English

Español

Waterford.org Privacy Policy

Last updated: August 5, 2020

Waterford Research Institute, LLC (“Waterford”) provides advanced educational software— blending the best aspects of high quality educational content, learning science, mentoring relationships, and innovative technologies to form community, school, and home programs that deliver excellence and equity for all learners. Waterford has specific programs that range from complete home-centered kindergarten readiness, to educational tools for parents of school children, to classroom curriculum and online programs operated by teachers within their school. Our learning science enables individuals to learn at their own pace and tailoring for individual capability and learning styles. Waterford supports its educational software with related services, including personalized curriculum recommendations, research-based learning solutions, automated tracking of student progress, and reports for the parent, teacher, or learning facilitator who is overseeing student learning.

Waterford respects your privacy and takes safeguarding personal data seriously. Please read the following to understand the privacy practices of Waterford, which cover all Waterford websites, software applications, mobile apps, including Waterford Reading Academy, Waterford Early Learning, Classroom Advantage, SmartStart, Curriculet, and UPSTART, our mobile apps MyBackpack and Mentor, our Subscription Services (as defined in our Subscription Services agreement), and our websites: www.waterford.org; www.waterfordupstart.org; and our Waterford Teacher Training Hub at https://waterford.digitalchalk.com/dc/guest/login (collectively “Digital Media”).

Personal Data We Process

We process the personal data of data subjects, including: students, parents, guardians, educators, representatives of educational institutions, representatives of entities, and individuals identified during registration, which we may refer to more generally as “Customers.”

We process the following categories of personal data: contact information, student progress, student reports, student learning difficulties and impairments, device information, information relevant to learning advancement such as language, culture, age and other characteristics, Subscription Service use and service information, internet use information and regulatory information (to satisfy regulatory obligations such as tax and other reporting obligations).

This information includes specific data elements such as name, student ID, grade, class, as well as such optional identification information such as gender, email address, physical address, birthday, ethnicity, primary language, disability, special programs, and picture.

To set up our Digital Media, you may need to create districts, schools, and classes, as well as add teachers, administrators, and create student profiles. In these cases, you may be asked to provide the following information:

  • District, school, class, administrator, and teacher names and contact information;
  • Security information, such as usernames, passwords, and security questions;
  • Student profile information such as name, unique student ID, grade, and class, gender, contact email, birthday, ethnicity, primary language, disability, special programs, and a student picture (some information may be required for specific programs or to comply with requirements established by the funding source or local regulations).

Other information we collect may include the following:

  • Social and contact information (e.g., address, email and phone number)
  • Geographical information (i.e., your location down to the city level) in order to map usage trends;
  • Basic technical data including your operating system, browser, network, and device type (desktop, tablet, or mobile phone) in order to optimize our Digital Media and your user experience;
  • Usage data including assessment scores, curriculum progress, usage time, activity start and end time, historical sessions, and time to load; and
  • IP address in order to determine the frequency with which our visitors look at various parts of our sites and to administer our Digital Media. The IP address is also used to gather demographic information such as geographic distribution of our visitors and may be used to allow us to provide goods and services appropriate to your location of residence.

We may process your personal data with or without automatic means, including collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction of your personal data. Please note we may combine the personal data that you give us with publicly available information and information we receive from, or cross-reference with, our technical analysts, data analysts, administrators, education providers, and others.

We may also collect additional personal data about you from our third-party services providers (e.g., the Apple® App Store® or the Google PlayTM store) who provide us with e-commerce and/or technical related services/support associated with the functionality and purposes of the Digital Media. Where the Digital Media is available as a mobile application, the application is downloaded from Apple’s App Store or Google Play and may be subject to the Privacy Policy and Terms and Conditions of Apple and Google respectively.

Tracking Technologies, Cookies and Clear GIFs

We use tracking technologies, cookies and clear GIFs to collect information. Tracking technologies are used to collect information from your web browser through our servers or filtering systems when you visit any of our sites.

Cookies store small text files onto a user’s computer hard drive with the user’s browser, containing the session ID and other data. Cookies enable a web site to track a user’s activities on the website for the following purposes: (1) enable essential features; (2) provide analytics to improve website performance and effectiveness; (3) store user preferences; and (4) facilitate relevant targeted advertising on advertising platforms or networks. Users are free to change their web browsers to prevent the acceptance of cookies. Cookies may also be set within emails in order to track how often our emails are opened.

A clear GIF is a transparent graphic image placed on a website. The use of clear GIFs allows us to monitor your actions when you open a web page and makes it easier for us to follow and record the activities of recognized browsers. Clear GIFs are used in combination with cookies to obtain information on how visitors interact with our websites.

Information collected may include but is not limited to your browser type, your operating system, your language preference, any referring web page you were visiting before you came to our site, the date and time of each visitor request, and information you search for on our sites. We can also track the path of page visits on a website and monitor aggregate usage and web traffic routing on our sites. We collect this information to better understand how you use and interact with our sites in order to improve your experience. We also collect this information to better understand what services and marketing promotions may be more relevant to you. We may also share this information with our employees, service providers, business partners and affiliates.

You can change your web browser settings to stop accepting cookies or to prompt you before accepting a cookie from the sites you visit. If you do not accept cookies, however, you may not be able to use some sections or functions of our sites.

To find out more about cookies, including how to see what cookies have been set and how to manage and delete them, visit http://www.allaboutcookies.org.

To opt out of being tracked by Google Analytics across all websites visit https://tools.google.com/dlpage/gaoptout.

Purposes for Processing Personal Data

We process personal data for purposes related to our Digital Media, including licensing and operation of the Subscription Service and Products, consultation for student education progress, training, communication, Customer service, system monitoring and data security. We process donations received from individuals and entities. We also process personal data in order to expand access to our Digital Media, including communication with organization representatives for funding and potential expansion opportunities. In addition, we process personal data for our business purposes including, research, analytics, products and service improvement, security monitoring, business operations and administration, tax, and other regulatory requirements.

We process personal data to enable use of Digital Media features, including through use of third-party service providers. We also use personal data to communicate with you for marketing purposes, such as to offer opportunities to donate to Waterford. We may also use personal data for internal purposes, including auditing, data analysis and system troubleshooting.

We inform you of new products, services, contests, promotions, or other special offers that might be of interest to you or benefit you from time to time (collectively “Special Events and Offers”). When you register through the Digital Media, you consent to receive communication about Special Events and Offers. In connection with Special Events and Offers, we may ask for contact information or demographic information. If you chose to participate, we will contact you when necessary and pursuant to the terms and conditions specified when you signed up for, or participated in, the Special Event or Offer. Any personal data gathered by Waterford is used solely by Waterford or other entities and affiliates that are involved in the Special Events and Offer. If you would like to stop receiving information about Special Events and Offers from Waterford, please see the “Personal Data Rights” section of this Privacy Policy.

We base our processing on the necessity to perform our contractual obligations under the Subscription Agreement and our legitimate interests in performing the activities of the organization as a provider of educational software and related services. We also process personal data in compliance with our obligations under applicable law and to exercise our legal rights. Where we process the personal data of minors we require the Customer to obtain the requisite consent from the parent or guardian of the minor.

Sharing of Personal Data

We share your personal data with other parties in the following circumstances:

  1. Subprocessors. We use third-party service providers to process personal data to facilitate your use of the Digital Media or the operation of our business (“Subprocessors”). We may provide personal data to third parties for their processing in performing functions on our behalf (for example payments, security, data analysis, surveys, website administration, technical support, and so forth). The third party may also collect credit card or debit card information. These third parties may share your personal data with their affiliates or services providers whom they engage to perform services related to the Digital Media or the operation of our business. In such instances, the third party providers will be contractually required to protect personal data from additional processing (including for marketing purposes) and transfer in accordance with this Privacy Policy, the Subscription Agreement and applicable laws.Under certain data protection laws, including the EU General Data Protection Regulation (“GDPR”), we are liable if a Subprocessor that we have engaged to process personal data fails to fulfill its data protection obligations.
  2. Parents, Guardians, Teachers, and Learning Facilitators. Our programs are administered by individuals who oversee the learning of the student. Depending on the program, this may be a parent, guardian, teacher, or other learning facilitator such as one of the parents or guardians assigned to administer the program for a group of students within a community.
  3. Research. De-identified personal data may form part of our valuable research and be included in publications.
  4. No Sale of Personal Data. We never sell personal data to third parties, but we expressly reserve the right to disclose aggregated user statistics such as “45 percent of our users are educators” or “5,000 members indicate an interest in science lessons,” as well as non-personally identifiable information (such as anonymous usage data), in order to describe our services to prospective partners, licensees, advertisers, and other third parties.
  5. Legal Requirements. We may access and disclose your personal data to regulatory bodies if we have a good-faith belief that doing so is required under regulation or in order to defend and protect our legal rights. This may include submitting personal data required by tax authorities. Additionally, we may disclose your personal data and other information as required by law, including in response to lawful requests by public authorities, including law enforcement and judicial authorities.

Transfer and Storage of Personal Data

We may transfer, process and store personal data collected from our Digital Media in centralized data centers and with service providers in the United States, cloud storage solutions, or on our premises. We implement standard data protection clauses with our third party service providers to ensure adequate protection of personal data transferred from the European Economic Area (“EEA”).

Our software and mobile apps are cloud based. This means they are stored in and run from the cloud, specifically an Amazon Virtual Private Cloud (“VPC”). Amazon VPC guarantees the security and privacy of its VPC. The Amazon servers we utilize are hosted in the USA and in Asia. For more details, visit https://aws.amazon.com/vpc/. In addition to secure cloud storage, internal access to your personal data is restricted to authorized users (for example, the premium support team) and is only available through a secure tunnel between Waterford’s networks and Amazon’s VPC network. While in our database, select personal data is encrypted (such as student names and birthdays) and usage data is linked to students using internal identifiers. All database access requires authentication, and the back-end services restrict database access at the profile level. Also, our database is set up using Amazon Relational Database Service, which provides security and daily back-up snapshots to aid in case of disaster recovery.

Personal Data Security

Waterford uses technical and organizational measures to protect the personal data that we store, transmit, or otherwise process, against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data transmitted, stored or otherwise processed. Our security controls and risk management program and processes are designed to implement appropriate technological and organizational measures to ensure a level of security appropriate to the risks. We regularly consider appropriate new security technology and methods as we maintain and develop our software and systems. Security measures implemented include:

  1. Web and database servers are protected using firewalls;
  2. Passwords used for account registration require minimum password strength attributes;
  3. User access is tracked;
  4. Role-based security is applied to system access;
  5. Use of data encryption;
  6. Use of RC4 256-bit Transport Layer Security (TLS) technology where Customer data traverses public networks;
  7. Vendor-supplied patches are reviewed and tested for compatibility before installation;
  8. Regular system backups are made;
  9. Regular maintenance is performed on systems;
  10. Systems are monitored for security;
  11. Data requiring a higher level of protection, such as payment card account numbers, are processed via a third-party vendor that specializes in the payment processing;
  12. Security assessments are performed on third-party vendors with access to personal data;
  13. All Waterford employees are contractually obligated to maintain the confidentiality of personal data accessible through their employment; and
  14. All Waterford employees are required to attend regular security and awareness training.

Retention of Personal Data

Waterford processes personal data on behalf of its Customers and may retain the personal data for the period of the Subscription Agreement. In some instances, users have an option to update or delete personal data through Digital Media features. Upon termination of the Subscription Agreement, Waterford reserves the right to delete associated personal data.

Waterford does not guarantee the ability to restore data that has been removed from its database server. Waterford retains certain data that has been pseudonymized for historical reporting and statistical and research purposes.

Waterford also collects and processes personal data for its own purposes. This personal data is retained for a reasonable period of time to fulfill the processing purposes mentioned above.

Personal data will only be further retained as allowed under applicable law or required under regulatory provisions mandating record retention, including tax records and transaction history. When archival is no longer required, personal data is deleted from our records.

We periodically review our retention policy to ensure compliance with our obligations under data protection laws and other regulatory requirements. We periodically audit our databases and archived information to ensure that personal data is only stored and archived in alignment with our retention policy.

Personal Data Rights

We rely upon our Customers maintaining the accuracy of the personal data they provide by accessing and updating their account profile. Our Digital Media gives Customers the ability administer user accounts and to add, edit and delete account contact information. Under certain data protection regulations, including the GDPR, individuals have certain data subject rights regarding their personal data.

Individuals in the EEA have certain data subject rights which may be subject to limitations and/or restrictions. These rights include the right to: (i) request access to and rectification or erasure of their personal data; (ii) obtain restriction of processing or to object to processing of their personal data; and (iii) ask for a copy of their personal data to be provided to them, or a third party, in a digital format. If you wish to exercise one of the above-mentioned rights, please send us your request to the contact details set out below. Individuals also have the right to lodge a complaint about the processing of their personal data with their local data protection authority.

For email communication of a marketing nature, an ‘unsubscribe’ option is provided in the footer of every email. In addition, we may be contacted directly to unsubscribe. Our contact details are provided at the end of this Privacy Policy.

Please note that as a non-profit organization, certain regulations, such as the California Consumer Privacy Act of 2018, do not apply. However, we have a policy of honoring and respecting the requests of all data subjects when it is reasonable and practical to do so and does not place an undue administrative burden on our organization. Therefore, we invite you to submit your requests to us, which we will review and respond to at our discretion. You may also contact us for assistance in modifying or updating your personal data. Our contact details are provided at the end of this Privacy Policy.

Effective Date and Amendments

This document is effective as of the date indicated at the top of this Privacy Policy under “Last

Updated.” Waterford may amend this document from time to time.

Contact Information

Inquiries may be made to:

Waterford Institute, LLC
Attn: Data Privacy Agent
1590 East 9400 South
Sandy, Utah 84093 USA

dataprivacy@waterford.org

Waterford Research Institute, Romania
Attn: Data Privacy Agent
96 Memorandului Street
Timisoara, Timis County
Romania

dataprivacyro@waterford.org
Main Menu
Register for Upstart
Login
Back to top