Privacy Statement

1.0: Scope:

All data subjects whose personal data is collected, is done so in line with the requirements of the GDPR/Data Protection Act 2018.

2.0: Responsibilities:

The Director is responsible for ensuring that this notice is made available to data subjects prior to the school/client organisation collecting/processing their personal data. All Employees/Staff of the school/client organisation who interact with data subjects are responsible for ensuring that this notice is drawn to the data subject’s attention and that they are aware of the lawful grounds for the processing of their data in relationship to the system.

3.0: Who are we?

The Steam School platform combines STEAM powered project based learning with weekly broadcasts from global STEAM experts. Steam School works with schools and home educating families.

Our data protection representatives can be contacted directly here:

[email protected]

07957411209

4.0: Data Being Processed:

4.1: Depending on the services being requested/provided, the personal data we would like to process on your behalf is:

Personal data type:	Source (where Steam School Ltd obtained the personal data from)	Lawful Grounds
Teacher & Parent – to provide access to resources:
First name*	School licenses: Teacher data provided by the host school. Family Subscription: Parent data provided by the parent.	Article 6(1b) Contractual agreement
Surname *
Email address *
Students – to provide access to resources:
First name*	School licenses: Student data provided by the host school. Family Subscription: Student data provided by the parent. Student activity and achievement data is collated by the platform and shared with lead teachers in a student’s school (school license) or with a parent (family subscription).	Article 6(1b) Contractual agreement
Surname*
D.O.B
Gender
Activity and Achievement Data
Landline*
Postcode*
Financial Information:
First name	This information will be retained for 7 years, in line with financial information for completeness and accuracy of the record.	Article 6(1b) Contractual agreement
Surname
Email address

4.2. Our legal basis for processing for the personal data:

Article 6 (1b) – processing is necessary for the performance of a contract to which the organisation has agreed.
Article 6 (1f) – processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party.

5.0. Consent:

5.1. The data controller is consenting to this privacy notice through the lawful processing condition of performance of a contract, upon the purchase of any of the following licenses; Use of Steam School Ltd. You are giving Steam School Ltd permission to process the personal data supplied specifically for the purposes identified. In doing so, Steam School Ltd must assume that the data has been collected under the terms identified in Article 6 ‘Lawfulness of processing’ of the General Data Protection Regulation and reflected in the Data Protection Act 2018.

Where consent is required for Steam School Ltd to process both types of personal data, it must be explicitly given. Where we are asking you for special category personal data we will always tell you why and how the information will be used.

You may withdraw consent at any time by contacting Steam School Ltd using the contact details above or directly through the link provided directly in any communication.

6.0. Use of data for marketing purposes (B2B purposes only):

6.1. Data used by Steam School Ltd for marketing purposes is obtained in the following manner.

From the individual where consent has been obtained directly from 3^rd Parties – Under Article 6(f) of GDPR – Legitimate Interest where the data has been confirmed to be eligible for use for these purposes and the Privacy and Electronic Commutation (PECR) guidelines.

6.2. Purposes and Intentions:

6.2.1.Steam School Ltd.’s purpose for processing and storing personal (B2B) data is as follows:

Increased awareness of the product in the market.
The opportunity to present a demonstration of the system and potentially sell a system to the organisation (B2B environment only).

6.2.2. Engagement with organisations business only environment contacts to raise awareness of Steam School Ltd.

To arrange meetings to provide a demonstration for interested parties.
To establish a frequency of contact that suits each individual business.
Increased networking opportunities.
Growth of the business.

6.2.3. Steam School Ltd’s intentions in using business data are primarily:

To engage with organisations business only environment contacts to raise awareness of Steam School Ltd.
To arrange meetings to provide a demonstration for interested parties.
To enquire about and aim to establish a frequency of contact that suits each individual business.

6.2.4. Guidelines and Restrictions:

Steam School will remove CTPS exclusions either prior to use or at once upon discovery of CTPS.
No non-business email addresses i.e. @hotmail will not be used – they must be [email protected].
All individuals at businesses will be given a clear route to opt out of future email communications and to apply their rights under current data protection legislation.
Mobile numbers will not be obtained, recorded or used unless obtained through direct communication with any given business and given out by that business voluntarily to allow InVentry to attempt to contact a given individual.
Data obtained for marketing purposes shall not be used for any other purpose.

7.0. Disclosure:

Steam-school will not release the information to any third party unless the request is subject to legal obligation without obtaining the express written authority of the partner who provided the information.

8.0. Retention Period:

Steam School Ltd will process personal data for the following periods;

Account access.
Staff – for the period of the contract.

Financial information

7 years under Article 6(f) – Legitimate Interest of the organisation for completeness of the record.

Marketing

For 36 months or until consent is withdrawn.

9.0. As the Processor:

All data hosted by Steam-school is done so in compliance with the requirements laid in GDPR/Data Protection Act 2018.

For more information on storage and processing security, please contact Steam-school using the details above.

Steam School Ltd will support the Data Controller in demonstrating compliance with the regulations covering the UK. Where required and reasonable, the processor will work with the data controller to:

Cooperate with the relevant data protection authorities in the event of an enquiry
Report data breaches to the controller without delay
Help the controller to comply with data subject rights
Assist the data controller in managing the consequences of data breaches
Inform the controller if the processing instructions infringe GDPR/Data Protection Act 2018.

Steam School Ltd will take all possible steps to ensure the security of the data where it processes this on behalf of the data controller. However, it cannot be held responsible or liable for the any breach of data that is beyond its control. All requests for additional assistance will be subject to the agreement of the company’s management.

Should Steam School choose to change a 3^rd party service under Article 28 (2) of GDPR, we will complete appropriate impact assessments, alter our privacy statement where appropriate and notify you of this change. Where an additional service is being provided, consent will be sought.

10.0. Your Rights as a Data Subject:

At any point while we are in possession of or processing your personal data, you, the data subject, have the following rights:

Right of access – you have the right to request a copy of the information that we hold about you.
Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete.
Right to be forgotten – in certain circumstances you can ask for the data we hold about you to be erased from our records.
Right to restriction of processing – where certain conditions apply to have a right to restrict the processing.
Right of portability – you have the right to have the data we hold about you transferred to another organisation.
Right to object – you have the right to object to certain types of processing such as direct marketing.
Right to object to automated processing, including profiling – you also have the right to be subject to the legal effects of automated processing or profiling.
Right to judicial review: in the event that InVentry Ltd refuses your request under rights of access, we will provide you with a reason as to why. You have the right to complain as outlined in clause 2.6 below.

All of the above requests will be dealt with in line with Steam-school’s Subject Access Procedure and will shared with the customer should a request come from directly a subject.

11.0. Complaints:

In the event that you wish to make a complaint about how your personal data is being processed by Steam School Ltd or how your complaint has been handled, you have the right to lodge a complaint directly with the supervisory authority and schools/organisation’s data protection representatives.

The details for each of these contacts are:

	Supervisory authority contact details	Data and Safeguarding Manager contact details
Contact Name:	Information Commissioners Office	Steam School Ltd
Address line 1:	Wycliffe House	A117a Business First Centre
Address line 2:	Water Lane	25 Goodlass Rd
Address line 3:	Wilmslow	Liverpool
Address line 4:	Cheshire	L24 9HJ
Address line 5:	SK9 5A
Email:	[email protected]	[email protected]
Telephone:	0303 123 1113	07957411209

Document Owner and Approval:

The Data Protection Officer is the owner of this document and is responsible for ensuring that this record is reviewed in line with the review requirements of the GDPR.

Date: 30^th May 2019

Cookie Policy

Definitions and Interpretation

In this Policy the following terms shall have the following meanings:

“Account”	means an account required to access and/or use certain areas and features of Our Site;
“Cookie”	means a small text file placed on your computer or device by Our Site when you visit certain parts of Our Site and/or when you use certain features of Our Site. Details of the Cookies used by Our Site are set out in section 12, below;]
“Our Site”	means this website, www.steam-school.com
[“UK and EU Cookie Law”	means the relevant parts of the Privacy and Electronic Communications (EC Directive) Regulations 2003 as amended in 2004, 2011 and 2015; and]
“We/Us/Our”	means Steam School, a limited company registered in England under 10200861 whose registered address is A117a Business First Centre, 25 Goodlass Rd, Liverpool L24 9HJ

What Cookies Do We Use and What For?

Our Site may place and access certain first party Cookies on your computer or device. First party Cookies are those placed directly by Us and are used only by Us. We use Cookies to facilitate and improve your experience of Our Site and to provide and improve Our products and services. By using Our Site you may also receive certain third party Cookies on your computer or device. Third party Cookies are those placed by websites, services, and/or parties other than Us. We use third party Cookies on Our Site for advertising services. In addition, Our Site uses analytics services provided by Google Analytics, which also use Cookies. Website analytics refers to a set of tools used to collect and analyse usage statistics, enabling Us to better understand how people use Our Site.