Global Privacy Notice

 

As a leading provider of integrated education systems, the privacy and security of individuals about whom we process personal data is critical to us. This Global Privacy Notice (“notice”) explains how we manage and protect your personal data (referred to as “data”) when you visit our website (“Visitor”) or use our learning platform services either as a representative of a School to which we provide services (“School User”) or a User which uses our services (a “Service User”). If you are a Service User, for the majority of personal data we process about you, we are a processor and therefore act on behalf of you or your school and as directed by them. If you are associated with a School we recommend that you review your school’s privacy notice to understand how your school manages your personal data.

This notice tells you who we are, what data about you we collect in connection with our website and services, and what we do with it.

To learn more about our approach to privacy law compliance and data security more broadly, please visit our GDPR page here.

Who are we?

ManageBac LLC (“ManageBac”, “we, “us”) is part of Faria Education Group. ManageBac is a Curriculum First Learning Platform for the world’s leading international schools. Founded in 2006, we serve over 700,000 students and 2,600 schools in 120 countries providing integrated systems to enhance efficiency in schools. We are responsible for managing your data in connection with our services.

Details of how to contact us can be found below at Who should you contact with questions?

What data about you do we collect?

We use various types of data about you for purposes connected with the management of our website or the delivery of our learning platform services.

Visitor

We may collect and process the following information about you in order to:

• provide you with our website or services
  We will collect and process the information you provide to us if you register for a demonstration, trial account, blog or webinar, which includes your name, email address, phone number, school name, information regarding the curriculums your school offers and other information collected to provide the website or services. We will also process your name and email address to send you email messages about our newsletters, product updates and other marketing materials. We will only send you such email messages as permitted under applicable law and in line with your marketing preferences which you can update at any time as described below.
• We will collect information through cookies, including analytics information about your use of our website and information about your device, internet connection, browser, location, page and search terms used, etc. Learn more about how we use cookies and similar technologies in our cookies policy
• Process a job application which you submit to us. We will collect and process any personal data you provide in your CV / resume and cover letter.

School User

We may collect and process the following information in order to provide your school with our learning platform services:

• your name, title, business telephone number, details about the school you represent, details about your position at the school (e.g., subjects you teach or how long you have worked at the school) and e-mail address used during our registration process in order to communicate with you in relation to the provision of learning platform services to your school.
• responses to our surveys you choose to take.
• your email address to send email marketing to you, including our newsletters and updates as permitted under applicable law and in line with your preferences.
• details of your interactions with us when you contact us with enquiries through our online customer support, or via telephone or email.

Service User

We may collect and process the following information:

• information captured in your student account, provided by you or your parents including information such as your name, email address, nationality, date and place of birth, gender, language, national ID, and parents’ names and contact details, in order to conduct statistical analyses for our own reporting.
• email address in order to request survey responses or feedback from you in relation to future product developments and educational plans.
• feedback and responses to our surveys you choose to take.
• details of your interactions with us when you contact us with enquiries through our customer support system online, or via telephone or email.

For what purposes do we use data about you, and on what legal basis?

Throughout your use of our website and/or our provision of services to you or a school, we use data about you for various purposes.

The purposes for which we use data about you, with corresponding legal basis for use, are set out below:

Visitors

Purpose	Legal basis for processing
Management of our website e.g. site maintenance and analytics of website usage (which will include the sharing of data with Google Analytics).	It is our legitimate business interest to manage and develop our website.
Fulfilment of online services e.g. registering for a demonstration, webinar, blog or trial account.	We process your data in order to provide you with the online service which you have requested. Our processing is based on your consent.
Marketing e.g. to send you marketing emails relating to product updates and other services we think you may be interested in	We either rely on your consent or our legitimate business interest to send email marketing to you depending on how we collected your personal data and the nature of our relationship. Any email marketing will only be sent to you as permitted by applicable law and in accordance with your preferences which you can update at any time as described below.
Legal & regulatory compliance and compliance with law enforcement requests	In some instances, we will be required by law to process your personal data and share it with law enforcement or other government or regulatory bodies. We may also choose to do so in other circumstances, in accordance with our legitimate interests.
Processing a job application e.g. if you apply for a job or position via our website	If you decide to apply for a job with us, we will process your personal data on the basis of our legitimate interests in order to ascertain your suitability for the job.

 

School Users

Purpose	Legal basis for processing
Customer support activities e.g. interacting with you via our online customer support or by phone, e-mail	It is our legitimate business interest to provide customer support to School Users in order to provide the learning platform services to schools.
Provision and management of learning platform services to school e.g. managing requests, curriculum standards, managing user accounts, submitting a PO, handling invoices, etc.	It is our legitimate business interest to provide and manage the learning platform services we provide to schools.
Marketing e.g. to send you marketing emails relating to product updates other services we think you may be interested in	We either rely on your consent or our legitimate business interest to send email marketing to you depending on how we collected your personal data and the nature of our relationship. Any email marketing will only be sent to you as permitted by applicable law and in accordance with your preferences which you can update at any time as described below.
Sharing data with other third parties Please see “Who do we share data with and for what purpose?” below.	It is our legitimate business interest to share data with third parties to assist with the purposes described below.
Legal and regulatory compliance and compliance with law enforcement requests	In some instances, we will be required by law to process your personal data and share it with law enforcement or other government or regulatory bodies. We may also choose to do so in other circumstances, in accordance with our legitimate interests.

 

Service Users

Purpose	Legal basis for processing
Conducting statistical analyses for reporting e.g. to conduct data analyses that enables us to improve and develop our services	It is our legitimate business interest to improve our learning platform services through the use of statistical analyses and reporting.
Customer support activities e.g. interacting with you via our online customer support or by phone or e-mail	It is our legitimate business interest to provide customer support to Service Users.
Feedback and surveys e.g. to request survey responses or feedback from you in relation to future product developments and educational plans	It is our legitimate business interest to gather feedback and survey results to improve user experience and develop improved services. We store this data in anonymised form.
Sharing data with other third parties Please see “Who do we share data with and for what purpose?” below.	It is our legitimate business interest to share data with third parties to assist with the purposes described above
Legal & regulatory compliance and compliance with law enforcement requests	In some instances, we will be required by law to process your personal data and share it with law enforcement or other government or regulatory bodies. We may also choose to do so in other circumstances, in accordance with our legitimate interests.

Please note that we do not process any special category data about you (e.g., information of race or ethnicity) for our own purposes. You may be requested to provide such information by your school which may be passed to us for processing but we do not use it for any other purpose.

In some instances, we may use personal data about you in ways that are not described above. Where this is the case, we will provide a supplemental privacy notice that explains such us and consent if required. You should read any supplemental notice in conjunction with this notice.

Who do we share your data with, and for what purposes?

We share data across our Group for various purposes such as:

• Customer support activities (e.g. our online support or contacting us via our e-mail or telephone) may be undertaken by our offices in China, Taiwan, UK, Canada or the US depending on your school’s location and the time of the day of your inquiry. Schools in India will be supported primarily by our representatives in India, or in other offices outside of China, depending on the time of inquiry.
• Billing inquiries (e.g. submitting a PO, handling invoices, etc.) will be processed by our offices in the United Kingdom, Hong Kong and Taiwan. Schools in India will be supported in India, or by other teams outside of China.
• System usage and platform hosting is provided from our offices in Canada (unless you are based in China or the USA in which case it will be done in the country in which you are based).

Sharing data with third parties

• If you are a Service User, we will share data with education partners as instructed to do so by your school such as exam awarding bodies for exam registration, moderation and coursework submission or integration partners, such as other school systems providers, as instructed by your school.
• We may share data about you with our third-party service providers, such as IT providers or customer support services. A list of our Subprocessors can be found here
• We may share anonymised data, feedback and survey results with third-party service providers, such as other school systems for research purposes.
• We may share data about you with other third parties, where required or permitted by law, for example: regulatory authorities; government departments; in response to a request from law enforcement authorities or other government officials;
• We may share data when we consider disclosure to be necessary or appropriate to prevent physical harm or financial loss or in connection with an investigation of suspected or actual illegal purpose; and
• We may share data in the context of organisational restructuring

If you would like to learn more about the parties with which we share data, please contact us using the details below at Who should you contact with questions.

Where might your data be processed?

As with any multinational organisation, and as a result of the global nature of our services, we are often required to transfer data internationally as described above. Accordingly, data about you may be transferred both within our Group and to third parties internationally.

These countries may not have the equivalent data protection standards to the country in which you provided your data. We will ensure that we implement appropriate data transfer mechanisms to protect your personal data. If data is transferred outside the EU, we will only transfer such data on the basis of a European Commission adequacy decision, Binding Corporate Rules or, the EU Model Clauses (Standard Contractual Clauses).

If you would like to receive a copy of the information relating to the safeguards we put in place, please contact us using the details below at Who should you contact with questions?

How do we protect your data?

Faria Education Group is certified to the ISO27001:2013 standard and implements appropriate technical and organisational measures to protect personal data that we hold from unauthorised disclosure, use, alteration or destruction. Our standard protocols include:

Application security: traffic encryption, strongly hashed passwords, safeguards against vulnerabilities such as cross site scripting, SQL injections, phishing and others.

Network security: firewalls and systems to detect suspicious behaviour, stop malicious attempts to gain access, or compromise the resilience of the service (e.g. DDOS attacks).

Organisational security: access policies, audit logs and confidentiality agreements.

Physical security: preventing unauthorized access to infrastructure processing personal data.

Procedural security: IT management processes to minimize the risk of human errors, or testing regimes to identify software weaknesses before releasing new features to our cloud services, or policies to ensure data is only processed on instruction from our customers.

How long will data about you be kept?

The period for which we may retain data about you will depend on the purposes for which the data was collected, whether you have requested the deletion of the data, and whether any legal obligations require the retention of the data (for example, for regulatory compliance).

We will not retain data about you for longer than is necessary to fulfil the purposes for which the data was collected.

What rights do you have over your data?

Depending on where you are resident, you may have some or all of the following rights under applicable law in respect of data about you which we hold:

• request us to give you access to it, and have us provide you with a copy of any data we hold about you
• request us to rectify or update it
• request us to erase it in certain circumstances
• request us to restrict our using it, under certain circumstances
• object to our using it, in certain circumstances
• withdraw your consent to our using it, where our processing is based on consent
• data portability, in certain circumstances
• opt out from using it for email marketing. You may opt out by clicking on the unsubscribe link in the email marketing messages we send you or by contacting us as set out below and we will always comply with this request; and
• lodge a complaint with the supervisory authority in your country (if there is one).

You can exercise these rights, or learn more about them, by contacting us using the details below at Who should you contact with questions?

We may be required to confirm your identity before we action any request from you in connection with your data. This may involve asking you to provide identification documents.

Who should you contact with questions?

If you have any questions, or wish to exercise any of your rights, then you can contact our Data Protection Officer at dpo@managebac.com.

If your country has a supervisory authority, you have a right to contact it with any questions or concerns. If we cannot resolve your questions or concerns, you also have the right to seek judicial remedy before a national court.

Changes to this notice

We may update this notice (and any supplemental privacy notice), from time to time as shown below. We will notify you of the changes where required by applicable law to do so.

Last modified on 23rd March, 2021