accordance with this privacy policy.

Some laws (like the GDPR) require heightened data protection measures for special types of Personal Data. For the purposes of this privacy policy, “Special Personal Data” includes details about race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about user health, genetic and biometric data or information about criminal convictions and offences. Unless otherwise agreed with the Client, Alef Education does not knowingly collect any Special Personal Data about Clients or their End Users. Alef Education will not be held responsible in circumstances where the Client or End Users provide Special Personal Data. If Alef Education discover that it is Processing Special Personal Data without prior written agreement with the Client, Alef Education may take steps to delete such data without any further notice to the Client or End Users.

5. If a Client fails to provide Personal Data

Where Alef Education need to collect Personal Data by law, or under the terms of a contract Alef Education has with a Client, and that Client or their End Users fails to provide that data when requested, Alef Education may not be able to provide the Client and their End Users with access to the Services.

6. How is the Personal Data collected?

Alef Education use different methods to collect data from and about Clients and End Users including through:

• Direct interactions. Clients and their End Users may give Alef Education identity and contact details by filling in forms or by corresponding with Alef Education by post, phone, email or otherwise. This includes Personal Data provided when a Client or End User:
  • creates or instructs Alef Education to create an End User account;
  • subscribes to Alef Education Services or publications;
  • requests support or maintenance services;
  • enters a competition;
  • completes forms;
  • contacts Alef Education or provides feedback;
  • uploads data onto platforms or applications that form part of the Services including any direct communications via such platforms or applications; or
  • responds to surveys and questionnaires.
• Automated technologies or interactions. As Clients and End Users interact with the Services, Alef Education will automatically collect Log Data and Profile Data about Clients and End Users equipment, actions and patterns. Alef Education may collect this Personal Data by using cookies, cache and other similar technologies. Clients and End Users are always free to decline cookies if their browser permits although doing so may interfere with use of the Services.
• Third parties or publicly available sources. Alef Education may receive information about Clients and End Users from Clients themselves and parents/guardians through providing the Services. Alef Education may also receive Personal Data about Clients and End Users from various third parties and public sources including Log Data from analytics providers such as Google.

7. Purposes for which Alef Education use Personal Data

Alef Education will only use Personal Data when the law allows it to. Most commonly, Alef Education will use Personal Data in the following circumstances:

• Where Alef Education need it to ensure secure End User authentication.
• Where Alef Education need to perform the contract it is about to enter into or has entered into with Clients.
• Where it is necessary for Alef Education’s legitimate interests (or those of a third party) provided that user interests and fundamental rights do not override those interests.
• Where Alef Education need to comply with a legal obligation.

Set out below, in a table format, is a description of the ways Alef Education use Personal Data of Clients and End Users who use the Services, and which of the legal bases Alef Education rely on to do so.

Alef Education will only use Personal Data where such use is compatible with the purposes as outlined above. However, Alef Education may Process Personal Data without Clients’ or End Users’ knowledge or consent, in compliance with the above rules, where this is required by law.

8. Consent

As Alef Education’s Clients are a Controller for Personal Data collected and used as part of the Services, Alef Education require that, where consent is the legal basis for the Processing of any Personal Data or special data, all Clients obtain all necessary consents required under data protection and other laws from End Users before allowing End Users to access the Services. As a Client, you are responsible for checking your local laws to determine the appropriate method of consent and ensuring that consent meets the required standard.

In particular, Alef Education does not permit children or minors (as defined by the laws applicable to a Client) to create an account without the consent and at the direction of a parent or, in lieu of parental consent, School Client. A Client should contact privacy@alefeducation.com if it believes Alef Education have inadvertently collected information from a child or minor without appropriate consent so that Alef Education may delete the information as soon as possible.

9. Disclosures of Personal Data

Alef Education take any requests to share Client and End Users’ data very seriously and any approval for data sharing only takes place after an assessment is undertaken on a case by case basis.

Depending on the Services set up for a Client, Alef Education may make student End User data available to teacher and school administrator End Users as well as registered parents/guardian of student End Users who have Services accounts connected to the student End User (as provided by the Client).

Depending on the features and account controls applicable to the Client’s accounts, the Services may make student End User Personal Data visible to teachers, school administrator or parent/guardian End Users (who are linked to the student End User). Further, Alef Education may provide access to certain Personal Data to the School for the purpose of monitoring End User usage and activity and evaluating the effectiveness of the Client’s use of the Services.

Alef Education may share Personal Data for the purposes set out in the table above to third parties to whom Alef Education may choose to sell, transfer or merge parts of Alef Education’s business or its assets. Alternatively, Alef Education may seek to acquire other businesses or merge with them. If a change happens to Alef Education’s business, then the new owners may use the Personal Data Alef Education has obtained in the same way as set out in this privacy policy.

Alef Education may also share Personal Data with its service providers to help enable it to provide its products/services to Clients and End Users. A list of Alef Education’s Approved Sub-processors can be accessed here.

Alef Education require all third parties to respect the security of Personal Data it shares and to treat it in accordance with the law. Alef Education does not allow its third-party service providers to use Personal Data for their own purposes and only permits them to Process Client and End User Personal Data for specified purposes in accordance with this privacy policy and Alef Education’s instructions.

Alef Education may also disclose Client and End User Personal Data to a third party to comply with applicable laws or regulations, or a valid legal request. If Alef Education are going to release Personal Data in this instance, Alef Education will use reasonable attempts to provide the relevant Client with notice in advance by email, unless Alef Education are prohibited from doing so by law or otherwise where it is impracticable to do so in the circumstances.

The Services may link to and may be linked by websites operated by other entities or individuals. Some of these websites, such as an Alef Education social media page, may be co-branded with Alef Education name or logo. This privacy policy does not apply to, and Alef Education cannot always control the activities of, such other third-party websites. A Client and/or their End Users should consult the respective privacy policies of those third-party websites.

10. International transfers

Unless agreed otherwise in a contract between Alef Education and a Client, by default, any Personal Data processed by Alef Education pertaining to its Clients or their End Users will be hosted on servers in Europe or, for Client’s situated in the United States of America, in the United States of America. Notwithstanding the foregoing, during a Client and their End Users use of Services and interactions with Alef Education, Personal Data may be transferred outside of a Client’s home country and may be stored in and accessed from multiple countries in compliance with applicable laws.

Some of Alef Education external third party service providers are also based in jurisdictions outside of those of its Clients and therefore, the Processing of Personal Data may involve a transfer of data outside of the Client’s country. Whenever Alef Education transfer Personal Data out of a Client’s home country, it ensures a similar degree of protection is afforded to it and Alef Education ensures that it follows any data protection laws governing the transfer to and from of Personal Data outside of specific jurisdictions.

11. Data security

Alef Education have put in place appropriate security measures to prevent Personal Data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, Alef Education limit access to Personal Data to those employees, agents, contractors and other third parties who have a business need to know. They will only Process Personal Data on Alef Education’s instructions and they are subject to a duty of confidentiality.

To protect Clients’ and their End Users’ privacy and security, Alef Education takes reasonable steps to verify their identity before granting account access or responding to Personal Data requests. For example, Alef Education may ask for certain Personal Data to confirm a Client or their End User’s identity, and may require that passwords are created and used to access certain parts of its Services. Clients are responsible for ensuring that they and their End Users’ create and maintain a strong password to help ensure the security of their accounts and they keep these secure.

However, no security measures are perfect and Alef Education cannot ensure or warrant the security of any or all of the information that is shared with Alef Education by Clients or their End Users. In the event that any Personal Data is compromised as a result of a breach of security, Alef Education will take steps to investigate the situation and will notify the Client of the security incident in accordance with applicable laws and regulations.

12. Data retention and requests for deletion

Alef Education will delete an End User account when instructed to do so by a Client. Alef Education may also delete End User accounts following termination or expiry of a Client contract. Prior to deleting an account, Alef Education will notify the Client associated with the account by email and provide an opportunity to download an archive copy of End User Account Data and Profile Data.
Where Alef Education are required to do so by law, Alef Education will retain basic information about its Clients after they cease to be Clients. In limited circumstances Alef Education may also retain Client and End User Personal Data for a longer period in the event of a complaint or if Alef Education reasonably believe there is a prospect of litigation in respect to Alef Education’s relationship with a Client.
In some circumstances Alef Education will anonymise Personal Data (so that it can no longer be associated with or identify the Client and/or associated End Users) for analytical purposes, in which case Alef Education may use this information indefinitely without further notice.

13. Additional information for certain jurisdictions

Additional information about the collection, and use of Personal Data relating to prospective and current Clients in certain jurisdictions are set out below under the relevant section.

• United States of America Federal Law
  To help Clients address their obligations to protect their student End Users’ data privacy, Alef Education have implemented additional controls and procedures for schools, school districts and teachers (collectively referred to as School Clients) when they enter into a contract with Alef Education to use the Services as part of the School’s educational curriculum. When the Services are used as part of the School Client’s educational curriculum, the personal information related to the School Client’s student End Users (Student End Users) that is (i) provided to Alef Education by a Student End User or by a School Client, or (ii) collected by Alef Education during the provision of Services to a School Client, may include information defined as “educational records” by FERPA or other information protected by similar student data privacy laws. Alef Education call this information “Student Records”.

  Alef Education are proud supporters of the Student Privacy Pledge. Its collection and use of Student Records is governed by its contracts with the School Clients, by this Privacy Policy, and by applicable privacy laws. For example, Alef Education work with School Clients to help protect Personal Data contained in Student Records as required by FERPA and to protect the Personal Data of Student End Users under 13 consistent with the COPPA. End User questions about specific practices relating to Student Records provided to Alef Education by a School Client should be directed to the School Client.

• Other applicable laws
  In certain circumstances, local data protection laws (such as the GDPR) may give Clients and their End Users rights with respect to Personal Data if they are located in or are a resident of that country, state, or territory (including European Economic Area and the United Kingdom of Great Britain).
  What rights may be available?
  These rights differ based upon local data protection laws in an individual’s country, state, or territory, but these rights may include one or more of the following:
  • ✔ ask if Alef Education hold Personal Data about a Client or their End Users and request copies of such Personal Data and information about how it is Processed (also called an access request);
  • ✔ request that inaccurate Personal Data is corrected (also called a rectification request);
  • ✔ request deletion of Personal Data that is no longer necessary for the purposes of the Processing, Processed based on withdrawn consent, or Processed in non-compliance with applicable legal requirements (see section 12 of this privacy policy for more information);
  • ✔ request Alef Education to restrict the Processing of Personal Data where the Processing is inappropriate or not as anticipated;
  • ✔ object to the Processing of Personal Data;
  • ✔ request portability of Personal Data that a Client or their End User has provided to Alef Education (which does not include information derived from the collected Personal Data), where the Processing of such Personal Data is based on consent or a contract with the Client and is carried out by automated means; and
  • ✔ lodge a complaint with the relevant local supervisory authority.

  Please consult your local data protection laws to determine what rights may be available to you and which exceptions may apply. If a Client wants to make an access request or a rectification request, the Client can do this themselves using the self-service functionality via applications or platforms that provide the Services. If for any reason a Client is unable to access the data or make any changes via the self-service functionality, the Client can contact Alef Education, via the helpdesk using the following email address helpdesk@alef.ae. For all other rights under applicable law, a Client can exercise its rights on behalf of itself or its End Users by contacting Alef Education by email at privacy@alefeducation.com. Alef Education endeavour to comply with these requests within one calendar month of your request, however in certain circumstances it may take longer if your request is complex or excessive. If this is the case, Alef Education will let you know. End Users of Clients should contact the Client if they want to exercise their rights under applicable law.