Introduction
The Website is offered from the United Kingdom by Flosendo Ltd (referred to in this Notice as “our”, “us”, “Flosendo” and “we”), a company registered in England and Wales.
We are committed to protecting and respecting your privacy. This Privacy Notice (together with any other documents referred to herein) sets out the basis on which the personal data collected from you, or that you provide to Us, will be processed by Us in connection with Our website and general enquiries processes. Please read the following carefully to understand Our views and practices regarding your personal data and how We will treat it.
For the purposes of UK data protection law, Flosendo Ltd acts as Data Controller in respect of personal data collected directly through this website and general enquiries. Where a school transfers pupil or staff data to us for the delivery of a Flosendo programme, the school is the Data Controller and Flosendo acts as Data Processor on the school’s behalf, processing data only on the school’s documented instructions. Where Flosendo acts as Data Processor, the processing will be governed by a Data Processing Agreement between Flosendo and the school. We are in the process of putting formal Data Processing Agreements in place with all school partners; in the interim, Flosendo commits to processing pupil data only for the purposes described in this notice and in accordance with UK GDPR. Schools may request a copy of our standard Data Processing Agreement by contacting enquiries@flosendo.com.
Please note: where you apply for a job with Us, these Privacy Notice provisions will apply to Our processing of your personal information.
Your Personal Information
Information We collect from You
We collect and process some or all of the following types of information from you:
- Pupil and teacher account data is given to us by schools when they set up accounts. The data fields received are: first name, surname and school email address. Pupils and teachers sign in with a password, which we store only as a one-way hash.
- Information that you provide when you send Us an enquiry. This includes information provided via email or by any other method. In particular, We process personal details such as name, email address, role, and the organisation you work for, together with any other details included in your enquiry.
- If you contact Us, We may keep a record of that correspondence.
- Details of all actions that you carry out through the use of the Services.
- Technical details our servers record, including your IP address, when they cannot complete a request and, in Eden, when a teacher or administrator makes certain changes.
- Until September 2026, pupils could give a parent’s or carer’s name and email address in Eden. Eden no longer asks for them; those already given are kept with the pupil’s record and have never been used.
Information We Collect From Other Sources
Where we receive personal data about you from a school or other third party in connection with our programmes, we will only process that data as described in this Privacy Notice and in any Data Processing Agreement in place with that school.
Uses Made Of Your Information
Lawful basis for processing
We rely on the following lawful bases under UK GDPR Article 6, depending on the nature of the data and the purpose of processing: (a) contractual necessity – where processing is necessary to deliver a programme commissioned by a school; and (b) legitimate interests – for improving our services, where we have assessed that our interests are not overridden by your rights. Given that our programmes are used by children, we apply the highest standard of care to all processing of children’s personal data and do not rely on legitimate interests as a basis for processing children’s data on the platform itself.
Purposes of processing
We use information held about you in the following ways:
- On the basis that there is a contract between Us and you. We process your data in order to fulfil this contract.
- Pupil and teacher data received from schools is used to provision accounts on our platform. This enables teachers to facilitate the programme, monitor engagement, and award virtual currency. It enables pupils to participate in programme activities and track their own progress.
- To communicate with you in response to enquiries.
- To retain pupil records so that a pupil may participate in future Flosendo programmes. Data is retained for up to 8 years from the date of last programme participation, after which it is securely deleted.
- To communicate with schools and prospective school partners in response to enquiries about our programmes.
How We Store Your Personal Data
Security
We take appropriate measures to ensure that all personal data is kept secure including security measures to prevent personal data from being accidentally lost, or used or accessed in an unauthorised way. We limit access to your personal data to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.
We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where We are legally required to do so.
Unfortunately, the transmission of information via the internet is not completely secure. Although We will do Our best to protect your personal data, We cannot guarantee the security of your data transmitted through any online means, therefore any transmission remains at your own risk.
Where We store your personal data
We store your personal data in the cloud, on Amazon Web Services servers in London, in the United Kingdom. Email you send Us is held by Microsoft (Microsoft 365). When a pupil plays a video in Eden, YouTube (Google, in the United States) receives the device’s IP address and what is watched.
If you would like further information please contact Us via enquiries@flosendo.com. We will not transfer your personal data to any organisation (or subordinate bodies) governed by public international law or which is set up under any agreement between two or more countries.
How long we keep your personal data
We will hold pupil programme records for a period of up to 8 years from the date of last programme participation. After this period, data is securely deleted. Website enquiry data is retained for up to 6 years in line with the Limitation Act 1980.
Your rights
Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have a number of important rights, which you may exercise free of charge. In summary, those include rights to:
- access to your personal data and to certain other supplementary information that this Privacy Notice is already designed to address
- require Us to correct any mistakes in your information which We hold
- require the erasure of personal data concerning you in certain situations
- receive the personal data concerning you which you have provided to Us, in a structured, commonly used and machine-readable format
- object at any time to processing of personal data concerning you for direct marketing
- object to decisions being taken by automated means which produce legal effects concerning you or similarly significantly affect you
- object in certain other situations to our continued processing of your personal data otherwise restrict our processing of your personal data in certain circumstances
- claim compensation for damages caused by our breach of any data protection laws.
Further information
If you have any questions, comments or complaints about this Notice or wish to: (i) exercise any of the rights described above; (ii) make any other type of request in relation to the processing of your Data; or (iii) report a concern or complaint related to the processing of your Data; you should contact: enquiries@flosendo.com
We hope that we will be able to address any of your requests. However, you have the right to make a complaint about the processing of your personal data to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.