Privacy statement LessonUp B.V.

Website

Personal data is processed by LessonUp when the website (www.lessonup.com) is visited. For this purpose, LessonUp is the controller within the meaning of the GDPR. Below, LessonUp explains what data LessonUp processes and for what purposes it does so.

We process the following personal data via our website:

Contact (form): If you contact us via the contact form on our website, we will process your name, email address and any other information and personal data that you share with us, including your comments (message, request, query or complaint). We do so to be able to take note of your comments, to contact you, and to update you on progress in handling your comments. We process this personal data based on our legitimate interests, namely, to contact you and to provide you with help regarding your comments.

Newsletters: If you subscribe to our newsletters, we will process your name and email address. We do so to inform you about developments within LessonUp and about our services. If you no longer want this, you can unsubscribe via a link in the relevant mailing. We process this personal data on the basis of your consent. If you are already one of our customers, we may send you newsletters – without prior consent – based on our legitimate interests, namely, to inform you of similar services that may be of interest to you.

Social media: If you want to contact us via our social media channels or if you leave a message on one of our social media pages, then we will process your name or username and any other personal data that you share with us, including your comments (message, request, query or complaint). We do so to be able to take note of your comments, to contact you, and to update you on progress in handling your comments. We process this personal data based on our legitimate interests, namely, to contact you and to provide you with help regarding your comments.

Please note that our social media channels are also controlled by the social media itself. Check their own privacy policy to see how the relevant social media handle your personal data:

• Instagram: Privacy policy and information
• Facebook: Data policy
• Twitter: Privacy policy
• YouTube: Privacy policy

Trial: If, as a teacher, you want to try LessonUp via the 30-day trial, we will process your name, email address and password. We do so to provide you with access or temporary access to our application(s) and to be able to contact you with information about our complete range of services. For more information on data that is processed in this case, please refer to APPLICATIONS.

Without having the data as meant above available, we cannot comply with your requests and/or grant you access to LessonUp.

In the context of our legitimate interests (to improve our website and in the context of compliance with laws and regulations), in response to complaints or reports (including notice-and-take-down requests) we process data about (alleged) infringements of intellectual property rights and/or other unlawful actions and, if necessary, personal data of users involved.

Website and applications

Receivers

Your personal data will not be shared with other parties, except in the cases mentioned below.

Processors:

We make use of processors. These are parties that support us in our services and who only process personal data on our behalf and on our instruction. For example, we make use of:

• The email marketing programme Sendinblue, based in France (EU);
• The hosting provider Google, with its server based in Ghislaine, Belgium (EU);
• The marketing software Hubspot, based in Germany (EU);
• Our application monitoring software Sentry, based in Iowa (US);
• The CRM and management software Pipedrive, based in Germany (EU), used for drawing up and managing quotes, among other things;
• Our helpdesk software Intercom, based in the US.

The processors engaged by LessonUp must comply with strict security requirements and have committed themselves towards LessonUp not to use the data for any purpose other than those purposes mentioned above. The personal data is stored on a server in the Netherlands and Belgium.

External controllers:

• We may proceed in providing information or personal data to external parties, such as entitled parties, supervisory bodies, the Tax and Customs Administration, judicial authorities, police and other investigative authorities, if it is mandatory for LessonUp to do so pursuant to laws or regulations, or if this is justified based on this Privacy Statement.
• When implementing payments, we make use of payment providers:
• i) Stripe, based in the USA;
• ii) Mollie based in the Netherlands.

Where recipients of personal data are based outside the EU, LessonUp will conclude the appropriate Standard Contractual Clauses with these recipients to ensure the adequate protection of the personal data after the transfer outside the EU. We do not apply this rule to schools or individual teachers outside the EU, as we assume that these schools and teachers will sufficiently protect the personal data of their own students and do not require additional data protection obligations from LessonUp.

For lesson components video and interactive video, LessonUp makes use of YouTube and Vimeo API services. More information on how these parties handle your personal data is available at:

• YouTube: Privacy policy and Terms
• Vimeo: Privacy policy and Terms

Student information systems

The school/teacher may request us to pass on certain data about Students (including grades) to a student information system (e.g. Magister). Depending on the role taken up by the student information system, this will apply as a processor or an external controller. We only share this data in our role as a processor.

Retention periods

LessonUp does not retain the personal data that it processes for longer than is necessary for the purposes described in this Privacy Statement. Thereafter, this personal data is deleted. In any case, we maintain the following retention periods:

• Newsletters: If you have subscribed to the newsletter, we will retain your data until you unsubscribe via the link included in each newsletter and in any case one year after we no longer have a contractual relationship with you.
• Personal data in our administration for the Tax and Customs Administration: We retain this personal data for seven (7) years, in accordance with our statutory obligation.
• Miscellaneous: We only retain other personal data for as long as this is necessary for the purpose and in any case no longer than thirty-six (36) months unless we are legally obliged to retain the personal data for longer.

For the processing of personal data in which LessonUp acts as a processor, the retention periods set out in the data processing agreement will apply.

Security

LessonUp has taken appropriate technical and organisational measures to protect personal data from loss and any form of unauthorised access.

The website has been secured with an encrypted connection (256-bits SSL – shown by the lock symbol in the browser) to ensure security between the visitor's computer and the LessonUp servers.

More information on security measures taken by LessonUp can be found in the data processing agreement concluded by the schools with LessonUp data processing agreement.

Rights

Based on the GDPR, in respect of the processing of your personal data, you have certain rights. It concerns the following rights:

• Access: You have the right to access the data that we process about you, including information about the purposes for which we process that data, to whom the data has been provided and what the (expected) retention period is.
• Correction: If it appears that we have stored incorrect or incomplete data about you, then you have the right to have this data corrected.
• Deletion: You have the right to have your data deleted by us. Under certain circumstances, we may refuse the request for deletion, e.g. when we have to retain the data in connection with tax obligations.
• Limitation: You have the right to limit the processing of your data, e.g. pending the handling of an objection lodged by you.
• Objection: You have the right to object to the processing of your personal data, insofar as it relates to your particular situation.
• Withdrawal of consent: You have the right to withdraw your consent for the processing of your personal data, provided that the processing is based on your consent. This does not affect the validity of the processing which was executed before the moment that consent was withdrawn.
• Complaint to supervisory authority: You have the right to file a complaint at the Dutch Data Protection Authority, if you believe that we process your personal data unlawfully. Of course, you could also file a complaint directly at LessonUp.

You could submit any objections or requests to LessonUp using the contact details below. LessonUp will assess the objection and/or request in accordance with the requirements of the GDPR.

If LessonUp processes your personal data based on an agreement with a school, then you must submit any objections and/or requests directly to your school.

Protocol for reporting a data breach

LessonUp maintains a fixed protocol for reporting data breaches and/or incidents or security incidents, which can be found here. LessonUp will always inform the school's management within 24 hours of a data breach or security incident.