Online safety is of paramount importance to Webskape. We take pride in how we deal with the data we hold and make sure we comply with the General Data Protection Regulation (GDPR) and the Age Appropriate Design Code.
We take seriously the privacy of all who visit our website, including visitors, registrants, school subscribers, subscriber’s students, and home users.
We are especially conscious of the need to protect all information concerning children using our services.
We are committed to safeguarding the privacy of students while providing personalised and valuable services.
If there are any requests concerning personal information or any queries with regard to these practices please contact our Privacy Officer by e-mail at [email protected].
References to Terms and Conditions are to the terms and conditions applicable to subscribers, subscriber’s students and home users.
Information Collected Personal information is collected by Webskape Ltd which is registered with the UK’s Information Commission as a Data Controller in accordance with the Data Protection Act 1998.
Company’s Registered Address:
Green Rake House, Birtle, Bury, Lancashire, BL9 6TR, UK
Registered Number: 06359056
ICO Number: ZB551346
We review this policy annually.
Webskape Ltd has designed, developed and delivered a number of products into schools since incorporation. These products include, but are not limited to: Cyber Coach Smart, Cyber Coach French, Emile, Guide to Life and the Personal Development Tracker.
Age Appropriate Design Code
The Secretary of State laid the Age Appropriate Design Code to Parliament under section 125(1)(b) of the Data Protection Act 2018 (the Act) on 11 June 2020. The ICO issued the code on 12 August 2020 and it came into force on 2 September 2020. It sets out 15 standards of age appropriate design reflecting a risk-based approach. The focus is on providing default settings which ensures that children have the best possible access to online services whilst minimising data collection and use, by default.
Webskape meets all obligations of the Code.
1. Best interests of the child:
The best interests of the child are a primary consideration when Webskape Ltd
2. Data protection impact assessments.
Webskape Ltd undertakes a DPIA to assess and mitigate risks to the rights and freedoms of children who are likely to access our resources. Webskape Ltd has taken into account differing ages, capacities and development needs and ensured that compliance with this code.
3. Age appropriate application.
Webskape Ltd takes a risk-based approach to recognising the age of individual users and applies the standards in this code to child users. Webskape Ltd applies the standards in this code to all users.
4. Webskape Ltd undertakes to make all Terms and Condition provided to users to be concise, prominent and in clear language suited to the age of the child.
Webskape Ltd also provides additional specific ‘bite-sized’ explanations about how you use personal data at the point that use is activated.
5. Detrimental use of data.
Webskape Ltd not use children’s personal data in ways that have been shown to be detrimental to their wellbeing, or that go against industry codes of practice, other regulatory provisions or Government advice.
6. Policies and community standards
Webskape Ltd holds all published terms, policies and community standards (including but not limited to privacy policies, age restriction, behaviour rules and content policies).
7. All of Webskape’s settings are set to ‘high privacy’ by default.
Webskape collects and retains only the minimum amount of personal data needed to provide resources.
9. Data sharing.
Webskape Ltd does not disclose children’s data unless with a Lawful or Contractual reason, taking account of the best interests of the child.
All geolocation options are set off by default.
11. Webskape Ltd does not provide parental controls.
12. Webskape Ltd does not profile children.
Webskape Ltd resources adjust to the achievements, answers and other responses to provide appropriate materials for students.
13. Webskape Ltd does not use nudge techniques to lead or encourage children to provide unnecessary personal data or weaken or turn off their privacy protections.
14. Webskape Ltd does not connect to toys or other devices.
15. Webskape Ltd provides prominent and accessible tools to help children exercise their data protection rights and report concerns.
When visitors access our websites, we collect certain information automatically from their device. Specifically, we may collect visitor’s IP address, device type, unique device identification numbers and login information, browser-type and version, time zone setting, operating system and platform, geographic location and other technical information.
We may also collect information about how a visitor’s device has interacted with our websites, including the pages accessed and links clicked, download errors, length of visits to certain pages, page interaction information, and methods used to browse away from any page.
Collecting this information enables us to better understand the visitors who visit our websites. We use this information for our internal analytics purposes and to improve the quality and relevance of our websites.
We collect some of this information via cookies. We use Google analytics to help improve our websites (more information about Google analytics and cookies can be found here: https://support.google.com/analytics/answer/6004245)
Visitors to our websites can also voluntarily provide more information, in particular by completing website enquiry forms and requests for trials. Only the information needed for responding or setting up trials is requested and this is made clear on our contact forms. Visitors must confirm that they are over 18 years old before sending any information.
We provide a personalised experience and as such we collect personally identifiable information about visitors to our websites and users of our services, including registrants, subscribers, subscriber’s students and home users (“Data”) through:
Webskape Ltd’s Use of Personally Identifiable Data
The elements of Data that we collect may include:
Student “names” may be simple identifiers such as UPNs, first names, initials, only their surname or any combination. The name serves to allow teachers to identify the student’s work and to allocate students work such as assessments or homework.
Student names are never shared with other students only with teachers that have permission (this may include teachers at other schools associated with the school such as staff in multi academy trusts).
Usernames need to be unique to a school but do not need to relate to student names.
In multiplayer games, leagues and competition, the top 5 students’ usernames may be displayed to other students.
Our Lawful Basis for processing this information may be Contract and/or Legitimate Interest. We try and minimise the amount of information held to that we need to provide our services and conduct our business.
It should be noted that those under 18 cannot register for an account or sign up for a trial. As such, all data provided by us should be provided by an adult.
Please note that by providing data, the user is deemed to have a Lawful Basis for supplying such data. It is a user’s responsibility to ensure that they have a sufficient lawful basis for supplying all data to us. If a user does not have (or in the future no longer has) a Lawful Basis for supplying us with such personal data, the user must promptly inform us so any relevant data can be removed.
Please note that we do not collect data relating to gender, age, personal addresses, religious beliefs, pupil premium status,….
Please note that when contracting with schools, schools are “controllers” of data and that Webskape Ltd are considered to be “processors” of that data. Webskape Ltd shall Process Data as a Processor for the purposes strictly in accordance with the instructions of the School (the “Permitted Purpose”), except where otherwise required by any EU (or any EU Member State) law applicable to Webskape. The School is deemed to have instructed and authorised Webskape Ltd as reasonably necessary to enable the Webskape to provide any of their products to the School.
The School warrants and represents that it has a lawful basis (pursuant to Applicable Data Protection Law) for supplying all Data to Webskape in connection with the School’s use of the Product and the lawful Processing of the Data by both the School and Webskape for the purposes set out. The School shall indemnify Webskape against all costs, claims, damages, expenses, losses and liabilities incurred by Webskape arising out of or in connection with any failure (or alleged failure) by the School to have a lawful basis for Processing Data.
Updating Your Information
You can update your account information by emailing [email protected].
Data kept for marketing purposes can be changed at any time by clicking on the unsubscribe link on any email from us. Alternatively, you can email [email protected] to update your information.
Your Access to Personally Identifiable Data
The General Data Protection Regulation gives you the right to access information held about you. Your right of access can be exercised in accordance with the regulations. Please make such a request in writing to [email protected].
Webskape Ltd Employees
To ensure that the user receives the best customer care, Webskape Ltd’s staff have access to user data (dependent upon their role). Staff access is controlled and is only granted on a need-to-know basis.
Disclosure of Personal Identifiable Data to third parties
Webskape Ltd has a policy of not sharing any Personal Identifiable Data about visitors, registrants, school subscribers, subscriber’s students, and home users with anyone outside the organisation. (Please note that the usernames/passwords are controlled by the users themselves.)
Who We Share data with
We do not sell or share your data without your consent, other than those processors we use for our business operations under our control:
In all cases the servers where your personal data is stored and processed are located in the European Economic Area or other areas where adequate standards of protection are in place in line with EU law.
We may also disclose Data to third party suppliers if we are otherwise required to do so by law.
Security and Protection of Personal Identifiable Data
All remote access to Webskape Ltd web applications are conducted over HTTPS, an encrypted web link secured with a Secure Sockets Layer (SSL). This is the same method used by banks and commercial entities to secure sensitive data from interception.
External Storage of Personal Identifiable Data
Webskape Ltd stores data on secure database servers – Amazon Webservers. Amazon Webservers are housed in secure data centres, trusted and used by many of the country’s leading organisations.
Transfer of Personal Identifiable Data Outside of the European Economic Area
All data entered and saved on Webskape Ltd’s products is stored and backed up on secure database servers within the UK. Any email communication with us will go through our email systems (Microsoft Office 365 & Google Mail) which is held on Privacy Shield compliant servers held in the USA – the US Privacy Shield policy is available to view on request. Wherever possible we request our customers to upload their data directly to Webskape Ltd’s products rather than emailing it to us.
Use of Personal Identifiable Data
By accepting the Terms and Conditions all home users and school subscribers consent to Webskape Ltd’s use and/or disclosure of the home user’s, schools and the subscriber’s students’ Data for purposes which may include:
Data Retention Schedule
Webskape Ltd holds data on suppliers, potential customers (schools), customers (schools), teachers, students, home users and employees.
Data may be held electronically on our email systems, payroll, CRM systems, and access control systems. (Please note that our accounts software holds no personal data)
Our working email servers (Office 365) have a 6-month retention policy. Our back up email servers (Gmail) have a 36-month retention policy.
Payroll is cleansed in August every year. The cleansing will be the removal of data relating to employees who terminated employment more than 6 years previous.
Customers and potential customers in our CRM and access control system are deleted 5 years from the last active service.
Breach Notification Procedure
Any potential Data Protection Breach (DPB) is notified to the Privacy Officer (PO). The PO will open an incident log and make an initial assessment of the breach’s severity.
The PO will conduct a detailed assessment and investigation of the DPB. The PO will establish a likelihood and severity of a resulting risk to people’s rights and freedoms.
If there is a risk, the ICO will be notified within 72 hours of the notification.
If there is no risk, a documented decision will be made available to the ICO (although the ICO will not be notified).
If a DPB is likely to result in a high risk to the rights and freedoms of individuals, the PO will inform those concerned directly and without undue delay.
Any DPB will be documented and reviewed to ascertain if lessons can be learned.
We run online demo’s daily for teachers throughout the year. They are a great way to see Emile in action and see if it’s right for your tutor group, school or MAT.