BoomApps privacy policy

This policy covers the BoomReader and BoomWriter apps. For this website, see our website privacy policy. All our key documents are on the key documents page.

BoomApps, which includes the BoomReader and BoomWriter platforms, is committed to protecting the privacy and security of the personal data we process. The Service is provided by Squirrel Learning Limited. This policy is designed to protect all users under the age of 18, in line with the UK Data Protection Act 2018, the UK GDPR, and the ICO Age Appropriate Design Code (AADC).

1. Introduction and Definitions

School

The educational institution that purchases a subscription and provides data.

Data Controller

The School is the Data Controller.

Data Processor

BoomApps is the Data Processor.

Child

Identified as under 13 years of age for GDPR purposes.

2. Our Role and Secure Data Synchronization

The School is the Data Controller, and BoomApps acts as the Data Processor. We rely on the School to ensure they have the necessary legal basis and privacy policies in place.

To facilitate the secure transfer and synchronization of student data from the School’s Management Information System (MIS), we may use authorized third-party secure intermediaries. These connectors act as secure portals between the School and our Product, but the School retains full control to review, revoke, and limit the data shared with us.

3. Data Collection and Usage

We adhere to the principle of Data Minimisation, collecting only the least amount of personal data required for the Service to function.

• Staff Data: We collect staff names, job roles, and email addresses to manage accounts and facilitate school administration.
• Parent Data: We collect parent names and email addresses solely for the purpose of account creation and administration.
• Student Data: Names, class, and year groups are used to track reading logs and book reviews.
• Special Category Data: Data such as SEND status or ethnicity is only processed if the School specifically approves it via the Data Dashboard for educational monitoring. Please note that specific fields can be omitted from syncing upon request by liaising with our third-party MIS integration provider.
• Technical Data: Website-only analytics (IP address, device type) are used for security and debugging.
• Location Data: We gather broad geographic location (country/city) from the website only; we do not collect the geographical location of children.
• No Marketing: We do not use the personal data of pupils for marketing or advertising purposes.

4. Children’s Privacy and Default Settings

The privacy of children is our primary concern.

• Age Gating: Children cannot create an account directly; they are managed by the School.
• High Privacy Defaults: We adhere to high privacy settings for all children’s accounts by default.
• Nudge Techniques: Reward systems (like “Gems”) are limited to non-data features (e.g., customizing avatars) and do not influence children to compromise their privacy.

5. Data Storage and Security

• Physical Storage: All user data is stored on secure servers located within the European Union (EU). Our data is hosted by Heroku on AWS servers across Dublin (Ireland), London (England) and Frankfurt (Germany).
• Encryption: We utilize AES-256 encryption at rest.
• Access Controls: Access is restricted to specific internal teams via role-based access control and Multi-Factor Authentication (MFA).

6. Retention and Deletion

• 90-Day Anonymisation: If a student is removed from a school or a subscription ends, we wipe the name and personal details after 90 days.
• Irretrievability: Once data is anonymised, it ceases to be personal data and cannot be re-identified or retrieved by the parent, child, or School.

7. Security Incidents and Data Breaches

• Reporting: If you suspect a data breach, contact the BoomApps Data Protection Contact at data@boomhub.app immediately.
• Notification: Upon becoming aware of a Security Incident, we will inform the School without undue delay and provide necessary cooperation to fulfill reporting obligations.
• Liaison: Our Data Officer will coordinate with the development team, the school, the parent, and the ICO as appropriate.

8. Access Requests and Rights

As the School is the Data Controller, any Subject Access Request (SAR) or request to delete data must be submitted directly to the child's School. The School is the only entity with the authority to verify identity and authorize the release or immediate deletion of data.

9. Cookies and Third-Party Tracking

The BoomReader and BoomWriter websites use cookies.

• Google Analytics: Used in anonymous form to analyze website activity; we never use it to collect Personally Identifiable Information (PII).
• Facebook Pixels: Used only to advertise to adult users (staff/parents) on general domains. We do not link Facebook technologies to children’s accounts.

10. Contact Information

If you have a concern about the way we use your data, please raise it with your school in the first instance, or contact the Information Commissioner’s Office (ICO).