At Lexplore Analytics we have standardised policies and procedures to ensure that the data we process following our assessment service is protected in accordance with Data Protection Regulation, Cyber Security Law and our registration with the ICO. For our assessment service we process personal data for:
- The designated contact person at the school.
- Users of the Results Portal.
- Pupils tested during the assessment service.
Who is the personal data controller?
The customer is the data controller. They determine what data is extracted, what purpose it is used for and who is allowed to process the data. Lexplore Analytics is the processor of the data made available by schools in our assessment software. Lexplore is trusted with such personal data but does not control it.
As the designated contact person at the school, we process the following personal data about you:
- System authorisation
- Telephone number
- Email address
- Details of your employer
The processing of the above personal data is necessary to enable our subsidiaries or distributors to perform the agreement they have with the Customer. In the event such data is not provided, the agreement with the Customer cannot be performed. Processing is undertaken based on the of the performance of that contact or our legitimate interests. Your name and contact details are stored in our register of contact persons for the duration of the contractual relationship with the Customer or for such time as we otherwise require the information for any circumstance associated with the contractual relationship with the Customer. In the event your employment with the Customer terminates or you otherwise cease to be a contact person for the Customer, we will remove your data from our register of contact persons.
Your data (e.g. your name) may occur in agreements correspondence or other documentation regarding the relationship with the Customer which must be stored for commercial, business or legal reasons. The information is stored applying a balancing of interests, in which our legitimate interest is to store information and documentation which is of commercial, business or legal importance for our operations.
We may also store your personal data for an extended period of time if necessary to perform a legal obligation which requires processing according to applicable law, or to enable us to establish, assert or defend legal claims.
We and our subsidiaries also process your email address in order to distribute marketing. In such a case, the marketing is directed at the Customer and based on the type of services that the Customer has previously purchased and which we believe to be relevant for you in the exercise of your profession. The marketing is sent for up to five years after the Customer’s most recent purchase. Newsletters and marketing emails are sent only on condition that you have not expressed opposition to such marketing and you are entitled, at any time, to deregister from our newsletter and marketing emails. To deregister, kindly contact us at firstname.lastname@example.org. or use the deregistration link stated in each newsletter/email. Marketing takes place with a balancing of interests as a legal ground, in which our legitimate interest is to market and provide information about our products.
As a user of the Results Portal, we process the following data about you:
- System authorisation
- Telephone number
- Email address
- Details of your employer
The information is processed to enable you to use the Results Portal. Your name and your authority role are used to enable the Customer to see which users are in the Results Portal. The details of your employer are used to allocate correct authorisation. Your email address is used as your unique login name and your telephone number is used solely to facilitate secure login using two-stage authorisation.
We also process data about your activity in the Results Portal, referred to as user data as follows:
- System authorisation
- Date of most recent login
- Performed administrative measures
- User log (incl. time, city and country, IP address and information regarding your entity, including browsers)
Your role is associated with the organisation, school or class for which you use the Results Portal and decides which authorisation you possess. Other data is processed to enable the Results Portal to function in the best manner. By processing such data we are able, among other things, to follow up if something goes wrong or if the Results Portal has in some way been misused.
Your data is stored for the duration of the contractual relationship with the Customer and during the period in which we provide results to the Customer via the Results Portal. In the event your employment with the Customer terminates or you otherwise cease to be a user of the Results Portal, your data will be deleted/anonymised.
We and our subsidiaries also process your email address in order to distribute marketing. In such case, the marketing is directed at the Customer and based on the type of services that the Customer has previously purchased and which we believe to be relevant for you in the exercise of your profession. The marketing is sent for up to five years after the Customer’s most recent purchase. Newsletters and marketing emails are sent only on condition that you have not expressed opposition to such marketing and you are entitled, at any time, to deregister from our newsletter and marketing emails. To deregister, kindly contact us at email@example.com or use the deregistration link stated in each newsletter/email. Marketing takes place with a balancing of interests as a legal ground, in which our legitimate interest is to market and provide information about our products.
Pupils tested during the assessment service
The Organisation processes the following personal data about the Pupil:
- Personal ID number
- Information about the school and class
- Eye movement recordings
- Audio recording
- Test results
- Comments about the Pupil
On each test occasion the Pupil, together with a person appointed by the Organisation, carries out the test by reading a text on a computer screen. The computer temporarily stores the eye movement recording and audio recording connected to a unique Lexplore ID, which is subsequently automatically uploaded to the cloud where the test is analysed.
The test results are thereafter processed in Lexplore’s results portal (the “Results Portal”). The Pupil’s name and personal ID number are processed to ensure that the test results, i.e. reading ability, can be linked to the correct pupil. Personal ID numbers are used to ensure that requirements for secure identification are satisfied. Data regarding the Pupil’s school and class is processed to enable authorised personnel within the Organisation to access their results.
Data regarding the Pupil’s gender and birthdate must be processed in order, among other things, to enable the Organisation to draw conclusions regarding the Pupil’s reading ability compared with other pupils, and thereby to be able to determine whether there is a need for special support measures.
In the Results Portal, there is a possibility for the Organisation to write a comment in connection to the Pupil. Comments take place in free text and may, e.g. contain information regarding implementation of the test and any circumstances which might have affected the quality.
Access to the Pupil’s data is restricted to authorised personnel appointed by the Organisation, which may include e.g. the head teacher, the pupil’s teachers, special needs educators, etc.
With whom might we share personal data?
The Organisation transfers the pupil’s personal data to Lexplore AB, org. nr 559069-1811, Tegelbacken 4A, 111 52, Stockholm, 0702487646; Lexplore Analytics Limited (a company registered in England and Wales, company number 11121766 of Suite 8 Bowden Hall Marple, Stockport, England SK6 6ND; and Lexplore Nordic AB Reg. No. 559091-9212, Tegelbacken 4A, 111 52, Stockholm, (together “Lexplore Companies”). Lexplore Companies process the Pupil’s personal data on behalf of the Organisation in connection with performance of a service for the Organisation. All personal data about the Pupil is encrypted when stored and processed by Lexplore Companies.
In addition, Lexplore Companies may anonymise the data collected and use the anonymised data in order to aggregate it with other data such that it can be used in order to improve our Services (and the AI underlying them) for the benefit of future users of the Services. In such cases, Lexplore Analytics will take on the role of data controller. The lawful basis on which this personal data is processed is entirely from your consent (this consent may have been given by your parent or guardian). In such cases, forms should have been given to you by our Customer for you (or your parent or guardian) to sign.
The Organisation can also provide the Pupil’s personal data to public authorities if we are obliged to do so by law.
Where do we process personal data?
The Pupil’s personal data will be processed only within the EU.
How long do we store personal data?
The Organisation stores the Pupil’s personal data within the scope of its tests and follow-up of the test results for as long as the Pupil is a part of the survey, typically throughout their years of schooling. The reason for storing the information during this period is that it is needed to be able to monitor the change over time and to achieve as good a result as possible in terms of implementation of any support measures.
In the event the Organisation terminates a service or the consent is revoked, the Pupil’s data will be anonymised. In the event the Pupil switches to a school outside the Organisation’s local authority, the Pupil’s data will be anonymised.
The Pupil has certain statutory rights which the Pupil’s parent or guardian is entitled to assert against the Organisation. A summary of those rights is presented below. For complete information about the Pupil’s rights, kindly see the Data Protection Regulation, Sections 3–5.
- Right of access/register extract. The Pupil is entitled to receive a reply as to whether the Organisation processes her/his personal data. If such is the case, the Pupil is entitled to information as to which personal data is processed, the purpose of the processing, which external recipients receive your personal data and how long the Organisation stores your personal data.
- Right of data portability. The Pupil is entitled to receive a copy of the personal data that the Pupil has personally provided to the Organisation in a structured, generally usable and mechanically readable format. The Pupil is also entitled to request that the Organisation transfer its personal data to another personal data controller. Analyses and results of analyses are not covered by data portability.
- Rectification of incorrect data. The Pupil is entitled to request that the Organisation rectify incorrect or incomplete information.
- Deletion of certain data. The Pupil is entitled to request that the Organisation delete the Pupil’s personal data.
- Right to object to the Organisation’s processing of personal data. The Pupil is entitled, under certain conditions, to object to the Organisation’s processing of your personal data.
- Right to restrict processing of your personal data. In certain cases, the Pupil is entitled to request a restriction on the Organisation’s processing of your personal data.
- Complaints. If the Pupil has any complaint regarding the Organisation’s processing of her/his personal data, the Pupil is entitled to submit a complaint to the Privacy Protection Authority.
In the event the Pupil’s parent or guardian wishes to submit a request for a register extract, data portability, rectification, deletion, objection or restriction, kindly contact the Organisation on firstname.lastname@example.org.