EEA+ Supplemental Notice
Last updated November 13, 2024
Our Privacy Notice explains how we, Outschool, Inc., collect and use personal data when you use our websites, applications, or activities offered through either (collectively, "Services"). We address this Supplemental EEA+ Privacy Notice (“EEA+ Notice”) to you if you use our Services and are located in the European Economic Area (EEA), United Kingdom (UK) or Switzerland.
If you are located in the EEA or UK, references to the “GDPR” below are references to the General Data Protection Regulation as it applies in the country where you are located. If you are located in Switzerland, the provisions of the Swiss Federal Data Protection Act (the “FDPA”) apply to you, and references to the GDPR below should be interpreted as applying to similar requirements under the FDPA.
last updated: 08 DEC 2022
Data Controller
Outschool, Inc., 2261 Market Street #4545 San Francisco, CA 94114, United States. Its EU and UK representative is DataRep who may be contacted at outschool@datarep.com.
The Teachers are considered co-controllers as they are independent contractors offering their services using our online platform.
Processing Purposes and Legal Bases
We collect the categories of personal data set forth in our Privacy Notice. In the Notice, we provide information on what information we collect on who, how we use it and why, but not to the specific detail that we do here aligning the purposes with the ruling law.. The following table outlines the purposes for which we process your personal data and the legal bases of such processing.
Purpose of Processing | Legal Basis and Legitimate Interest, if applicable |
Operate, provide, maintain, secure, troubleshoot and personalize our Services; Transmit your communications to other users of our Services at your instruction; Process payments related to our Services; and Perform our contracts with you. | We process your personal data for these purposes because doing so is necessary for us to perform a contract with you—specifically, the terms and conditions that apply to our Services—or take steps at your request prior to entering into the contract, per Art. 6(1)(b) of the GDPR. |
Perform our business operations, including billing, accounting, improving our Services and internal operations, securing our systems, detecting fraudulent or illegal activity, developing new services or features, and meeting our legal obligations; and Communicate with you to confirm registration and send Service-related updates, and provide customer support, security alerts, and other administrative messages. | We process your personal data for these purposes because doing so is necessary for us or third parties to pursue legitimate interests that are not outweighed by your privacy and other fundamental interests, per Art. 6(1)(f) of the GDPR (“Legitimate Interest Legal Basis”). Here, those legitimate interests are to provide you and other users of our Services with a good and safe experience, collect amounts owed to us, administer and enforce our contractual and legal rights, develop new services and features that we can offer to you and others, and manage our business operations and relationships with you and third parties. In addition, we are required to provide security protections for people who use our Services in terms of the security of personal information. This is also a legal obligation under Art. 6(1)(c). |
Send users marketing and advertising content where permitted by law, including messages about new and recommended classes, groups, events, and tailor such content to them. | We process your personal data for these purposes in accordance with your consent, per Art. 6(1)(a) of the GDPR. |
Conduct background checks if you wish to be a teacher or employee and determine whether to approve you. | We process your personal data for these purposes relying on the Legitimate Interest Legal Basis. Here, those legitimate interests are to ensure that the information you have provided in connection with your application is accurate. In some circumstances, we may also ask you to provide consent to allow the relevant sources (e.g., past employers and schools) to disclose the requested information with us depending on the requirements of applicable law. In these cases, we process your personal data in accordance with your consent, per Art. 6(1)(a) of the GDPR. Further, we have a legal obligation to maintain the safety of our child learners, part of which is to ensure we vet the teachers in charge of their activities and classes. |
Process any personal data about you that falls within the special categories that the GDPR enumerates—specifically, personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; genetic data or biometric data processed for the purpose of uniquely identifying a natural person; or data concerning health or data concerning a natural person’s sex life or sexual orientation (collectively, “Sensitive Data”). | We only process Sensitive Data for specific purposes where you have given us your explicit consent to do so, per Art. 9(2)(a) of the GDPR. Further, this data is not required to be provided and is voluntarily entered by the users. |
Disclose personal data as necessary to (i) comply with a legal obligation, (ii) protect and defend the rights or property of ours or those of our users, (iii) operate and maintain the security of our Services, including to prevent or stop an attack on our computer systems or networks, (iv) to protect the personal safety of users of our Services or the public, or (v) protect against legal liability. | We disclose your personal data for these purposes in order to comply with a legal obligation as well as for a Legitimate Interest Legal Basis. Here, those legitimate interests are to achieve the objectives listed in the left-hand column. |
Give effect to a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, sale of company assets, or transition of service to another provider. | We process your personal data for these purposes relying on the Legitimate Interest Legal Basis. Here, that legitimate interest is to effectuate a business transition that our management team considers to be advantageous to our business interests. Depending on the circumstances, we may also process the data for such a reason in order to comply with a legal obligation, such as government proceedings. |
Cross-Border Transfers
We operate our Services with the assistance of service providers in the United States and other countries, mostly Canada, UK, and Australia. If you consent to our use of third-party analytics and advertising cookies (see our Cookies Notice Page), our analytics and advertising partners will process your personal data primarily in the United States, Canada, and Australia. Where the EU or UK have not approved these countries as providing an adequate level of data protection, we take measures to ensure that service providers and other recipients in these countries provide an adequate level of data protection, such as by entering into appropriate data transfer agreements based on Standard Contractual Clauses that have been approved by the authorities of your country and performing data protection assessments of data transfer arrangements as appropriate.
You may also use our Services to communicate with Teachers, parents, or Learners in countries around the world. In these cases, we transmit your communications on your instructions and with your explicit consent. Some of these recipients may be in countries that have been deemed adequate by the authorities of your country, but some of these countries may not be deemed adequate and their data protection laws may differ from those in your country. You should be careful about what personal data you disclose to others on our Services.
Data Retention
In general, we store personal data only as long as necessary to fulfill the purpose for which we collected it (the “General Retention Period”), except in the following situations:
Where applicable laws require us to retain your personal data for a legally prescribed period beyond the General Retention Period, in which case we will keep that personal data for the legally prescribed time;
Where your personal data is relevant to potential legal claims by or against us, in which case we will keep that personal data for as long as the legal claims can be made or, if it has been made, for as long as the personal data is relevant to the resolution of the claims or any appeal thereto;
Where we are instructed by a court order, subpoena, or other legal directive to retain your personal data beyond the General Retention Period; and
Where we need a reasonable period of additional time to verify that the purposes for which we collected your data no longer apply and to delete the data following such verification.
If any of these exceptions apply to certain personal data, we will retain personal data for as long they apply. In general, we keep class video recordings for 90 days after the date of the applicable class, but recordings may be shared with Teachers and on to others as described in our Privacy Notice.
Do You Have to Provide Personal Data?
There is no law or contract stating that individuals in the EEA, UK, or Switzerland have to use our Services. We will try to tell you what personal data we need from you to provide certain Services or a certain level of quality of Services to you. In those cases, if you do not provide the personal data that we request from you, we will not be able to provide you with the Services or level of quality of Services that you request from us. That data which is optional will not be marked required, typically by an asterisk.
Your Rights
You have the following rights, subject to the conditions under the data protection laws that apply to you:
To object, on grounds relating to your particular situation, to the processing of your personal data by us. This includes the right to object to our processing of your personal data for direct marketing and the right to object to our processing of your personal data where we are performing a task in the public interest or pursuing our legitimate interests or those of a third party. If we process your personal data based on our legitimate interests or those of a third party, or in the public interest, you can object to this processing, and we will cease processing your personal data, unless the processing is based on compelling legitimate grounds or is needed for legal reasons. Where we use your personal data for direct marketing for our own products and services, you can always object and opt out of future marketing messages using the unsubscribe link in such communications.
To obtain from us confirmation as to whether your personal data is being processed, and, where that is the case, to request access to details about how we process your personal data and copies of the personal data.
To transfer or receive a copy of your personal data in a usable and portable format if we process it on the basis of your consent or a contract with you.
To obtain from us the rectification of inaccurate personal data concerning you.
To ask us to erase your personal data to the extent it is not required for legally required purposes.
To withdraw your consent at any time with future effect if we process your personal data on the basis of consent.
To request restriction of processing of your personal data, in which case, it would be marked and processed by us only for certain purposes.
In some jurisdictions such as France and Portugal, you also have the right to provide us with guidelines as to the processing of your personal data after your death.
When we are processing Personal Data on behalf of another party that is the “data controller,” such as certain relationships we have with schools, you should direct your request to that party. You also have the right to lodge a complaint with a supervisory authority, but we encourage you to first contact us with any questions or concerns. You may view a list of supervisory authorities in the EEA, UK and Switzerland and their respective contact information here:
EEA: https://edpb.europa.eu/about-edpb/board/members_en
United Kingdom: https://ico.org.uk/global/contact-us/
Switzerland: https://www.edoeb.admin.ch/edoeb/en/home/the-fdpic/contact.html
You can exercise your rights by submitting your request via our online Data Subject Request Portal.
