1. Introduction

1.1

This privacy policy explains how Homegrown Learning Limited, a company registered in England and Wales under company number 11818690, whose registered office is at The Workbox Penzance, Wharf Rd, Penzance TR18 4FG ("we", "us" or "our"), collects, uses, stores and protects personal data when you use our websites, the Collage App or otherwise interact with us.

1.2

This privacy policy should be read together with our Collage App Terms of Use.

1.3

If you have any questions about this privacy policy or how we process personal data, please contact us at: hello@collageapp.co.uk

1.4

We may update this privacy policy from time to time to reflect changes to our services, technology, legal requirements or how we process personal data. Where we make a change that materially affects how we process your personal data, we will take reasonable steps to notify you, for example by email or through the Collage App.

1.5

For the purposes of applicable data protection legislation, Homegrown Learning Limited is the controller of the personal data that we process for our own purposes as described in this privacy policy.

1.6

In this privacy policy, "Personal Data" means information relating to an identified or identifiable individual, as defined by applicable data protection legislation.

2. Whose Personal Data Do We Collect?

We may collect and process Personal Data relating to:

• you, as the person who creates and uses a Collage Account;
• your Children, where you choose to record information about them using Collage;
• people who contact us, for example for customer support;
• people who subscribe to our marketing communications; and
• people who visit or interact with our websites or other online services.

For the purposes of this privacy policy, Child means a child whose learning records, photographs, videos or other information you record, upload or store using the Collage App.

3. Personal Data You Provide to Us

3.1 Account information

When you create or use a Collage Account, we may collect information such as:

• your name;
• email address;
• contact details;
• login and authentication information;
• subscription information;
• billing information;
• account preferences; and
• information you provide when contacting us for support.

Some information is necessary for us to create and operate your Account. Where information is mandatory, we will normally make this clear when we collect it.

3.2 Children's information

Collage allows you to create and maintain records of your Children's learning and educational experiences.

Depending on how you use Collage, this may include:

• a Child's name;
• age or date of birth;
• learning records;
• educational activities;
• notes and observations;
• photographs;
• videos;
• audio recordings;
• documents;
• artwork; and
• other information that you choose to record about a Child.

You decide what information to enter into your Account. You should therefore avoid uploading information that is not reasonably necessary for the purposes for which you use Collage.

3.3 Your responsibility for Children's information

You should only add information about a Child where you have parental responsibility for that Child or otherwise have lawful authority to provide and store that information.

You are responsible for ensuring that you have any permissions, consents or other lawful authority required by law before uploading Personal Data, photographs, videos, recordings or other information relating to a Child.

3.4 User Content

Information that you upload or create using Collage is referred to in our Terms of Use as User Content.

User Content may include Personal Data relating to you and your Children.

You retain ownership of your User Content. We process and store it only as necessary to provide and operate the Collage App and for the other purposes described in this privacy policy and our Terms of Use.

4. Information We Collect Automatically

When you use our websites or the Collage App, we may automatically collect certain technical and usage information.

Depending on the services and technologies we use, this may include:

• IP address;
• browser type and version;
• operating system;
• device type;
• device settings;
• time zone and language;
• login information;
• dates and times of access;
• pages and features used;
• technical error information; and
• information about how you interact with the Collage App.

We use this information to operate, secure and improve our services, investigate technical problems and understand how the Collage App is being used.

Some information may be collected using cookies or similar technologies.

Further information about cookies and similar technologies is provided in our Cookies Policy.

5. Information We Receive From Other Sources

We may receive Personal Data about you from third parties where necessary to provide, operate or secure the Collage App.

These third parties may include:

• payment providers;
• fraud-prevention and security providers;
• authentication providers;
• hosting and technology providers;
• analytics providers; and
• other service providers that support our business.

We may also receive information from third parties where this is necessary to comply with a legal obligation or protect our rights, users or systems.

We will only use such information in accordance with applicable data protection legislation.

6. How We Use Personal Data

We use Personal Data for the following purposes.

6.1 Providing and managing your Account

We use your Personal Data to:

• create and manage your Account;
• authenticate your identity;
• provide access to the Collage App;
• provide the features and functionality you request;
• store and display your User Content;
• communicate with you about your Account; and
• provide customer support.

The usual lawful basis for these activities is that they are necessary to perform our contract with you.

6.2 Providing and maintaining Collage

We process information contained in your Account and User Content to:

• provide the Collage App;
• store your records;
• display your records to you;
• maintain backups;
• maintain and secure our systems;
• investigate technical problems;
• provide customer support; and
• maintain the functionality of the service.

The usual lawful basis for these activities is performance of our contract with you and, where appropriate, our legitimate interests in operating a secure and effective service.

6.3 Improving Collage

We may use technical and usage information to understand how the Collage App is used and to improve its functionality, performance, security and reliability.

Where reasonably possible, we will use aggregated or anonymised information for these purposes rather than identifiable User Content.

Our legitimate interest in improving and developing our services may provide the lawful basis for this processing where appropriate.

6.4 Payments

We use payment providers to process subscription payments.

We may receive limited information from payment providers, such as confirmation that a payment has been made, payment status and information needed to manage your subscription.

Payment card details are generally processed directly by our payment provider rather than being stored by us.

6.5 Customer support

We use Personal Data to respond to questions, complaints, support requests and other communications.

The lawful basis may be performance of our contract with you, our legitimate interests in providing customer support or compliance with a legal obligation, depending on the circumstances.

6.6 Security and fraud prevention

We may process Personal Data to:

• protect the security of your Account;
• detect and prevent fraud;
• investigate misuse of the Collage App;
• protect our systems and services;
• prevent unauthorised access; and
• protect our users and their information.

The lawful basis may be our legitimate interests in protecting our business and users and, where applicable, compliance with a legal obligation.

6.7 Legal obligations

We may process and disclose Personal Data where necessary to:

• comply with applicable laws;
• respond to lawful requests from public authorities;
• comply with court orders;
• meet accounting, tax or other statutory obligations;
• establish, exercise or defend legal claims; or
• protect the rights, property or safety of us, our users or other people.

The lawful basis will normally be compliance with a legal obligation and/or our legitimate interests.

6.8 Business transactions

We may use and disclose relevant Personal Data where reasonably necessary in connection with:

• a proposed or actual sale of our business;
• a merger or acquisition;
• investment or financing;
• restructuring; or
• the sale or transfer of assets.

Where required by law, we will take appropriate steps to protect Personal Data during such transactions.

7. Children's Personal Data

7.1

We recognise that information relating to Children requires particular care.

7.2

Collage allows parents to create and maintain records about their Children's learning and educational experiences. This may include photographs, videos and other information that could identify a Child.

7.3

We process Children's Personal Data only for the purposes described in this privacy policy and as necessary to provide and operate the Collage App.

7.4

We do not use Children's Personal Data for direct marketing.

7.5

We do not sell Children's Personal Data or User Content.

7.6

We do not use identifiable photographs, videos or other User Content relating to your Children for advertising or marketing purposes without your separate permission.

7.7

We take appropriate technical and organisational measures designed to protect Children's Personal Data against unauthorised access, accidental loss, destruction, alteration or disclosure.

7.8

You should only upload Children's Personal Data where you have the necessary parental responsibility, authority, permission or other lawful basis to do so.

8. Our Lawful Bases for Processing

We will only process Personal Data where we have a lawful basis under applicable data protection legislation.

Depending on the circumstances, these bases may include:

8.1 Contract

We may process Personal Data where it is necessary to provide the Collage App or otherwise perform our contract with you.

8.2 Legal obligation

We may process Personal Data where necessary to comply with a legal or regulatory obligation.

8.3 Legitimate interests

We may process Personal Data where necessary for our legitimate interests, provided those interests are not overridden by your rights and interests.

Our legitimate interests may include:

• operating and managing our business;
• providing and improving the Collage App;
• maintaining security;
• preventing fraud and misuse;
• providing customer support;
• managing business transactions; and
• establishing, exercising or defending legal claims.

8.4 Consent

Where we rely on consent, we will ask you for that consent where required and you may withdraw your consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before you withdrew it.

9. Marketing

9.1

We may send you marketing communications about Collage App where we are legally permitted to do so.

9.2

Where consent is required, we will ask for your consent before sending marketing communications.

9.3

You can stop receiving marketing communications at any time by:

• clicking the unsubscribe link in a marketing email; or
• contacting us at hello@collageapp.co.uk.

9.4

We will continue to send you important service-related communications where necessary, such as messages concerning your Account, payments, security or material changes to the Collage App.

9.5

We do not use Children's Personal Data for direct marketing.

10. Who We Share Personal Data With

We may share Personal Data with third parties where necessary for the purposes described in this privacy policy.

These may include:

• hosting and cloud service providers;
• payment providers;
• email and communications providers;
• customer-support providers;
• analytics providers;
• security and fraud-prevention providers;
• IT and software providers;
• professional advisers, including accountants, auditors and lawyers;
• insurers;
• regulators and public authorities;
• law enforcement agencies where legally required or permitted; and
• organisations involved in a proposed or actual business transaction.

10.1 Service providers

Where a third party processes Personal Data on our behalf, we will take appropriate steps to ensure that the processing is carried out in accordance with applicable data protection legislation and our instructions.

10.2

We will only provide service providers with the information reasonably necessary for them to provide their services.

10.3

We require appropriate contractual and security protections from relevant service providers.

11. International Transfers

11.1

Some of our service providers may process Personal Data outside the United Kingdom.

11.2

Where Personal Data is transferred outside the UK in circumstances where applicable data protection legislation requires specific safeguards, we will use an appropriate transfer mechanism.

This may include:

• a country or territory recognised as providing an adequate level of protection;
• the UK International Data Transfer Agreement;
• the UK Addendum to the EU Standard Contractual Clauses; or
• another lawful transfer mechanism recognised under applicable data protection legislation.

11.3

Where required, we will take appropriate steps to assess and protect international transfers of Personal Data.

12. Security

12.1

We use appropriate technical and organisational measures designed to protect Personal Data against:

• unauthorised or unlawful processing;
• accidental loss;
• destruction;
• alteration;
• unauthorised disclosure; and
• unauthorised access.

12.2

Our security measures may include access controls, authentication procedures, encryption, secure hosting, backups, monitoring and other appropriate technical and organisational measures.

12.3

Access to Personal Data within our organisation is limited to people who need access for legitimate business purposes.

12.4

No internet-based service can be guaranteed to be completely secure. You are responsible for keeping your Account login details confidential and for notifying us promptly if you believe your Account has been compromised.

12.5

If we become aware of a Personal Data breach, we will assess and respond to it in accordance with our legal obligations, including notifying the Information Commissioner's Office and/or affected individuals where required.

13. How Long We Keep Personal Data

13.1

We retain Personal Data only for as long as reasonably necessary for the purposes for which it was collected, unless a longer period is required or permitted by law.

13.2

While your Collage Account is active, we will generally retain the Personal Data and User Content necessary to provide the service to you.

13.3

Following cancellation or termination of your Account, we may retain User Content and related Personal Data for a limited period to allow you a reasonable opportunity to recover your information.

13.4

After that period, we will delete or anonymise Personal Data and User Content where reasonably practicable, subject to:

• legal or regulatory obligations;
• legitimate business requirements;
• the establishment, exercise or defence of legal claims; and
• secure backup systems.

13.5

Personal Data held in backups may remain for a limited period after deletion from our active systems and will be deleted or overwritten in accordance with our backup procedures.

13.6

Some information, such as financial and transaction records, may need to be retained for longer periods to comply with legal, accounting or tax requirements.

14. Your Data Protection Rights

Depending on the circumstances and subject to applicable law, you may have the following rights:

14.1 Right to be informed

You have the right to receive clear information about how we process your Personal Data. This privacy policy is intended to provide that information.

14.2 Right of access

You may request a copy of the Personal Data we hold about you.

14.3 Right to rectification

You may ask us to correct inaccurate or incomplete Personal Data.

14.4 Right to erasure

In certain circumstances, you may ask us to delete your Personal Data.

14.5 Right to restrict processing

In certain circumstances, you may ask us to restrict how we process your Personal Data.

14.6 Right to data portability

Where the legal requirements are met, you may ask us to provide certain Personal Data to you in a structured, commonly used and machine-readable format or to transmit it to another organisation.

14.7 Right to object

In certain circumstances, you may object to our processing of your Personal Data, including processing based on legitimate interests.

14.8 Rights relating to automated decision-making

Where applicable, you may have rights relating to decisions made solely by automated means, including profiling.

We do not currently use automated decision-making that produces legal or similarly significant effects on you.

14.9 Marketing

You may object to or withdraw consent to direct marketing at any time.

15. Children's Data Protection Rights

15.1

Children may have rights under applicable data protection legislation in relation to their Personal Data.

15.2

Depending on the Child's age, maturity and the circumstances of the request, those rights may be exercised by the Child themselves or by someone with parental responsibility or another person authorised to act on their behalf.

15.3

If you believe that we hold Personal Data relating to a Child and you would like to exercise a data protection right on their behalf, please contact us at:

hello@collageapp.co.uk

15.4

We will consider requests relating to Children's Personal Data in accordance with applicable law and the particular circumstances of the request.

16. How to Exercise Your Rights

16.1

You can exercise your data protection rights by contacting us at: hello@collageapp.co.uk

16.2

We may need to request additional information from you to verify your identity before responding to a request.

16.3

We will normally respond to a valid request within the period required by applicable data protection legislation.

16.4

We do not normally charge a fee for exercising your data protection rights.

We may charge a reasonable fee or refuse to act on a request where permitted by applicable law, including where a request is manifestly unfounded or excessive.

17. Complaints

17.1

If you have concerns about how we process your Personal Data, please contact us first at: hello@collageapp.co.uk

17.2

We will investigate your complaint and aim to respond within a reasonable period.

17.3

You also have the right to complain to the Information Commissioner's Office (ICO) if you believe that your Personal Data has been processed unlawfully.

Information about contacting the ICO is available at ico.org.uk.

If you live outside the United Kingdom, you may also have the right to complain to the relevant data protection supervisory authority in your country.

18. Cookies and Similar Technologies

18.1

We use cookies and similar technologies on our websites and, where applicable, within the Collage App.

18.2

These technologies may be used for purposes including:

• enabling the service to function;
• keeping you signed in;
• remembering preferences;
• maintaining security;
• understanding how the service is used; and
• improving our websites and services.

18.3

Where required by law, we will obtain your consent before using non-essential cookies or similar technologies.

18.4

Further information about the cookies and similar technologies we use, their purposes and how you can manage them is provided in our Cookies Policy.

19. Changes to This privacy policy

19.1

We may update this privacy policy from time to time.

19.2

If we make a material change to the way we process Personal Data, we will take reasonable steps to notify you before or when the change takes effect where required by law.

19.3

The date at the beginning of this privacy policy indicates when it was most recently updated.

20. Contact Details

If you have any questions about this privacy policy or our processing of Personal Data, please contact:

Homegrown Learning Limited
Company number: 11818690
The Workbox Penzance
Wharf Rd
Penzance
TR18 4FG

Email: hello@collageapp.co.uk