Introduction
This privacy policy (“Policy”) describes how the Firefly Group (as defined below) collects, uses, and shares personal data when using this website www.fireflylearning.com (the “Site”).
This Policy also applies to your use of mobile application stores when downloading or installing Firefly for Parents, Firefly for Students, and Firefly for Teachers mobile application software hosted on the iOS App Store or the Google Play App Store (App Site).
Please read the following information carefully to understand our views and practices regarding your personal data and how we will treat it. This Policy is provided in a layered format so you can click through to the specific areas set out below. Alternatively, you can download a pdf version of the policy here.
IMPORTANT INFORMATION AND WHO WE ARE
HOW IS YOUR PERSONAL DATA COLLECTED?
DISCLOSURES OF YOUR PERSONAL DATA
Important information and who we are
This Policy aims to give you information on how Firefly collects and processes your personal data through your use of this Site and the Apps, including any data you may provide through the Apps when you log in to your account, or through this Site when you sign up to our newsletter, download one of our ebooks, register for one of our online events, book a demo with us, apply to one of our available positions, or contact us via our online contact form, or by email or phone.
This Policy does not apply to any personal data processed in connection with our “Services” to our customers, educational or other institutions which have engaged us to provide our Services (our “Customers”). In our processing of personal data in connection with our Services, we act as a processor under applicable data privacy laws, and in that context our Customers act as controllers on behalf of which we process the data for purposes of the Services. When we act as a processor our processing of data isn’t governed by this Policy but by our Data Processor Addendum or other data processing terms in place between Firefly and each Customer. For more information on our processing as a processor, please contact the educational or other institution that collected your personal data in connection with the Services.
By accessing and using our Apps and Site, you agree that you have read and understand this Policy and you consent to the privacy practices (and any uses and disclosures of information about you) that are described in this Policy. Please carefully read this Policy together with any other privacy policy or fair processing policy we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This Policy supplements other notices and privacy policies and is not intended to override them.
Controller
Firefly is made up of different legal entities, details of which can be found here:
Firefly Learning Limited (UK)
167-169 Great Portland Street
5th Floor, London, W1W 5PF
Epraise Limited (UK)
privacy@epraise.com
167-169 Great Portland Street
5th Floor, London, W1W 5P
Firefly learning Pty Ltd (Australia)
Room 105
Floor 6
333 George Street
Sydney
NSW 2000
This Policy is issued on behalf of the Firefly Group so when we mention "Firefly”, “Company", "we", "us" or "our" in this Policy, we are referring to the relevant company in the Firefly Group responsible for processing your data. We will let you know which entity will be the controller for your data when you purchase a product or service with us. Firefly Learning Limited in the UK is the controller and responsible for this Site and our Applications.
Because we also have an entity and business operations in Australia, in addition to the UK, we are bound by not only the UK GDPR, the Data Protection Act 2018, and The Privacy and Electronic Communications (EC Directive) Regulations 2003 in the UK, but also the Privacy Act 1988 (Cth) and the Australian Privacy Principles in connection with our data processing activities in Australia. This Policy governs our collection and processing of personal data in both the UK and Australia.
We have appointed a data protection officer (DPO) who is responsible for overseeing questions in relation to this Policy. If you have any questions about this Policy, including any requests to exercise your legal rights, please contact our DPO using the details set out at the end of this Policy.
Changes to this Policy and your duty to inform us of changes
We will post any modifications or changes to the Policy on the Site http://www.fireflylearning.com/. We reserve the right to modify the Policy at any time, so we encourage you to review it frequently. If we make any material change(s) to the Policy, we will notify you via a notice on our website. Historic versions of our Policy can be obtained by contacting us.
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.
The data we collect about you
What is personal data?
As used in this Policy, “personal data” means any information which, either alone or in combination with other information we hold about you, identifies you as an individual, including, for example, your name, postal address, email address and telephone number. It does not include data where your identity has been removed (anonymous data).
We may collect, use, store and transfer different kinds of personal data about you through our Site, which we have grouped together as follows:
- Identity Data includes first name, maiden name, last name, username or similar identifier.
- Contact Data includes email address and telephone numbers.
- Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this Site.
- Profile Data includes your username and password, your interests, preferences, feedback, and survey responses.
- Usage Data includes information about how you use our Site and services.
- Employment & Education data including previous positions held and degrees obtained.
- Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.
From our App users we may collect, use, store and transfer the above categories as well as the following categories of personal data:
- Device Data includes the type of mobile device you use, your mobile network information, your mobile operating system, and the type of mobile browser you use.
For information about the categories of personal data about you that we collect or otherwise access as a data processor for purposes of our Services to our Customers, please contact the Customer institution on behalf of which we process your personal data.
We also collect, use, and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific App or Site feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Policy.
We do not collect any personal information about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.
If you fail to provide personal data
Where we need to collect personal data by law, or under the terms of a contract we have with you or the Customer on behalf of which we process your data for purposes of our Services, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you or our Customer (for example, to provide you or our Customers with our Services). In this case, we may have to cancel the Service in which case we will notify the Customer if this is the case at the time.
How is your personal data collected?
We collect information about you in the following ways:
Information You Give Us
This includes Identity and Contact Data:
- when you download or install one of our Apps
- when you register to receive a free trial of our Apps, or when you complete our online enquiry form;
- when you sign up to our newsletter
- when you download one of our ebooks
- when you register for one of our online events
- when you report a problem with our Apps or our Site or when we provide you with customer support;
- when you correspond with us by phone, email or otherwise.
Information Automatically Collected
We automatically log information about you and your computer or mobile device when you access our Site. For example, when visiting our Site, we log your computer or mobile device operating system name and version, manufacturer and model, browser type, browser language, screen resolution, the website you visited before browsing to our Site, pages you viewed, how long you spent on a page, access times and information about your use of and actions on our Site. We collect this information about you using cookies.
Information obtained from third parties
We will receive personal data about you from various third parties as set out below:
- Technical Data from analytics providers such as Google, LinkedIn and Twitter based outside the UK;
- Contact, Financial and Transaction Data from providers of technical, payment and delivery services such as Chargebee based outside the UK.
- Identity and Contact Data from data brokers or aggregators such as The Education Company and the Independent Schools Council, both based inside the UK.
- Identity and Contact Data from our Customers.
- Education & Employment data from our recruitment platform, Workable.
When we provide our Services, we collect personal data under the direction of contracted educational or other institutions (our “Customers”). We process that information as a service provider for our Customers through our Services. We have no direct relationship with the individuals whose personal data we process through our Services. Any personal data about individuals that we collect on behalf of our Customers is used solely for the business purpose for which our Customers provide the information, and we will promptly comply with Customers’ requests to provide, correct, or remove information, in compliance with applicable law.
When you use our Site or Apps, whether you are an employee of a Customer, an individual with whom we interact on behalf of our Customer, or any other individual, we may collect the categories of information listed above from you directly through your interaction with the Site or Apps.
How we use your personal data
We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:
- Where we need to perform the contract we are about to enter into or have entered into with you or the Customer on whose behalf we process your personal data.
- Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
- Where we need to comply with a legal obligation.
Generally, we do not rely on consent as a legal basis for processing your personal data although we will get your consent before sending third party direct marketing communications to you via email or text message. You have the right to withdraw consent to marketing at any time by contacting us.
Purposes for which we will use your personal data
We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified, for our Site and App users in the UK, what our legitimate interests are where appropriate.
| Purpose/Activity | Type of data | Lawful basis for processing including basis of legitimate interest |
|---|---|---|
|
To install any of our Apps
|
Identity
Contact
|
Performance of a contract (to give right to the contract we have signed the school on whose behalf we process your Personal Information for purposes of our Services)
|
|
To manage our relationship with you which will include notifying you about changes to our privacy policy
|
Identity
Contact
Profile
Marketing and Communications
|
Necessary to comply with a legal obligation (to notify you about changes to our privacy policy)
|
|
To enable you to complete a survey regarding our Services
|
Identity
Contact
Profile
Usage
Marketing and Communications
|
Necessary for our legitimate interests (to study how customers use our Services, to develop them and grow our business)
|
|
To administer and protect our business, our Apps, and this Site (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)
|
Identity
Contact
Device
Technical
|
Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise)
|
|
To deliver relevant Site or App content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you
|
Identity
Contact
Device
Profile
Usage
Marketing and Communications
Technical
|
Necessary for our legitimate interests (to study how customers use our Services, to develop them, to grow our business and to inform our marketing strategy)
|
|
To use data analytics to improve our Apps, Site, services, marketing, customer relationships and experiences
|
Device
Technical
Usage
|
Necessary for our legitimate interests (to define types of customers for our Services, to keep our Apps and Site updated and relevant, to develop our business and to inform our marketing strategy)
|
|
To make suggestions and recommendations to you about Services that may be of interest to you
|
Identity
Contact
Device
Technical
Usage
Profile
Marketing and Communications
|
Necessary for our legitimate interests (to develop our services and grow our business)
|
|
To process your application for one of our available positions
|
Employment
Education
|
Necessary for performance of a contract
|
Marketing
We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising.
Promotional offers from us
We may use your Identity, Contact, Device, Technical, Usage and Profile Data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which Services and offers may be relevant for you.
You will receive marketing communications from us if you have requested information from us or purchased Services from us and you have not opted out of receiving that marketing.
Third-party marketing
We will get your express opt-in consent before we share your personal data with any third party for marketing purposes.
Opting out
You can ask us or third parties to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you, by visiting our preference centre or by contacting us at any time.
Where you opt out of receiving these marketing messages, this will not apply to personal data provided to us as a result of a Service purchase, Service experience or other transactions.
Cookies
We use cookies and other tracking technologies to distinguish you from other users of the Site, the distribution platform (Appstore). This helps us to provide you with a good experience when you use the Site and allows us to improve the Site. We also use cookies or similar technologies to analyse trends, administer the Site, track our users’ movements around the Site, and to gather demographic information about our Site user base as a whole.
You can typically remove or reject cookies via your browser settings. In order to do this, follow the instructions provided by your browser (usually located within the “settings”, “help” “tools” or “edit” facility). Many browsers are set to accept cookies until you change your settings.
If you do not accept our cookies, you may experience some inconvenience in your use of our Site. For example, we may not be able to recognise your computer or mobile device and you may need to log in every time you visit our Site.
For more information about our use of Cookies, please contact us at privacy@fireflylearning.com. You can find our list of cookies and information about how they are used here: https://fireflylearning.com/list-of-cookies
Change of purpose
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.
If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
Disclosures of your personal data
We may share your personal data with the parties set out below for the purposes set out in the table Purposes for which we will use your personal data above:
- Internal Third Parties. We may share your personal data with our affiliates within the Firefly Group as well as within the Veracross group of companies based in the United States, Australia, and Singapore.
- Our Third-Party Service Providers. We may share your personal data with our or our affiliates’ third-party service providers such as Salesforce, Pardot, Microsoft, Atlassian, Google, Zoom, Docusign, Citrix, Pendo, Groove.co, and ChiliPiper based outside the UK, who provide services such as data analysis, information technology and related infrastructure provision, customer service, email delivery, auditing and other similar services. These third parties are only permitted to use your personal data to the extent necessary to enable them to provide their services to us. They are required to follow our express instructions and to comply with appropriate security measures to protect your personal data.
- Corporate Restructuring. We may share personal data when we do a business deal, or negotiate a business deal, involving the sale or transfer of all or a part of our business or assets. These deals can include any merger, financing, acquisition, or bankruptcy transaction or proceeding.
- Other Disclosures. We may share personal data as we believe necessary or appropriate: (a) to comply with applicable laws; (b) to comply with lawful requests and legal process, including to respond to requests from public and government authorities to meet national security or law enforcement requirements; (c) to enforce our Policy; and (d) to protect our rights, privacy, safety or property, and/or that of you or others.
- We may also disclose your personal data to others outside our group of companies where you have expressly consented to the disclosure or your consent may be reasonably inferred from the circumstances; or, if you are based in Australia and we are permitted to disclose the information under the Privacy Act.
International Data Transfers
Please note that Firefly is part of the Veracross LLC group (https://www.veracross.com/), a US company with an address at 401 Edgewater Place, Suite 360, Wakefield, Massachusetts 01880.
For operational purposes, we now share your personal data within the Veracross Group. This will involve, if you are based in the UK, transferring your data outside the UK and European Economic Area (EEA) and, if you are based in Australia, transferring your data outside Australia, and in particular to the United States.
Many of Veracross’ external third-party vendors are also based outside the UK and Australia, so their processing of your personal data will also involve a transfer of data outside the UK or Australia (as applicable).
Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by using specific contracts approved by the UK Government which give Personal Information the same protection it has in the UK. For further details, see UK International data transfer agreement and guidance.
Please also note that Veracross LLC and its subsidiaries participate in and have certified their compliance with the EU-U.S. Data Privacy Framework (DPF), the Swiss-U.S. Data Privacy Framework Programs, and the UK Extension thereto, as these programmes are administered by the US Department of Commerce. As a group we are committed to subjecting all personal data received from European Union (EU) member countries, the UK, and Switzerland, respectively, in reliance on each DPF Program, to the Programs’ applicable Principles of Notice, Choice, Accountability for Onward Transfer, Security, Data Integrity and Purpose Limitation, Access, and Recourse, Enforcement, and Liability. To learn more about the DPF Programs, and to view our certification, visit the U.S. Department of Commerce’s DPF Framework Participants List at https://www.dataprivacyframework.gov/s/participant-search
Veracross is responsible for the processing of personal data it receives, under each DPF, and subsequently transfers to a third party acting as an agent on its behalf.
Veracross complies with the DPF Principles for all onward transfers of personal data from the EU, the UK, and Switzerland, including the onward transfer liability provisions.
With respect to personal data received or transferred pursuant to the DPF Programs, Veracross is subject to the investigatory and enforcement authority of the U.S. Federal Trade Commission. In certain situations, we may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.
If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S.-based third-party dispute resolution provider (free of charge) at https://feedback-form.truste.com/watchdog/request.
Under certain conditions, more fully described on the DPF website at https://www.dataprivacyframework.gov/s/article/How-to-Submit-a-Complaint-Relating-to-a-Participating-Organization-s-Compliance-with-the-DPF-Principles-dpf , you may be entitled to invoke binding arbitration when other dispute resolution procedures have been exhausted.
Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK or Australia.
Data security
We have put in place appropriate organisational, technical and administrative measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.
We will collect and store personal data on your Device using application data caches and browser web storage and other technology.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
Unfortunately, no transmission or storage system can be guaranteed to be completely secure, and transmission of information via the internet is not completely secure. If you have reason to believe that our Apps or Site are no longer secure, please immediately notify us of the problem by contacting us using the details in the Contact Information section below.
Data retention
We will only retain your personal data for as long as reasonably necessary to fulfil the purpose we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.
To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
Details of retention periods for different aspects of your personal data can be obtained by contacting us
In some circumstances you can ask us to delete your data: see your legal rights below for further information.
In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.
Our Policy on Children
Our Apps and Site are not directed to children under 13. If a parent or guardian becomes aware that his or her child has provided us with information without their consent, he or she should contact us using the details in the Contact Information section below. We will delete such information from our files as soon as reasonably practicable.
Your legal rights
The following section only applies to you if we collect and process your personal data directly and for our own purposes, not on behalf of our Clients for purposes of the Service we provide to you on their behalf. If we collect and/or otherwise process your data on behalf of your school or camp this section does not apply to you and we ask that you please direct any request to exercise your data subject rights to the school or camp on behalf of which we process your personal data for purposes of our Service. Under certain circumstances, you have rights under data protection laws in relation to your personal data:
- The right to request access to your personal data.
- The right to request correction of your personal data.
- The right to request erasure of your personal data.
- The right to object to the processing of your personal data.
- The right to request restriction of processing your personal data.
- The right to request transfer of your personal data.
- The right to withdraw consent.
We will process your request within the time provided by applicable law.
We will not discriminate against you for exercising your data subject rights.
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we could refuse to comply with your request in these circumstances.
Exercising Your Data Subject Rights
The following section only applies to you if we collect and process your personal data directly and for our own purposes, not on behalf of our Customers for purposes of the Services we provide to you on their behalf. If we collect and/or otherwise process your information this section does not apply to you, and we ask that you please direct any request to exercise your data subject rights to the data owner / controller on behalf of which we process your personal data for purposes of our Services.
If we collect and process your personal data directly and for our own purposes, you may submit a request to exercise your data subject rights by sending an email via the link below:
Individuals who submit requests to exercise data subject rights will be required to verify their identity by answering certain questions. We cannot process data subject rights requests until your identity is verified. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
If you are making a request for access, we may not be able to provide specific pieces of personal data if the disclosure creates a substantial, articulable, and unreasonable risk to the security of your personal data, your account with us, or our systems or networks.
If you are making a request for erasure of personal data, we will ask that you confirm that you would like us to delete the personal data again before your request is processed.
You may designate an authorised agent to submit a request on your behalf by providing that agent with your written permission. If an agent makes a request on your behalf, we may still ask that you verify your identity directly with us before we can honour the request.
Agents who make requests on behalf of individuals will be required to verify the request by submitting written authorisation from the individual. We will not honour any requests from agents until authorisation is verified.
If you are seeking to access, correct, or delete information on our Services, we may refer your request to the Customer (your educational or other institution).
We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
If you wish to exercise any of these rights, please make clear, in your request: (i) what personal data is concerned; and (ii) which of the above rights you would like to enforce.
Complaints
We are committed to resolve any complaints about our collection or use of your personal data. If you would like to make a complaint regarding this Policy or our practices in relation to your personal data, please contact us at: privacy@fireflylearning.com.
We will reply to your complaint as soon as we can and in any event, within 45 days. We hope to resolve any complaint brought to our attention, however if you feel that your complaint has not been adequately resolved, you reserve the right to contact your local data protection supervisory authority, which for the UK, is the Information Commissioner’s Office and, for Australia, is the Office of the Australian Information Commissioner.
Contact Information
We welcome your comments or questions about this Policy. You may contact our DPO in writing at privacy@fireflylearning.com, or 167-169 Great Portland Street, 5th Floor, London, W1W 5PF.