Privacy Notice for Teachers

Our Privacy Notice for Teachers

We’re working hard to make your privacy and rights are understandable. 
Explore each of the sections below to find out more.

This section provides privacy information in respect of the personal data in our control. It covers personal data of students, their parents or guardians, and non-student users of Upskill Me.

By non-student users of Upskill Me, we mean individuals acting in their capacity as representatives of their organisations. In particular, teachers using Upskill Me to support their students and employees of third party organisations that offer opportunities to our student users. 

We collect and process the following information about students:

  • name;
  • school email;
  • telephone number;
  • date of birth;
  • school (including whether it’s a state school);
  • year group;
  • gender (optional);
  • ethnicity (optional);
  • free school meal entitlement (optional);
  • user name and encrypted password;
  • record of achievements, GCSE & A-Level qualifications and results, GCSE/A-Level subjects studied, interests, skills, extra-curricular activities, certificates, awards, work experience photos;
  • achievement badges;
  • personal goals and progress;
  • details of usage of Upskill Me (e.g. time/duration and details of parts of the service accessed by the student);
  • event/job/course/career information the student attended or expressed interest in;
  • details of enquiries or other direct communication from/to a student; and
  • technical information (including the type of device used, a unique device identifier (for example, IP address, device’s IMEI number, or the mobile phone number used by the device), mobile network information, operating system and platform, the type of mobile browser used and time zone setting.

We collect and process the following information about parents/guardians of students:

  • name;
  • email address; and
  • details of parental consent provided.

We collect and process the following information about non-student users:

  • name;
  • professional role;
  • professional email;
  • name of organisation;
  • in case of teachers, school group information (year group and tutor group);
  • encrypted password;
  • details of usage of Upskill Me;
  • details of enquiries or other direct communication from/to the user; and
  • technical information (including the type of device used, a unique device identifier (for example, IP address, device’s IMEI number, or the mobile phone number used by the device), mobile network information, operating system and platform, the type of mobile browser used and time zone setting.

We may also collect, use, and share anonymised, aggregated data of any registered users, such as statistical or demographic data, for any purpose. Anonymised data may be derived from personal data but is not considered personal information under the Data Protection Legislation because such information does not directly or indirectly reveal a person’s identity. For example, we may aggregate information on how students use Upskill Me to calculate the percentage of users accessing a specific feature of the service, or share statistical information about students from selected schools with the multi-academy trust or charity that runs the school to help them understand how their schools are performing. 

We collect most personal data directly from user (for example, when they complete our sign up form or input any other data onto our platform).

We may also collect personal information from the school attended by the student (for example, email addresses of students to whom the school wishes us to make Upskill Me available, or details of parental consents concerning Upskill Me).

We may obtain certain personal data from third parties that offer opportunities to students via Upskill me (for example, career events attended by a student).

We also collect certain technical information about users through our use of automated technologies such as cookies, server logs and other similar technologies. For further information, please see our Cookies Notice.  

Under the Data Protection Legislation, we can only use personal data if we have a lawful basis to do so under Article 6 of the General Data Protection Regulation. These include: consent, contract, legitimate interests or legal obligation.

Consent. We may process personal data based on consent to:

  • place cookies and similar tracking technologies on the user’s device (please see our Cookies Notice for further details);
  • send our marketing communication to them (e.g. information about in-service e-Learning content which may be of interest to the student, information about our services to professional users; our newsletters to parents and non-student users);
  • send third party marketing communication to them (e.g. information for students about job, career, work experience or learning opportunities);
  • send targeted marketing communication from us or third parties to students (see section 5.12, Profiling of this statement for further information);
  • make the public employment profiles of students aged 16+ visible to employers; and
  • collect and use ethnicity, gender and free school meal entitlement information about students for the purpose of targeted marketing (see section 5.12, Profiling of this statement for further information).

Data revealing ethnic origin is classed under the Data Protection Legislation as a ‘special category of personal data’. Such data can be lawfully processed only if one of the conditions in Article 9 of the GDPR is met. The condition we rely on is explicit consent.

Where we want to use personal data on the basis of consent, we will ask for such consent clearly and separately from the body of our terms and conditions or privacy policies. Where consent is required to process the personal data of students under 13 years of age, we will seek such consent from their parent or guardian.

Users (or, where appropriate, their parent/guardian) have the right to withdraw their consent at any time by:

  • using the privacy settings within Upskill Me; 
  • emailing us at: info@upskillme.io; or
  • in case of our marketing emails, by using the ‘unsubscribe link’ in the email.

Contract. We will use personal data of users (students and non-students) where it is necessary for the performance of our obligations under our Terms of Use for Students or other contractual documents. For example, if we need to:

  • register an individual as a new user or administer their account; and
  • provide our services to users.

Legitimate interests. We may process users’ personal data when we (or a third party) have a legitimate reason to use it, so long as this is not overridden by that user’s rights and interests. For example:

  • to enable teachers nominated by their school to monitor the student’s progress and provide them with information that may assist the teachers in supporting the development of and the provision of career advice to the student;
  • to provide our services and manage our relationship with the organisation represented by the non-student user of Upskill Me;
  • to administer and protect our platform, website and business (including troubleshooting, data analysis, system maintenance, support, reporting and hosting of data);
  • to ask users to leave a review or complete a survey;
  • to create anonymous aggregated data derived from the users’ personal data and use it to promote and increase our business;
  • to conduct web analytics (via Google Analytics);
  • for the prevention and detection of fraud and spam; and
  • for the establishment, exercise or defence of legal claims.

Legal obligation. We may process personal data of users and parents/guardians of student users to comply with our legal obligations. For example:

  • we may use information about students’ ages to put age appropriate safeguards in place and offer age appropriate features to those students;
  • where we rely on ‘consent’ as the lawful basis to process personal data of students under the age of 13, we will use the personal data of their parents or guardians to obtain such consent;
  • to notify users about changes to this Data Protection Statement, our Privacy Notice for Students, our Terms of Use for Students, or other terms, rules or policies that affect them;
  • to address a data protection request or complaint; or
  • to comply with a request of a competent authority. 

We may share personal data with third parties for the purposes set out in this statement.

Teachers. Teachers nominated by schools will be able to invite their students to join Upskill Me and see some of their personal data within Upskill Me. This includes the names and year group of the students who joined Upskill Me and the date of their last activity. The nominated teacher may also view their students’ interests, skills, qualifications and subjects studied, and application details when their student applies for opportunities. Students will be able to view the name and contact details of their teachers.

Teachers and employers. Where a student in Years 12 - 13 chooses to share their public profile on Upskill Me, that profile will be visible to teachers, employers, universities and other third party organisations offering opportunities to students via Upskill Me.

Employers. Where a student applies through Upskill Me for an employment, work experience or other opportunity advertised by an employer or other third party, their application details will be shared with that party. 

Parents. We make personal data of students under the age of 13 available to their parents/guardians.

Suppliers. We share data with providers of cloud-based tools and services, which we use to operate Upskill Me, our website and our business. For example:

  • Amazon Web Services (AWS), based in the USA, who provides web hosting services to us. AWS host our data in the United Kingdom. We also use AWS to manage our website and database;
  • Google, based in the USA, who provide Google Analytics web analytics services to us through the use of cookies. The data collected by cookies does not directly identify any student. It includes information on the pages visited, duration of stay, device used, etc.;
  • SendGrid, Inc., based in the USA, who help our users to login and verify their email addresses; and
  • Revue Holding B.V., based in The Netherlands. We use their Revue tool to send newsletters and notification emails to our users.

We impose contractual obligations on the above providers to ensure that your personal data is protected. Those of our providers that are based in the USA subscribe to the EU-US Privacy Shield framework. Transfers of personal data to US companies who subscribe to the EU-US Privacy Shield framework are deemed by the European Commission and the UK Information Commissioner Office to provide an appropriate level of protection.

Other sharing. We may also:

  • share personal data with members of our staff;
  • disclose personal data to professional advisers (e.g. lawyers, accountants, auditors or insurers) who provide professional services to us;
  • disclose and exchange certain information with law enforcement agencies and regulatory bodies to comply with our legal obligations; and
  • share some personal data with other parties, such as potential and actual investors or buyers of some or all of our business or during a re-structuring. 

Such data recipients will be bound by confidentiality obligations. 

We will only retain personal data for as long as reasonably necessary to fulfil the purposes it was collected for. For example, we will usually keep personal data of students for six years from the last time they logged in to Upskill Me. We will do that in order to make it easily accessible by the students. 

We may retain an individual’s personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with that individual (or their parent/guardian).

We may also anonymise personal data (so that it can no longer be associated with any specific student) for analytics, research or statistical purposes, in which case we may use this information indefinitely without further notice. 

We have appropriate security measures to prevent personal data from being accidentally lost, or used or accessed unlawfully. We limit access to personal data of individuals to those who have a genuine business need to access it. Those processing personal data will do so only in an authorised manner and are subject to a duty of confidentiality. We also have procedures in place to deal with any suspected data security breach. 

Students, their parents/guardians, and non-student users of Upskill Me have a number of rights in relation to their personal data, which allow them to access and control their information in certain circumstances. They can exercise these rights free of charge, unless their request is manifestly unfounded or excessive (in which case we may charge a reasonable administrative fee or refuse to respond to such request).

If you would like to exercise any of these rights, please contact us by email at info@upskillme.io. Please let us know what right you want to exercise and the information to which your request relates. 

Access

The right to receive a copy of the personal data we hold about the individual and to check that we are lawfully processing it. 

Rectification

The right to require us to correct any inaccuracies in personal data. 

Erasure (to be forgotten)

The right to require us to delete personal data in certain situations. 

Restriction of processing

The right to require us to restrict processing of personal data in certain circumstances (e.g. if the individual contests the accuracy of the data we hold). 

Data portability

The right to receive, in certain situations, the personal data provided to us by the individual, in a structured, commonly used and machine-readable format and/or transmit that data to a third party. 

To object

The right to object at any time to the personal data of an individual being processed for direct marketing (including profiling) or, in certain other situations, to our continued processing of your personal data (e.g. processing carried out for the purpose of our legitimate interests). 

Not to be subject to automated individual decision-making

The right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you, or similarly significantly affects you. 

Complaints

If we process your personal data (or the personal data of your child), we hope that we can resolve any query or concern you may raise about our use of that information. You may contact us by using any of the contact methods set out in section 1 (About us and our service, How to contact us) of this statement.

The Data Protection Legislation also gives you a right to lodge a complaint with a supervisory authority. The supervisory authority in the UK is the Information Commissioner’s Office, who may be contacted at https://ico.org.uk/concerns, telephone on 0303 123 1113, or by post to: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. 

We would, however, appreciate the chance to deal with your concerns before you approach the Information Commissioner’s Office, so please contact us in the first instance.