Supporting Wellbeing in Schools and Multi-Academy Trusts

Privacy Policy

This policy is designed to provide details about the privacy policy for the use of evotivate and the data we collect and hold.

It contains information about what details we store, why and how and what to do if you have any further queries or concerns on security.

What user data do we use?

The evotivate system is designed and built for gathering information from users on their wellbeing and other surveyed information. We store a minimum amount of user data to create the personalised accounts for your users to enable us to track and report on them appropriately.

Though it is possible to create users with untraceable user details then this will significantly impact on the usefulness of the reporting engine and tracking.

User data

We store the following data for each user (note not all fields are mandatory):

  • First name
  • Last name
  • Email address
  • Site/Location based (optional)
  • Department (optional)
  • Phase of teaching (optional)
  • Gender (optional)
  • Age (optional)

Though many fields are optional, the more information you provide the more granular the reporting insights can be such as across multi-sites or departments.

Within the system we also create a profile of a user’s activity including their ‘mood’ setting and other usage to help us understand user preferences to guide future software development.

Cookies

Cookies are used to persist user sessions whilst logged in. Cookies are also used to pass system notifications between sections of the site. Neither session cookies or notification cookies contain any personal data about the user.

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of our website may become inaccessible or not function properly.

Why do we need any user data?

User accounts

User data is used to create user accounts to enable tracking of individual’s responses.

Marketing and product updates

We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising.We may use details of the main school administrator/purchasing contact to contact you regarding product changes, updates and new related content/products.

How is initial user data received?

Following the creation of the school administrator account they will have full control to create additional accounts and to modify/remove user accounts manually or via the ‘upload .csv’ option using the template provided.

Accounts can be permanently deleted by this administrator account allowing the organisation to fully control your own data in line with any Data Protection Regulations in force.

The user’s interactions with the system will generate additional data about them, notably any survey responses and/or wellbeing status updates. In this act evotivate are the data processor and the organisation remain the data controller.

Security

The evotivate system is hosted on maintained servers behind tiered security systems to ensure maximum protection for user data. All servers are based in the UK.

Users are assigned individual passwords with tiered access and permissions that protect access to the system and ensure that only registered users can access data. Individuals have the responsibility to safeguard the security of their password and have the ability to reset from within the mobile application. Additionally, administrators can reset passwords and accounts on behalf of users as required.

Who has access to data?

All users have a unique username and password allowing them access to the evotivate system. Users are responsible for this password and maintaining the security of their account. A user is able to view their own data regarding usage and performance in all aspects.

A nominated administrator will have full access to the user data (excluding passwords) and reporting insights. This administrator will have the ability to create and modify/remove users should a request under data protection be made to amend or erase data about a user.

No data is passed to 3rd party companies.

Usage data and research

D-Hub are able to access high level usage statistics and analyse data to identify trends and patterns of usage to aid in our product roadmap and systems support processes. We will use this data internally to help us continue to develop the system to meet the needs of our customers and to help inform policy changes where appropriate.

Some findings may be published to help showcase emerging patterns that may be beneficial to other users. Data will only be published about overall usage and no details of specific customers or users will be released without prior permission.

Data retention

We will only retain personal data relating to Users for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

In some circumstances you can ask us to delete your data – see legal rights below.

In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

Data protection legislation

D-Hub, the producers of evotivate, is registered with the Information Commissioner’s Office (ICO) to store data under registration entry ZA391996.

Under certain circumstances, data subjects have rights under data protection laws in relation to their personal data.

Each user has the right to:

Request access to personal data held about them (commonly known as a "data subject access request"). This enables the data subject to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

Object to processing of your personal data where we are relying on a legitimate interest and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.

Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data's accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

Request the transfer of personal data to you or to a third party. We will endeavour to provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you. So long as you can demonstrate that you have appropriate authorisation to enable us to transfer personal data to you, we will do so.

Withdraw consent at any time where we are relying on consent to process any categories of personal data. However, this will not affect the lawfulness of any processing carried out before consent is withdrawn.

Concerns...

We take our responsibility for safeguarding data very seriously and take all reasonable steps to maintain the tightest security. If you suspect a breach of this privacy policy at any stage, please report this immediately to [email protected]

Any questions?

If you have any queries regarding anything in this privacy policy and would like to discuss it further, please contact our support team:

D-Hub
Unit 4 Atlas Office Park
First Point
Doncaster
South Yorkshire
DN4 5JT