Privacy Notice as at 11-10-2021.
Update to International transfer section following the EU Adequacy Decision on data transfers between the UK and EU. Information on this decision can be found on the ICO website.
Satchel (‘Satchel’, ‘we’, ‘us’) takes the protection of privacy very seriously. This notice describes how we collect, use, and handle your personal data. It also describes your data protection rights, including a right to object to some of the processing which Satchel carries out. More information about your rights, and how to exercise them, is set out in the ‘Your rights?’ section below.
This notice applies to the information Satchel collect from teachers and students when they use our Satchel Pulse tool. It also covers personal information collected on www.satchelpulse.com.
Your school will be the data controller for the personal data which is hosted in Satchel Pulse. For more information on how this personal data is processed, please speak to your school or refer to their privacy notice.
We are Satchel, our flagship product, Show My Homework, was launched in 2011 by former assistant head teacher, Naimish Gohil, who had a vision to transform the way homework and technology was approached in schools. Our software is now used in over 1 in 3 secondary schools in the UK and in 23 countries across the world, making a difference to the lives of millions of students and parents.
The website www.satchelpulse.com, and Satchel apps in the UK are run by Satchel.
We collect and process the following information:
Sometimes, we receive information about you from third parties. This includes information from your school, but also in the case of teachers or other school staff, information from publicly available sources such as LinkedIn and in some cases obtaining information (such as email contact lists) from data suppliers.
We process this data for the following purposes:
In our capacity as a Data Processor for a Data Controller, in particular:
Where we act as a Data Processor, we act on the lawful basis provided to us by each Data Controller. This information should be available on your Data Controller’s Privacy Notice. In the majority of cases the lawful basis is typically Public Task.
To fulfil a contract, or take steps linked to a contract including:
As required by Satchel to conduct our business and pursue our legitimate interests, in particular:
Where you give us consent:
For purposes which are required by law:
|Hubspot / based in the United States||Marketing automation / company updates / product information|
|Send In Blue / based in France||Marketing automation / company updates / product information|
|Amazon Web Services (AWS) / based in Ireland||Product Database (including personal data from school MIS)|
|Salesforce / based in Ireland||Key school contact database / support ticketing system (including user contact information) / product information / marketing database|
|New Voice Media / England||Call recording software for training and quality purposes|
|Groupcall / England||Data sharing between Satchel and the school MIS|
|Intercom / United States||Customer engagement and support tool|
In connection with the purposes identified above, your personal information may be transferred outside the UK, including to the United States and the European Economic Area (‘EEA’). Where information is transferred outside the UK that is not subject to an adequacy decision by the EU Commission, information is adequately protected by EU Commission approved standard contractual clauses, or a vendor's Processor Binding Corporate Rules. For the latest information on EU adequacy decision please follow this link to the ICO website. For more information on the transfer mechanism used, please contact us at the details set out below. We are also aware of the CJEU ruling “Schrems II” and have reviewed our international transfers to ensure we no longer rely on EU-US Privacy shield as the basis for any of our International Transfer to the USA.
|Hubspot / based in the United States||Standard Contractual Clauses (SCC)|
|Intercom / based in the United States||Standard Contractual Clauses (SCC)|
|Send In Blue / based in France||Adequacy Decision|
|Amazon Web Services (AWS) / based in Ireland||Adequacy Decision|
|Salesforce / based in Ireland||Adequacy Decision|
For data which is hosted in Satchel Pulse: As noted above, Satchel is not a Data Controller for personal data hosted in Satchel Pulse. Therefore as a Data Processor, we delete this data on the instruction of your school.
Satchel will, pursuant to the school instructions, process and store personal data for students, parents, teachers and school staff members for the duration of the schools license with Satchel. If you leave the school during an active license with your school we will delete/anonymise your personal data within 28 days of your account being deleted by your school.
If you are a parent of children at two different schools which use Satchel, if one school requests that Satchel delete its data your details will still be held by Satchel for the second school.
For data which is listed in section 3 above:
For non-Satchel users (such as prospects and business contacts) we will process and store personal data while we are in contact with you with relevant information on our services. If we have not contacted you for a period of 2 years your data will then be removed from our system automatically.
If you have opted out to your data being processed we will delete your data within 28 days of your opt out being received. Sometimes business and legal requirements oblige us to retain certain information, for specific purposes, for an extended period of time. Reasons we might retain some information for longer periods of time include security, fraud prevention, financial record-keeping, complying with legal or regulatory requirements.
Where required by applicable law or regulation, you have the right to ask us for a copy of your personal information; to correct, delete or restrict (stop any active) processing of your personal information; and to obtain the personal information you provide to us for a contract or with your consent in a structured, machine readable format, and to ask us to share (port) this information to another controller.
In addition, you can object to the processing of your personal information in some circumstances (in particular, where we don’t have to process the information to meet a contractual or other legal requirement, or where we are using the information for direct marketing). These rights may be limited, for example if fulfilling your request would reveal personal information about another person, or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping. We will inform you of relevant exemptions we rely upon when responding to any request you make.
To exercise any of these rights - or get a copy of our legitimate interest balancing tests - you can get in touch with us using the details set out below. If you have unresolved concerns, you have the right to complain to an information protection authority where you live, work or where you believe a breach may have occurred.
For the provision of information marked as mandatory when you register to use Satchel Pulse, if such information is not provided, then you will not be able to use the service. All other provision of your information is optional. If you do not provide such information, our provision of certain services to you may be detracted from.
Our Data Protection Officer and data protection representatives can be contacted directly here:
By email: DPO@teamsatchel.com
By Mail: Data Protection Officer 2nd Floor, 154-158 Shoreditch High St, London E1 6HU, United Kingdom
In the event that you wish to make a complaint about how your personal data is being processed by Satchel, or how your complaint has been handled, you have the right to lodge a complaint directly with the supervisory authority.
Supervisory authority contact details
Contact Name: Information Commissioner’s Office (ICO)
Contact Details: https://ico.org.uk/concerns/