Bounce not break logo

Bounce Not Break – Privacy Policy for Pilot Schools

Last Updated: 04 July 2023

This privacy notice is provided to you, as part of your participation in stem4’s Bounce Not Break (“BNB”) pilot project. This privacy notice will inform you about how and why your personal data is used by us as part of the BNB pilot platform, how we look after your personal data, and what privacy rights you have in respect of your personal data under data protection law. We take our data protection and privacy responsibilities seriously, and we are committed to protecting your personal data.

The Company

We are stem4, a private limited company by guarantee and a registered charity in England and Wales (collectively referred to as “stem4”, “we”, “us” or “our” in this privacy notice). Our registered office address is at 51 St George’s Road, London SW19 4EA. We are the controller of your personal data, and are responsible for it.

Why do we collect your personal data? 

We collect and use your personal data so we can provide our services and resources to you for the purposes of the BNB pilot project. We will use any personal information you provide to us solely for the purposes of providing the services during the BNB pilot project and allowing you to access the BNB pilot platform. 

What personal data do we collect? 

During the registration process for the BNB pilot platform, we will collect the following types of personal data about you:

  • School Admin users: first and last name, school email address and phone number.
  • School teachers: first and last name, school email address and phone number.
  • Student users: first and last name (this can be a pseudonym if preferred), and the optional information of (i) gender and (ii) whether or not you have Special Educational Needs.

A student’s and a teacher’s personal data (as entered into the BNB pilot platform by their school) will only be stored on the BNB pilot platform and will not be transferred to any other organisations, other than to that student’s school. Our technical support team will be able to view such data if technical support is needed. The data is stored on our Postgres database, which can only be accessed by our authorised personnel using secure multi factor authentication (MFA) technology. Additionally, access to this database can only be obtained through a secure server, which itself can only be accessed using an authorised SSH (Secure Shell) key.

When associated with a school account in the BNB pilot platform, the name of the school which School Admin, teachers and Student users attend will also be recorded.

If the school does not provide all the information we require to complete the account setup process, we will not be able to provide the school, teachers, or any students with membership to the BNB pilot platform for purposes of the BNB pilot project.

We will also collect personal data from School Admin users and/or teachers through feedback questionnaires made available during the BNB pilot project. This feedback will be collected using online feedback questionnaires on Google Forms. In addition, we will be conducting virtual or in-person review sessions with participating School teachers. Notes taken by us during these review sessions will be retained by us and kept confidential. Any personal data in these notes or feedback will only be made public in relevant publicity and marketing materials with the relevant teacher’s explicit consent.

How do we collect your personal data? 

We collect personal data about you through the account creation process when your School registers for the BNB pilot project.  Any teacher participating in the BNB pilot project, including a School Admin user, should confirm their participation to stem4 by emailing bouncenotbreak@stem4.org.uk.

We may also collect your personal data through feedback questionnaires and virtual or in-person review sessions, as described in the Section above entitled “What personal data do we collect?”.

How do we use your personal data? 

We use your personal data to:

  • register you on the BNB pilot platform;
  • provide you with the resources and services that are part of the BNB pilot project;
  • carry out troubleshooting and provide technical support in relation to our BNB pilot platform;
  • manage our relationship with registered Schools; and
  • receive feedback and input (during in-person review sessions) from participating teachers.

When we process your personal data, data protection law requires us to identify a legal basis for processing your personal data. The legal basis that we rely on to process your personal data can be different depending on the circumstances in which we process it. Most commonly, we will rely on the following legal bases when processing your personal data:

  • where we need to perform a contract with you;
  • where the processing is necessary for our legitimate interests basis (or those of a third party) and your interests and fundamental rights do not override those interests (e.g. for the legitimate interests listed above);
  • where you have provided your consent to the processing (e.g. where we need to process your health data (where you have Special Educational Needs), where you are a student that is participating in the BNB pilot project, or where a teacher consents to us publishing any of the personal data obtained from them in a feedback questionnaire or as part of an in-person review session); and
  • where we need to comply with a legal obligation (e.g. where we are required to disclose your personal data to a court or regulatory authority).

We may monitor, analyse, and compile statistical and performance information based on and/or related to your use of the BNB pilot platform and the services in an aggregated and anonymised format. Such aggregated and anonymised data does not contain your personal data, as you cannot be directly or indirectly identified from it.

Who has access to your data? 

The stem4 technical support team, for the purposes of account management relating to the BNB pilot project and to perform technical system support during the BNB pilot project, will have access to your personal and usage data. Additionally, we may share your information with others in certain situations, including:

  • Courts (e.g. pursuant to a court order) or regulatory / governmental authorities.
  • If you are subscribed to the BNB pilot project through your school, then we will share your personal data with that school.
  • Professional advisors and agents.
  • Other organisations that provide services to us. We use Google for our email and document storage within stem4; we have an external IT support company who may access your personal and usage data for technical support reasons and we have a web development and hosting service who process your usage data on our behalf. Additionally, we hold your contact details on our cloud based CRM (which is provided by our external cloud services provider). The processing of your personal data by these service providers is subject to a data processing contract, as required by data protection law. This helps ensure that your data is handled in accordance with data protection laws.

How long do we keep your personal data? 

We will store your personal information for as long as is reasonably necessary for the purposes for which it was collected. Where your information is no longer needed, we will ensure that it is deleted or destroyed in a secure manner. To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

In some circumstances we may need to store your personal information for longer periods of time, for instance where we are required to do so in accordance with legal or regulatory requirements. We retain such information for a period of 7 years.

In specific circumstances we may also store your personal information for longer periods of time so that we have an accurate record of your dealings with us in the event of any complaints or challenges, or if we reasonably believe there is a prospect of litigation relating to your personal information or dealings.

Transferring your data outside of the UK

We do not transfer personal data outside of the UK.

Your rights 

Under certain circumstances, you have rights under the UK GDPR in relation to your personal data. The rights that are relevant to our processing of your personal data are:

  • Right of access: you have the right to obtain access to your personal data (including a copy of it) and information regarding how your personal data is being used.
  • Right to restriction of processing: you can restrict our processing of your personal data.
  • Right to rectification: you can ask us to rectify any inaccurate or incomplete information about you that we process.
  • Right to be forgotten: you can ask for the personal data we process about you to be erased from our records.
  • Right of portability: you have the right to have the personal data we process about you transferred to another organisation.
  • Right to object: you have the right to object to our processing of your personal data where we are relying on a legitimate interest in order to process it.
  • Right to withdraw your consent: you have the right to withdraw your consent (to the processing by us of your personal data) at any time. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

Where you request to access your privacy rights, we will aim to respond within one month. In certain circumstances it may take up to three months for us to action your request to exercise your rights, but we will let you know where this is the case. Please note that where you request to exercise your rights, we may need to ask you for ID to confirm your identity before we can action your request.

How can I exercise my privacy rights, or get information about how stem4 processes my personal data?

If you have any questions about this privacy notice, our privacy practices, or would like to exercise any of your privacy rights, please contact our Data Protection Lead at dpo@stem4.org.uk

You also have the right to lodge a complaint about our processing of your personal data with the UK Information Commissioner’s Office (“ICO”). The ICO can be contacted on the details provided below. However, we would appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Website: www.ico.org.uk