What is GDPR?
The UK General Data Protection Regulation (UK GDPR), together with the Data Protection Act 2018, governs how organisations collect, use, store and share personal data in the United Kingdom. The UK GDPR was introduced following the UK’s departure from the European Union and largely mirrors the EU GDPR whilst applying specifically to the UK. It sets out individuals’ rights over their personal data and the obligations of organisations that process it. Further information is available from the Information Commissioner’s Office at ico.org.uk.
The Data Protection Act 2018 supplements the UK GDPR and together they form the primary data protection framework in the UK. The Information Commissioner’s Office (ICO) is the independent regulator responsible for upholding data rights and can be contacted at ico.org.uk.
Data Controllers and Data Processors
When a school enrols a cohort on a Flosendo programme, the school gives Flosendo the pupil data needed to set up the pupils’ accounts. In this scenario the school is the Data Controller – it determines what data is shared and is responsible for informing pupils and parents about how their data is used. Flosendo acts as Data Processor and processes that data only on the school’s instructions and for the purpose of delivering the programme.
How we comply with GDPR
- Cloud Hosted
- We are hosted in the cloud, on Amazon Web Services servers in London, in the United Kingdom.
- Data Stored in the UK
- Personal data in Eden is stored on those servers. When a pupil plays a video in Eden, YouTube (Google, in the United States) receives the device’s IP address and what is watched.
- Trusted Third Parties – We share personal data with the following trusted third parties where necessary to deliver our services: Amazon Web Services, our cloud hosting provider (data storage in London, United Kingdom); Google (YouTube), which plays the videos in Eden; and Microsoft (Microsoft 365), which holds email sent to us. We do not sell personal data or share it with any advertising networks or data brokers.
- Bank Level Encryption
- We encrypt all personal data in transit and at rest using industry-standard encryption protocols. Access to personal data is restricted to authorised personnel only.
- Secure logins – Every user has secure logins with automatic logouts after periods of inactivity.
- Easily retrievable data – A pupil can download a copy of their data from their profile page in Eden.
- Permanent deletion of data – All users can make subject access and/or right to be forgotten requests by contacting enquiries@flosendo.com
- Data minimisation – We collect only the personal data necessary for programme delivery. Where data is used for internal reporting, it is aggregated and anonymised so that individual pupils cannot be identified.