Privacy statement LessonUp B.V.

Updated: May 2023

LessonUp B.V. LessonUp takes the privacy of all its users (students and teachers) and visitors to its website (www.lessonup.com) and applications or mobile applications very seriously. In the processing of personal data, we comply with laws and regulations relating to the processing of personal data (including the General Data Protection Regulation, GDPR).

On this page you can read how LessonUp handles personal data and what rights you have.

LessonUp may change this Privacy Statement. The latest version of the Privacy Statement will always apply between LessonUp and the user and visitor – and is available through our website and applications.

Website

Personal data is processed by LessonUp when the website (www.lessonup.com) is visited. For this purpose, LessonUp is the controller within the meaning of the GDPR. Below, LessonUp explains what data LessonUp processes and for what purposes it does so.

We process the following personal data via our website:

Contact (form): If you contact us via the contact form on our website, we will process your name, email address and any other information and personal data that you share with us, including your comments (message, request, query or complaint). We do so to be able to take note of your comments, to contact you, and to update you on progress in handling your comments. We process this personal data based on our legitimate interests, namely, to contact you and to provide you with help regarding your comments.

Newsletters: If you subscribe to our newsletters, we will process your name and email address. We do so to inform you about developments within LessonUp and about our services. If you no longer want this, you can unsubscribe via a link in the relevant mailing. We process this personal data on the basis of your consent. If you are already one of our customers, we may send you newsletters – without prior consent – based on our legitimate interests, namely, to inform you of similar services that may be of interest to you.

Social media: If you want to contact us via our social media channels or if you leave a message on one of our social media pages, then we will process your name or username and any other personal data that you share with us, including your comments (message, request, query or complaint). We do so to be able to take note of your comments, to contact you, and to update you on progress in handling your comments. We process this personal data based on our legitimate interests, namely, to contact you and to provide you with help regarding your comments.

Please note that our social media channels are also controlled by the social media itself. Check their own privacy policy to see how the relevant social media handle your personal data:

Trial: If, as a teacher, you want to try LessonUp via the 30-day trial, we will process your name, email address and password. We do so to provide you with access or temporary access to our application(s) and to be able to contact you with information about our complete range of services. For more information on data that is processed in this case, please refer to APPLICATIONS.

Without having the data as meant above available, we cannot comply with your requests and/or grant you access to LessonUp.

In the context of our legitimate interests (to improve our website and in the context of compliance with laws and regulations), in response to complaints or reports (including notice-and-take-down requests) we process data about (alleged) infringements of intellectual property rights and/or other unlawful actions and, if necessary, personal data of users involved.

Applications

LessonUp offers several applications, namely the application ‘LessonUp’ and ‘Stap-voor-Stap’ (for students) and ‘Sidekick for LessonUp’ (for teachers).

Personal data is processed by LessonUp for the use of applications. To be able to inform you of the manner in which LessonUp processes personal data, we distinguish between the situation in which (1) LessonUp is a processor and (2) LessonUp is a controller.

LessonUp as a processor: In most cases, the LessonUp applications are used based on an agreement between either an individual teacher and LessonUp or a school and LessonUp. With regard to the student learning data and learning results, the school/teacher is the controller and LessonUp acts as a processor. This means that LessonUp only processes the personal data on order from and in line with the school/teacher's instructions.

LessonUp as controller: We process some data for our own purposes, such as account and payment information which we process to be able to offer you our services. In this situation, LessonUp is controller.

Below, we further explain the processing in our role as processor and controller.

LessonUp is processor

This situation occurs when an agreement has been concluded between schools and LessonUp or an individual teacher and LessonUp, on the basis of which students and teachers use the LessonUp applications.

Privacy Covenant

LessonUp endorses the provisions of the Covenant on Digital Teaching Resources and Privacy – (the Covenant) Teaching Resources and Testing by the Secondary Education Council and the Primary Education Council and has associated itself with this Covenant.

Data Processing Agreement

Schools that make use of LessonUp (applications) are controller within the meaning of the GDPR for the processing of personal data of their students. This means that the school has and maintains control, at all times, of the personal data of students that LessonUp processes.

LessonUp has concluded a data processing agreement with the schools and other purchasers of LessonUp services, which defines the rights and obligations applicable to the processing of personal data. This data processing agreement is based on the model data processing agreement belonging to the Covenant.

Click here to view the data processing agreement for schools. This data processing agreement is available on request for other purchasers of the LessonUp services.

LessonUp is controller

This situation occurs if LessonUp processes personal data for its own purposes, e.g. if a 30-day trial is taken out or an account is created to make use of the LessonUp application(s)/services.

In the context of the execution of this agreement, LessonUp processes the following personal data:

Registration and login: If you register and login, we will process your name and email address. If you login with your Google or Microsoft Office account, we will process the data linked to that account. A student can only register after he/she has received a link with the teacher's code.

We use this data to attend to your registration and to provide you with access to the application(s). We process this data because it is necessary to execute our agreement with you (i.e. to provide our services to you based on this agreement).

Use of LessonUp application: If you make use of our application(s), we will process the following data:

  • Students: login details, name, school, grade or class. Students can only use the application after receiving an invitation from their teacher.
  • Teachers: login details, lessons completed (if these contain personal data).

We use this data to perform our service, including making the lessons available and storing the results of the assignments. We process this data because it is necessary to execute our agreement with you (i.e. to provide our services to you).

Teachers make use of the LessonUp application via Lessonup.app and/or the Sidekick application. Students make use of the LessonUp application via Lessonup.app and/or the Stap-voor-Stap application (intended for students who require some additional help).

Class participation without an account: As a student, in some cases you can also participate in your teacher's class without an account. In that case, you only enter the code provided and the name with which you want to join the class. For this purpose, we only process the name specified. We process this information based on our legitimate interests, namely, to allow you to participate in the class and to ensure that the teacher knows who all the participants are.

Information: Where necessary, we will inform you about (updates in) LessonUp services and will deal with your queries, complaints or suggestions. For this purpose, we will process your name and email address and the information or personal data that you share with us in your message. We process this information based on our legitimate interests, namely, to inform and to help you and thus offering you the best possible service.

Subscription: If you purchase a subscription from us, we will be able to view your name, email address, amount, payment method, payment status (successful/failed) and the last 4 digits of your account number. The data will be processed further by our payment providers. We process this data because it is necessary to execute our agreement with you and because we are legally obliged to include (part of) this data in our financial administration for the Tax and Customs Administration.

Quotation request: If you request a quote for a subscription, we will ask for your first name and surname, email address, phone number (optional), school name and place, country, number of teachers and any other comments you may have. We process this data because we need it to take certain measures before we enter into an agreement (i.e. that we can draw up a quotation based on your data and can contact you in this regard).

In the context of LessonUp's legitimate interests, LessonUp also processes data regarding the use of the applications to:

  • be able to analyse them and to interpret their results into modifications and additional features of the applications;
  • improve services and to promote use and ease of use;
  • ensure the security, control, prevention of misuse and improper use, and the prevention of inconsistency and unreliability in the processed data;
  • ensure the continuity and proper functioning of the applications;
  • be able to implement laws and regulations.

Website and applications

Receivers

Your personal data will not be shared with other parties, except in the cases mentioned below.

Processors:

We make use of processors. These are parties that support us in our services and who only process personal data on our behalf and on our instruction. For example, we make use of:

  • The email marketing programme Sendinblue, based in France (EU);
  • The hosting provider Google, with its server based in Ghislaine, Belgium (EU);
  • The marketing software Hubspot, based in Germany (EU);
  • Our application monitoring software Sentry, based in Iowa (US);
  • The CRM and management software Pipedrive, based in Germany (EU), used for drawing up and managing quotes, among other things;
  • Our helpdesk software Intercom, based in the US.

The processors engaged by LessonUp must comply with strict security requirements and have committed themselves towards LessonUp not to use the data for any purpose other than those purposes mentioned above. The personal data is stored on a server in the Netherlands and Belgium.

External controllers:

  • We may proceed in providing information or personal data to external parties, such as entitled parties, supervisory bodies, the Tax and Customs Administration, judicial authorities, police and other investigative authorities, if it is mandatory for LessonUp to do so pursuant to laws or regulations, or if this is justified based on this Privacy Statement.
  • When implementing payments, we make use of payment providers:
  • i) Stripe, based in the USA;
  • ii) Mollie based in the Netherlands.

Where recipients of personal data are based outside the EU, LessonUp will conclude the appropriate Standard Contractual Clauses with these recipients to ensure the adequate protection of the personal data after the transfer outside the EU. We do not apply this rule to schools or individual teachers outside the EU, as we assume that these schools and teachers will sufficiently protect the personal data of their own students and do not require additional data protection obligations from LessonUp.

For lesson components video and interactive video, LessonUp makes use of YouTube and Vimeo API services. More information on how these parties handle your personal data is available at:

Student information systems

The school/teacher may request us to pass on certain data about Students (including grades) to a student information system (e.g. Magister). Depending on the role taken up by the student information system, this will apply as a processor or an external controller. We only share this data in our role as a processor.

Retention periods

LessonUp does not retain the personal data that it processes for longer than is necessary for the purposes described in this Privacy Statement. Thereafter, this personal data is deleted. In any case, we maintain the following retention periods:

  • Newsletters: If you have subscribed to the newsletter, we will retain your data until you unsubscribe via the link included in each newsletter and in any case one year after we no longer have a contractual relationship with you.
  • Personal data in our administration for the Tax and Customs Administration: We retain this personal data for seven (7) years, in accordance with our statutory obligation.
  • Miscellaneous: We only retain other personal data for as long as this is necessary for the purpose and in any case no longer than thirty-six (36) months unless we are legally obliged to retain the personal data for longer.

For the processing of personal data in which LessonUp acts as a processor, the retention periods set out in the data processing agreement will apply.

Security

LessonUp has taken appropriate technical and organisational measures to protect personal data from loss and any form of unauthorised access.

The website has been secured with an encrypted connection (256-bits SSL – shown by the lock symbol in the browser) to ensure security between the visitor's computer and the LessonUp servers.

More information on security measures taken by LessonUp can be found in the data processing agreement concluded by the schools with LessonUp data processing agreement.

Rights

Based on the GDPR, in respect of the processing of your personal data, you have certain rights. It concerns the following rights:

  • Access: You have the right to access the data that we process about you, including information about the purposes for which we process that data, to whom the data has been provided and what the (expected) retention period is.
  • Correction: If it appears that we have stored incorrect or incomplete data about you, then you have the right to have this data corrected.
  • Deletion: You have the right to have your data deleted by us. Under certain circumstances, we may refuse the request for deletion, e.g. when we have to retain the data in connection with tax obligations.
  • Limitation: You have the right to limit the processing of your data, e.g. pending the handling of an objection lodged by you.
  • Objection: You have the right to object to the processing of your personal data, insofar as it relates to your particular situation.
  • Withdrawal of consent: You have the right to withdraw your consent for the processing of your personal data, provided that the processing is based on your consent. This does not affect the validity of the processing which was executed before the moment that consent was withdrawn.
  • Complaint to supervisory authority: You have the right to file a complaint at the Dutch Data Protection Authority, if you believe that we process your personal data unlawfully. Of course, you could also file a complaint directly at LessonUp.

You could submit any objections or requests to LessonUp using the contact details below. LessonUp will assess the objection and/or request in accordance with the requirements of the GDPR.

If LessonUp processes your personal data based on an agreement with a school, then you must submit any objections and/or requests directly to your school.

Protocol for reporting a data breach

LessonUp maintains a fixed protocol for reporting data breaches and/or incidents or security incidents, which can be found here. LessonUp will always inform the school's management within 24 hours of a data breach or security incident.

Queries, complaints and changes to this Privacy Statement

If you have any queries about the processing of your personal data or if you wish to invoke any of the above-mentioned rights, please contact us, the details are shown below.

LessonUp B.V.

Saturnusstraat 14

2516 AH The Hague

Email address: privacy@lessonup.com

Chamber of Commerce no.: 64760006