Student Data Protection Privacy Policy
Redwood Literacy, LLC
Last modified: August 18, 2022
Introduction
This Student Data Protection Privacy Policy (“Policy”) applies to personal data held by Redwood Literacy, LLC (“Company” or “We”). We value the trust of our students, staff, parents/guardians, and community. The Policy applies to all Company staff, students, parents/guardians, and others (including prospective or potential students and their parents/guardians) insofar as the measures under the Policy relate to them. We respect individuals’ rights to privacy and rights under the applicable data protection legislation, and is committed to protecting it through our compliance with this Policy as individuals use our school website and services. Protected data is any data that contains personally identifiable information (“PII”) or personal data concerning any individual (“Protected Data”). Protected Data includes data that is regulated by local, state, Federal, the European Union (“EU”), or other statute/agreements. These regulations may include, but are not limited to:
● Children’s Onlie Privacy Protection Rule (“COPPA”)
● EU General Data Personal Regulation (“GDPR”)
● Gramm-Leach-Bliley Act (“GLBA”)
● Health Insurance Portability and Accountability Act (“HIPAA”)
● Family Educational Rights and Privacy Act (“FERPA”)
● Payment Card Industry Data Security Standards (“PCI DSS”)
● Stop Hacks and Improve Electronic Data Security Act (“SHIELD Act”)
● Student Online Personal Protection Act (“SOPPA”)
Protected Data requires the highest level of protection. All other data is protected by the Company with voluntary industry standards or reasonable practices concerning the protection of such data that the Company chooses to follow. This policy describes the types of information we may collect or that individuals may provide to us. This policy may change from time to time in our sole discretion.
Information We Collect and How We Collect It
We collect several types of information from and about users of our school website, including information:
● By which individuals may be personally identified, such as name, postal address, e-mail address, telephone number, or any other identifier by which individuals may be contacted online or offline (“personal information”);
● That is about individuals but individually does not identify individuals; and/or
● About individuals’ internet connection, the equipment individuals use to access our school website, and usage details.
We collect this information:
● Directly from individuals when individuals provide it to us.
● Automatically as individuals navigate through the site. Information collected automatically may include usage details, IP addresses, and information collected through cookies, web beacons, and other tracking technologies.
● From third parties, for example, our business partners.
Information Provided to Us
The information we collect may include:
● Information that individuals provide by filling in our forms. This includes information provided at the time of registering to use our services, subscribing to our service, posting material, or requesting further services. We may also ask individuals for information when individuals report a problem with the Company.
● Records and copies of individuals’ correspondence (including email addresses), if individuals contact us. ● Individuals’ responses to surveys that we might ask individuals to complete for research purposes.
● Details of transactions individuals carry out through us and of the fulfillment of individuals’ orders. Individuals may be required to provide financial information before placing an order through us.
● Individuals’ use and interaction with our various features.
We may store information collected by us on Google Drive for up to seven (7) years following these instructions and information provided: cookies, IP address Google’s Privacy Policy: https://support.google.com/analytics/answer/6004245?hl=. Individuals also may provide information to be published or displayed (hereinafter, “posted”) on our public areas, or transmitted to other students, parents/guardians, school staff, or third parties. Such material is created or posted at individuals’ own risk. Although we limit access to certain pages, please be aware that no security measures are perfect or impenetrable. Additionally, we cannot control the actions of other students, parents/guardians, school staff, or third parties with whom individuals may choose to share individuals’ information. Therefore, under this circumstances, we cannot and do not guarantee that individuals’ information will not be viewed by unauthorized persons.
Information We Collect Through Automatic Data Collection Technologies
As individuals navigate through and interact with our school website and platform, we may use automatic data collection technologies to collect certain information about individuals’ equipment, browsing actions, and patterns, including:
● Details of individuals’ visits to our school website and platform, including traffic data, location data, logs, and other communication data and the resources that individuals access and use on the school website and platform.
● Information about individuals’ computer and internet connection, including individuals’ IP address, operating system, and browser type.
The information we collect automatically is only statistical data and does not include personal information, but we may maintain it or associate it with personal information we collect in other ways or receive from third parties. It helps us to improve our school website and platform and to deliver a better and more personalized service, including by enabling us to:
● Estimate our audience size and usage patterns.
● Store information about individuals’ preferences, allowing us to customize our school website according to individuals’ individual interests.
● Speed up individuals’ searches.
● Recognize individuals when individuals return to our school website and platform. As an example, the technologies we may use for this automatic data collection may include or be similar to:
● Cookies (or browser cookies). A cookie is a small file placed on the hard drive of individuals’ computer. Individuals may refuse to accept browser cookies by activating the appropriate setting on individuals’ browser. However, if individuals select this setting individuals may be unable to access certain parts of our school website. Unless individuals have adjusted individuals’ browser setting so that it will refuse cookies, our system will issue cookies when individuals direct individuals’ browser to our school website.
● Flash Cookies. Certain features of our school website and platform may use local stored objects (or Flash cookies) to collect and store information about individuals’ preferences and navigation to, from, and on our school website. Flash cookies are not managed by the same browser settings as are used for browser cookies.
● Web Beacons. Pages of our the school website, platform, and our e-mails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit Company, for example, to count users who have visited those pages or opened an email and for other related website statistics (for example, recording the popularity of certain website content and verifying system and server integrity).
We do not collect personal information automatically, but we may tie this information to personal information about individuals that we collect from other sources or individuals provide to us.
Third-Party Use of Cookies and Other Tracking Technologies
Some content or applications, including advertisements, on the school website and platform are served by third-parties, including advertisers, ad networks and servers, content providers, and application providers. These third parties may use cookies alone or in conjunction with web beacons or other tracking technologies to collect information about individuals when individuals use our website. The information they collect may be associated with individuals’ personal information or they may collect information, including personal information, about individuals’ online activities over time and across different websites and other online services. They may use this information to provide individuals with interest-based (behavioral) advertising or other targeted content.
We do not control these third parties’ tracking technologies or how they may be used. If individuals have any questions about an advertisement or other targeted content, individuals should contact the responsible provider directly.
How We Use Information
We use information that we collect about individuals or that individuals provide to us, including any personal information:
● To present our school website and its contents to individuals.
● To provide individuals with information, products, or services that individuals request from us. ● To fulfill any other purpose for which individuals provide it.
● To provide individuals with notices about individuals’ account or subscription, including expiration and renewal notices.
● To carry out our obligations and enforce our rights arising from any contracts entered into between individuals and us, including for billing and collection.
● To notify individuals about changes to our school website or any products or services we offer or provide through it.
● To allow individuals to participate in interactive features on our school website and platform. ● In any other way we may describe when individuals provide the information.
● For any other purpose with individuals’ consent.
We may also use individuals’ information to contact individuals about our own and third-parties’ goods and services that may be of interest to individuals. If individuals do not want us to use individuals’ information in this way, please adjust individuals’ user preferences in individuals’ account profile on our school website and platform or contact us.
We may use the information we have collected from individuals to enable us to display advertisements to our advertisers’ target audiences. Even though we do not disclose individuals’ personal information for these purposes without individuals’ consent, if individuals click on or otherwise interact with an advertisement, the advertiser may assume that individuals meet its target criteria.
Disclosure of Information
We may disclose aggregated information about our users, and information that does not identify any individual, without restriction.
We may disclose personal information that we collect or individuals provide as described in this privacy policy: ● To our subsidiaries and affiliates.
● To contractors, service providers, and other third parties we use to support our business.
● To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Company’s assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by Company about our school website users is among the assets transferred.
● To third parties to market their products or services to individuals if individuals have not opted out of these disclosures.
● To fulfill the purpose for which individuals provide it.
● For any other purpose disclosed by us when individuals provide the information.
● With students’ and parents/guardians’ consent.
We may also disclose individuals’ personal information:
● To comply with any court order, law, or legal process, including to respond to any government or regulatory request.
● If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of Redwood Literacy, LLC our customers, or others. This includes exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction.
Choices About How We Use and Disclose Information
We strive to provide individuals with choices regarding the personal information individuals provide to us. Where applicable, we may provide individuals with the following control over individuals’ information:
● Tracking Technologies and Advertising. Individuals can set individuals’ browser to refuse all or some browser cookies, or to alert individuals when cookies are being sent. To learn how individuals can manage individuals’ Flash cookie settings, visit the Flash player settings page on Adobe’s website. If individuals disable or refuse cookies, please note that some parts of this site may then be inaccessible or not function properly.
● Disclosure of Information for Third-Party Advertising. If we plan to share individuals’ personal information with unaffiliated or non-agent third parties for promotional purposes, we will provide individuals the option to opt-out by logging into the school website and platform, and adjusting individuals’ user preferences in individuals’ account profile or by sending us an email with individuals’ request to jillian@redwoodliteracy.com.
● Promotional Offers from Company. If we plan to use individuals’ contact information to promote our own or third parties’ products or services, we will provide individuals the option to opt-out by logging into the school website and platform, and adjusting individuals’ user preferences in individuals’ account profile or by sending us an email stating individuals’ request to jillian@redwoodliteracy.com. This opt out does not apply to information provided to Company as a result of a product purchase, warranty registration, product service experience or other transactions.
● Targeted Advertising. If we plan to use information that we collect or that individuals provide to us to deliver advertisements according to our advertisers’ target-audience preferences, we will provide individuals the option to opt-out by adjusting individuals’ user preferences in individuals’ account profile or by sending us an email stating individuals’ request to jillian@redwoodliteracy.com.
We do not control third parties’ collection or use of individuals’ information to serve interest-based advertising. However these third parties may provide individuals with ways to choose not to have individuals’ information collected or used in this way.
Accessing and Correcting Information
Individuals can review and change individuals’ personal information by logging into the school website and platform, and visiting individuals’ account profile page.
Individuals may also send us an email at jillian@redwoodliteracy.com to request access to, correct or delete any personal information that individuals have provided to us. We cannot delete individuals’ personal information except by also deleting individuals’ user account. We may not accommodate a request to change information if we believe the change would violate any law or legal requirement or cause the information to be incorrect.
If individuals delete individuals’ information from the school website and platform, copies of individuals’ information may remain viewable in cached and archived pages, or might have been copied or stored by other school website users. Proper access and use of information provided on the school website and platform, is governed by our school website and platform terms of use.
Data Security
We have implemented industry standard measures intended to secure individuals’ personal information from accidental loss and from unauthorized access, use, alteration, and disclosure.
The safety and security of individuals’ information also depends on individuals. Where we have given individuals (or where individuals have chosen) a password for access to certain parts of our school website and platform, individuals are responsible for keeping this password confidential. We ask individuals not to share individuals’ password with anyone. We urge individuals to be careful about giving out information in public
areas of the school website like message boards. The information individuals share in public areas may be viewed by any user of the school website.
Unfortunately, the transmission of information via the internet is not completely secure. Although we do our best to protect individuals’ personal information, we cannot guarantee the security of individuals’ personal information transmitted to our school website. Any transmission of personal information is at individuals’ own risk. We are not responsible for circumvention of any privacy settings or security measures contained on the school website and platform.
Additional Rights
While we have provided individuals various account settings and controls for managing individuals’ information, individuals may have additional or complementary rights under one or more state or local laws, some of which are noted below.
Residents of California, thanks to section 1798.83 of the California Civil Code, may request, once per calendar year, from companies conducting business in California a list of all third parties to whom the company has disclosed certain personally identifiable information as defined under California law during the preceding year for third-party direct-marketing purposes. In individuals’ request, please attest to individual’s being a California resident and provide a current California address for our response.
If individuals are a California resident and under the age of 18, and a registered user of this school website, section 22581 of the California Business and Professions Code permits individuals to request and obtain the removal of content that individuals have publicly posted. Please note that individuals’ request will not ensure a complete removal of the content and that in some cases the statute may not require or allow removal even if requested.
Nevada residents who wish to exercise their sale opt-out rights under Nevada Revised Statutes Chapter 603A may submit a request to this designated address: [EMAIL].
GDPR
Individuals may have certain rights under the European Union’s GDPR 2016/679. The GDPR is a complex regulatory scheme and we do not intend to provide every detail here. If interested individuals should read the GDPR and the relevant guidance provided by the applicable authorities for a fuller explanation. The GDPR provides the right, where applicable, to (a) access, (b) publication, (c) erasure, (d) restrict processing, (e) object to processing, (f) data portability, (g) complain to a supervisory authority, and (h) withdraw consent.
Where applicable, the GDPR provides the right to confirm whether Company has processed individuals’ Personal Data (as defined in the GDPR) and, when the Company does, the right to access that data, together with certain other information including the purposes of the processing, the categories of Personal Data concerned, and the recipients of the Personal Data. Where applicable, and providing that we do not affect the rights and freedoms of anyone else, we will supply individuals with one copy of individuals’ Personal Data. The first copy is free. We may charge a reasonable fee for additional copies.
Where applicable, the GDPR provides the rights to rectify any inaccurate Personal Data about individuals and, taking into account the purposes of the processing, to complete any incomplete data about individuals.
In some circumstances the GDPR provides individuals the right to erase individuals’ Personal Data without undue delay, including when we no longer need the Personal Data for the purposes for which we collected or
processed the Personal Data, if individuals withdraw individuals’ consent to consent-based processing, if individuals object to the processing of the Personal Data under certain rules of the GDPR, if the processing is for the purpose of direct marketing, and if the Personal Data have been unlawfully processed. However, the GDPR provides exceptions or exclusions to the right to erase, including where the processing is necessary for the exercise of free expression and information, to comply with a legal obligation, or to establish, exercise, or defend a legal claim.
In some circumstances the GDPR provides the right to restrict the processing of individuals’ Personal Data, such as to contest the accuracy of the Personal Data, where the processing is unlawful but individuals oppose erasure, when we no longer need the Personal Data for the purpose of our processing but individuals require Personal Data to establish, exercise or defend a legal claim, and individuals have objected to the processing pending the verification of that objection. When processing has been restricted on this basis, we may continue to store individuals’ Personal Data. But we will process individuals’ data otherwise only with individuals’ consent, to establish, exercise or defend a legal claim, or to protect another natural or legal person’s rights, or for reasons of important public interest.
If applicable, the GDPR provides the right to object to our processing of individuals’ Personal Data on grounds relating to individuals’ situation, but only to the extent that the processing is necessary for a task carried out in the public interest or to exercise any official authority vested in Company, or for a legitimate interest pursued by Company or someone else. If individuals object, we shall stop processing the Personal Data unless we can demonstrate compelling legitimate grounds to process the information that override individuals’ interests, rights and freedoms, or the purpose of the processing is to establish, exercise or defend a legal claim.
Individuals may object to our processing of individuals’ Personal Data for direct marketing purposes including profiling for direct marketing purposes. If individuals notify us of such an objection, we shall stop processing individuals’ Personal Data for that purpose.
Individuals may object to our processing of individuals’ Personal Data for scientific or historical research or statistical purposes on grounds relating to individuals’ particular situation, unless the processing is necessary for a task carried out in the public interest.
If the legal basis for our processing individuals’ Personal Data is consent or that the processing is necessary to perform a contract to which individuals are a party, or in order to take steps at individuals’ request before entering into a contract, and such processing is carried out by automatic means, individuals have the right to receive individuals’ Personal Data from us in a structured, commonly used, and machine-readable format. But this right does not apply when its application will adversely affect the rights and freedoms of others.
If individuals believe that our processing of individuals’ Personal Data infringes any data-protection statute, rule or regulation, individuals may lodge a complaint with the appropriate authorities responsible for data protection. If applicable, individuals may lodge that complaint in the European Union member state of individuals’ habitual residence, individuals’ workplace, or the place of the alleged infringement.
To the extent that we base our processing of individuals’ Personal Data on individuals’ consent, individuals may withdraw that consent at any time. But individuals’ withdrawal of that consent will not affect the lawfulness of any processing we do before individuals’ withdrawal.
If applicable, individuals may exercise any of individuals’ rights in relation to individuals’ Personal Data by emailing Company at jillian@redwoodliteracy.com.
COPPA
If applicable, the COPPA requires us to inform parents/guardians about our practices for collecting, using, and disclosing personal information from children under the age of 13. It also requires us to obtain verifiable consent from a child's parent for certain collection, use, and disclosure of the child's personal information. Children can access many parts of our school website and platform and its content and use many of its features without providing us with personal information. However, some content and features are available only to registered users or require us to collect certain information, including personal information, from them. In addition, we use certain technologies, such as cookies, to automatically collect information from our users (including children) when they visit or use the school website and platform.
This section notifies parents of:
● The types of information we may collect from children.
● How we use the information we collect.
● Our practices for disclosing that information.
● Our practices for notifying and obtaining parents' consent when we collect personal information from children, including how a parent may revoke consent.
● All operators that collect or maintain information from children through our school website and platform.
This section only applies to children under the age of 13. We only collect as much information about a child as is reasonably necessary for the child to participate in an activity, and we do not condition his or her participation on the disclosure of more personal information than is reasonably necessary.
At any time, parents/guardians may review the child's personal information maintained by us, require us to correct or delete the personal information, and/or refuse to permit us from further collecting or using the child's information. Parents/guardians can review, change, or delete the child's personal information by:
● Logging into the child's account and visiting the account profile page.
● Sending us an email at jillian@redwoodliteracy.com. To protect parents/guardians’ privacy and security, we may require parents/guardians to take certain steps or provide additional information to verify their identity before we provide any information or make corrections.
FERPA
FERPA is a Federal law that is administered by the Student Privacy Policy Office (“Office”) in the U.S. Department of Education (“Department”). FERPA generally prohibits the improper disclosure of personally identifiable information derived from education records on our school website and platform. If the information is obtained through personal knowledge or observation, or has heard orally from others, it is not protected under FERPA.
Once a student reaches 18 years of age or attends a postsecondary institution, he or she becomes an "eligible student," and all rights formerly given to parents/guardians under FERPA transfer to the student. The eligible student has the right to have access to his or her education records, the right to seek to have the records amended, the right to have control over the disclosure of personally identifiable information from the records (except in certain circumstances specified in the FERPA regulations), and the right to file a complaint with the Department. The term "education records" is defined as those records that contain information directly related to a student and which are maintained by an educational agency or institution or by a party acting for the agency or institution.
Where applicable, under FERPA, we are not generally required to maintain particular education records or education records that contain specific information. Rather, we are required to provide certain privacy protections for those education records that we do maintain. Also, unless there is an outstanding request by an eligible student and parents/guardians to inspect and review education records, FERPA permits us to destroy such records without notice to the student or parents/guardians.
If applicable, under FERPA, we must provide an eligible student and parents/guardians with an opportunity to inspect and review his or her education records within 45 days following our receipt of a request. We are required to provide an eligible student with copies of education records, or make other arrangements, if a failure to do so would effectively prevent the student and parents/guardians from obtaining access to the records. We are not generally required by FERPA to provide an eligible student or parents/guardians with access to academic calendars, course syllabi, or general notices such as announcements of specific events or extra-curricular activities.
Where applicable, under FERPA, we may not generally disclose personally identifiable information from an eligible student's education records to a third party unless the eligible student has provided written consent. Such prohibitions does not include disclosure to our school officers including teachers, instructors, administrators, health staff, counselor, volunteer, or other party to whom we has outsourced institutional services or functions.
SOPPA
SOPPA is the student data privacy law that regulates students’ covered information by schools, the Illinois State Board of Education, and education technology vendors. School districts are required by SOPPA to provide additional guarantees that student data is protected when collected by educational technology companies, and that data is used for beneficial purposes only (105 ILCS 85).
If applicable, below is a high-level overview of the requirements. Under SOPPA, school districts must: ● Annually post a list of all operators of online services or applications utilized by the district.
● Annually post all data elements that the school collects, maintains, or discloses to any entity. This information must also explain how the school uses the data, and to whom and why it discloses the data.
● Post contracts for each operator within 10 days of signing.
● Annually post subcontractors for each operator.
● Post the process for how parents can exercise their rights to inspect, review and correct information maintained by the school, operator, or ISBE.
● Post data breaches within 10 days and notify parents within 30 days.
● Create a policy for who can sign contracts with operators.
● Designate a privacy officer to ensure compliance.
● Maintain reasonable security procedures and practices. Agreements with vendors in which information is shared must include a provision that the vendor maintains reasonable security procedures and practices.
Changes to Our Privacy Policy
It is our policy to post any changes we make to our student data protection privacy policy with a notice that the privacy policy has been updated on the school website or platform home page. If we make material changes to how we treat our users’ personal information, we will notify individuals by email to the email address specified in individuals’ account or through a notice on the school website home page. The date the privacy policy was last revised is identified at the top of the Policy. Individuals are responsible for ensuring we have an up-to-date active and deliverable email address for individuals, and for periodically visiting our school website and this privacy policy to check for any changes.
Contact Information
To ask questions or comment about this student data protection privacy policy and our privacy practices, contact us at:
jillian@redwoodliteracy.com