This privacy policy outlines how we collect and use your personal data when you access this website. We may occasionally amend this policy by updating this page.

The Flex toolkit is available for schools to use. Schools are the data controllers and the University of Exeter is the data processor. By this, we mean that the data that you choose to enter into the Flex toolkit is processed by us at the University on the Flex website, along with files on our servers that contain your login details and contact email, which we use to set up your account.

 

Analytics

This website uses Google Analytics, a web analytics service that enables us to monitor how our site is used. Information about your use of our website is transmitted to Google; however, this data does not enable you to be identified and is not considered privacy intrusive.

Users of most popular web browsers can install a browser add-on that prevents data being transferred to Google.

Embedded content

Pages on this site may include embedded content (e.g. audio or video) from third-party websites. Embedded content behaves in the same way as if you have visited the third-party website. These websites may collect data about you, use cookies, embed additional third-party tracking and monitor your interaction with the embedded content.

Server logs

In common with most websites we automatically log certain information about every visit to the site. This includes your IP address and information relating to your requests from our servers, for example date and time, referrer, user agent, request type and details of request size. This information is used to help us manage the website and where necessary to investigate potential misuse or breaches in regulations.

What data do we hold?

We will hold the name and email address of the person who purchases the license for your school, as well as the school name and address. If the SENCO is not the person who buys the license, we also require their contact information (email address) as they will hold the main account for each school.

All other data held is that which the school enters directly into Flex, for example child and teacher/class names, and answers to the “Know Me” activity as well as goals and targets set, and modules and strategies activated.

Deletion of data

When your license is due to expire, we will let you know. Should you choose not to renew your license we will delete your data manually within two weeks of your license expiring.

Schools are responsible for deleting data of students who leave the school or who you are no longer using Flex with. You are easily able to delete data within Flex- using the SENDCo login and admin tool you are able to remove teachers and students (and therefore their associated data). You can also email us at any time to request deletion of specific data on the toolkit: contact toolsforschools@exeter.ac.uk

How do we protect your data?

The University of Exeter shall implement and maintain appropriate technical and organisational measures to protect personal data processed through the Flex Toolkit against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.

Such measures shall include, as appropriate:

• User authentication through unique usernames and password-protected accounts;
• Role-based access controls restricting users to information required for their authorised functions;
• Secure transmission of data using industry-standard encryption protocols;
• Secure hosting and storage environments with access limited to authorised personnel;
• Procedures for the regular monitoring, review and testing of security controls;
• Secure backup and recovery processes designed to maintain availability and resilience of services;
• Logging and monitoring of administrative access where appropriate;
• Staff training and confidentiality obligations for personnel with access to personal data; and
• Processes for identifying, reporting and managing personal data breaches in accordance with applicable data protection legislation.

The University shall ensure that any person authorised to process personal data is subject to a duty of confidentiality and shall take reasonable steps to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services.

 

School Responsibilities

The School shall ensure that:

• User accounts are only provided to authorised members of staff;
• Passwords are kept confidential and not shared;
• Personal data entered into the Flex Toolkit is accurate, relevant and limited to what is necessary for the educational support of pupils;
• User accounts are promptly disabled when staff leave employment or no longer require access; and
• Any suspected security incident, unauthorised access or personal data breach relating to the Flex Toolkit is reported to the University without undue delay.

 

Your rights and preferences

You have the right to request access to your data within Flex at any time. Requests should be emailed to informationgovernance@exeter.ac.uk  with the heading “Flex toolkit subject access request” and can only be submitted to the university by individuals who hold toolkit login details.  

The following should be included: 

• a subject line or header that says "subject access request"; 

• date of request; 

• your name (and any other names where relevant) 

• your email address, home address and phone number; 

• toolkit login name 

• what personal information you want (be specific about the information you’re asking for, and where relevant say what information you don’t need); 

• details or dates that will help the organisation find the information you want

• the reason you want the information (you don't have to include this but it will help the organisation find what you need); and 

• how you would like to receive the information (eg electronically or printed and sent by post) and if you have any accessibility requirements (eg large fonts). 

 

Within 30 working days, all data relevant to your request will be provided. 

Parents of pupils at a school wishing to access any data entered relevant to their child should log a request with the school. 

 

Legal basis

The Flex toolkit is processing special category personal data because it stores information relating to children who have ADHD or ADHD traits, as well as behavioural goals, strengths, and progress data that may reveal information about a child's health or developmental condition. Under UK GDPR, data concerning health is special category data and requires additional protections and a valid Article 9 processing condition - Article 9 -  Article 9(2)(g) UK GDPR (substantial public interest), together with Schedule 1 DPA 2018 safeguarding-related provisions.