BoomApps privacy policy

Effective Date: 2nd September 2021 (In line with the UK ICO Age Appropriate Design Code enforcement)

1. Introduction and Definitions

BoomApps, which includes the BoomReader and BoomWriter platforms and associated services (collectively, the “Product” or “Service”), is committed to protecting the privacy and security of the personal data we process. The Service is provided by Squirrel Learning Limited (referred to as "BoomApps," "We," "Us," or "Our").

This Policy sets out the basis on which any personal data we collect from you, or that you provide to us, is processed by us in compliance with the UK Data Protection Act 2018 (the “Act”) and the UK General Data Protection Regulation (UK GDPR).

Key Definitions:

School:

The educational institution that purchases a subscription and provides data to BoomApps.

Data Controller:

The School is the Data Controller.

Data Processor:

BoomApps is the Data Processor.

Child/Children:

Identified as under 13 years of age for the purposes of GDPR. Our policies are designed to protect all users under the age of 18, in line with the ICO Age Appropriate Design Code.

2. Our Role: Data Controller vs. Data Processor

The School is the Data Controller, and BoomApps is the Data Processor. We rely on the School to ensure they have the necessary legal basis and appropriate privacy policies in place. All data for children is collected from the School.

3. Secure Data Integration and Special Category Data

BoomApps may utilize authorized third-party data synchronization services to securely facilitate the transfer and integration of student and teacher data from the School’s Management Information System (MIS).

• A. Role of Secure Intermediaries: Authorized third-party "connectors" act as separate, authorized Data Processors on behalf of the School. They serve as a secure intermediary portal between the School’s MIS and our Product.
• B. School Control and Approval: As the Data Controller, the School retains full control over the data shared through these services. The School has the authority to review, revoke, and limit the specific data sets shared with BoomApps at a granular level.
• C. Special Category Data: This section applies only if a school utilizes the BoomReader Data Dashboard. Special Category Data (such as pupil premium status, ethnic origin, or SEND status) requires a higher level of protection under UK GDPR.
  • Data Controller Oversight: If a school utilizes the Data Dashboard via a secure sync service, they can request that certain data fields remain non-mandatory and are not presented to BoomApps for collection.
  • BoomApps Processing: BoomApps will only process such data strictly for educational data analysis via the Data Dashboard function. This data is never used for profiling, advertising, or marketing.

4. The Data We Collect and Our Legal Basis

We only collect and process personal data that is strictly necessary for the Service to function as intended and to improve user experience.

A. Data Provided by the School (Teachers and Pupils)

We adhere to the principle of Data Minimisation, collecting the least amount of personal data required for the Product to function (e.g., name, class, school).

Data Category	Data Elements Collected	Purpose of Processing	Legal Basis (Processor's View)
Pupil Personal Data (Required)	Pupils' names, class, year groups.	To provide the core reading Service functionality, assign books, and track reading logs.	Contractual Obligation with the School
Special Category Data (Contingent)	E.g., SEND Status, Ethnicity (If approved by the School via Wonde).	To allow the Data Dashboard product to provide accurate educational functionality, monitoring, and reporting based on the needs of the child.	Contractual Obligation with the School

B. Data Collected Automatically (for all users)

Data Category	Data Elements Collected	Purpose of Processing	Legal Basis (Processor's View)
Technical Data	Website only - Google analytics data, Wix analytics data: User’s IP address, device type, browser-type and version.	User insights, system administration, security, and debugging.	Contractual Obligation / Legitimate Interest (Security)
Location Data	Website only - Broad geographic location (e.g., country or city-level location) derived from IP address.	To ensure security, comply with international data transfer laws, and for anonymous statistical reporting.	Contractual Obligation / Legitimate Interest (Security)

C. User Generated Data (Content Data)

• Product Reward Systems: The reward systems, such as Gems, simply reward the amount and frequency of reading logs. They can then be used within the platform to customize avatars or other non-data-related features. These systems do not improperly influence children to compromise their privacy or weaken security settings.

5. Children’s Privacy and Data Protection

The privacy of children is our primary concern. We adhere to the spirit of the ICO Age Appropriate Design Code:

• Age Gating: Children cannot create an account directly. Their accounts are created and managed by the School (the Data Controller).
• Default Settings: We adhere to high privacy settings for all children's accounts by default.
• Data Minimisation: We only collect the minimum personal data required to provide the core elements of the Service.
• No Direct Marketing: We do not use the personal data of pupils for marketing purposes.
• Detrimental Use: We commit not to use a child’s personal data in ways that are shown to be detrimental to their well-being.

6. Managing Student Data and Parental Access

A. Parental Access and Monitoring

• No Live Monitoring: There is no live parental monitoring of the child's in-app activity.
• Parent App: Parents have a separate app which allows them to log reading for their child. They are also able to see reading comments made by staff at the school and by their children, based on the data shared by the School.

B. Subject Access Requests (SARs) and Data Access

Any formal request from a parent, including a Subject Access Request (SAR), must be submitted directly to the child's School.

• School Authorization is Required: The School is the only entity with the authority to verify the requester's identity and legally authorise the release of the child’s data.
• Our Role: We cannot action data access requests from parents or guardians directly.

C. Data Anonymisation and Irretrievability

• Anonymisation: Upon deletion of a student account or termination of the School's subscription, all associated user-generated work is anonymised after 90 days.
• Irretrievability: Once the data is anonymised, it ceases to be personal data. This anonymised information cannot be re-identified, retrieved, or provided to the parent, the child, or the School.

7. Cookies and Tracking Technologies

The BoomReader & BoomWriter websites use cookies.

• Facebook Pixels/Targeting: This Website uses analytical cookies, pixels and other technologies by Facebook, Inc.. We do not link Facebook technologies to children’s accounts and do not use them to target children. We only use these services to advertise the Product to adult users (staff and parents) on the general website.
• Google Analytics: We collect visitor behaviour information in an anonymous form. We will never... use the statistical analytics tool to track or to collect any Personally Identifiable Information (PII) of visitors to our site.

8. International Data Transfers

We shall not transfer data outside of the European Economic Area ("EEA") unless we first ensure any such transfer is in compliance with Applicable Data Protection Law.

9. Contact Information and Complaints

A. Online Tools and Support

To support the AADC standard on Online Tools, an in-app 'Help' button is available to all users (staff, students, and parents) to contact our support desk directly.

If a child has concerns about their data, they should contact the School in the first instance.

B. Data Protection Contact

• Data Protection Contact: the Data Team
• Email: data@boomhub.app
• If you have a concern about the way in which we are collecting or using your personal data, you should raise your concern with your school in the first instance.