Who are we and what do we do?

Behaviour Smart is incident recording, reporting and behaviour management software for schools, Multi Academy Trusts (MATs), Children’s homes and Health Care Settings.

Behaviour Smart is registered with the Information Commissioner’s Office (ICO) under registration number ZB279718.

This Privacy Notice has been written to inform visitors to our website and prospective or current customers of Behaviour Smart about how and why we process your personal data. We will only collect and use your personal data in ways that are compliant with the applicable data protection legislation.

For data we collect via our website and to prepare and administer our services, Behaviour Smart is a Data Controller as defined by the UK GDPR.

We also process personal data in the capacity of a Data Processor when we provide services under a contract to clients, in accordance with their instructions. In these circumstances, the educational institution is the Data Controller under the UK GDPR. This means they are responsible for providing you with information about the use of your data, and who to contact to exercise your rights. Please refer to your institution’s Privacy Notice for further information.

Behaviour Smart has appointed Veritau as its Data Protection Officer (DPO). The role of the DPO is to monitor our compliance with the UK GDPR and the Data Protection Act 2018 and advise on data protection issues. If you would like to discuss this Privacy Notice or our use of your data, please contact our DPO using the below contacts details.

Data Protection Officer (Veritau)

[email protected]

/ 01904 552848

What personal information do we collect?

To provide our service we need to collect certain categories of information. This includes organisational information relating to your institution. However, we may also collect the following categories of personal data about you as a representative of the institution, which you provide when you register or use our services:

Full name, job title, address and contact details of the educational institution you represent.

Your feedback, compliments, complaints, and responses to any customer surveys.
Financial information in relation to your subscription payments.
Information collected via cookies when you visit or interact with our website (including IP address and other technical details).

Why do we collect your personal information?

We process your information for the purposes outlined below:
Providing our behaviour management system (including free trials).
Providing technical and administration support in relation to our service.
Facilitating access to our resources.
Collection of payments for our service and your subscription.
Responding to service enquiries and provide quotations etc.
Improving our products and services, through market research or the collection of feedback and customer survey responses.
Analysing traffic to our website, which helps us to improve our website.
Sending you newsletters and other marketing information from time to time. You can opt out of these at any time.

What is our lawful basis for processing your information?

Under the UK GDPR, we must have a lawful basis when processing personal information. We normally rely on Article 6(1)(f) Legitimate Interest.

To rely on the Legitimate Interests lawful basis, it is essential that we balance our organisation’s interests against the rights and freedoms of individuals. Therefore, we only rely on Legitimate Interests when we are using your data in ways you would reasonably expect.

For non-essential cookies, we rely on Article 6(1)(a) Consent.

Where we act as a Data Processor, the educational institution determines the lawful basis for processing.

Who do we obtain your information from?

We normally receive your personal information directly from you or your educational institution. We do not collect personal data from other third parties.

Who do we share your information with?

We do not share information with any other Data Controllers (external organisations).

We may share your personal data with service providers who provide IT and system administration services, or who store data on our behalf. We ensure that data processing contracts are in place with any service providers ensuring compliance with the relevant data protection legislation.

How long do we keep your personal data for?

We will retain your personal information for the duration that we provide our service to you. Any personal information which we are not required by law to retain, will only be kept for as long as is necessary to fulfil its purpose.

How do we keep your information secure?

Behaviour Smart is Cyber Essentials certified.

We have implemented technical and organisational measures to safeguard information and keep information secure.

We regularly review our information security policies and measures and improve them where necessary. We also conduct regular testing and reviews of our measures to ensure they remain effective. We also ensure that the data processors we use have appropriate technical and organisational measures.

International transfers of data

Although we are based in the UK, some of the digital information we hold may be stored on computer servers located outside the UK. Some of the IT applications we use may also transfer data outside the UK.

Normally your information will not be transferred outside the European Economic Area (EEA), which is deemed to have adequate data protection standards by the UK government. In the event that your information is transferred outside the EEA, we will ensure your data is protected and appropriate safeguards are in place in accordance with the UK GDPR.

Usage of Artificial Intelligence (AI)

We do not use AI to process personal data in our capacity as Data Controller.

Behaviour Smart AI is our behaviour management tool, powered by Artificial Intelligence (AI). We use AI to help you with the behaviour and incident management process in our capacity as a Data Processor. We do not undertake any further processing on the data provided by our clients.

To provide our Behaviour Smart AI tool, we have appointed OpenAI as a Sub-Processor.

You can find further information about the AI tool

here

.

Web Analytics

Web analytics is the collection and analysis of the data generated when people visit and use a website. This helps the website owner understand the method by which individuals found the website, how they access the website, the number of visitors to various parts of the website, the time they spend on the website, if they return to the website and their IP address.

What cookies do we use?

A cookie is a small file of text that may be saved on the memory or storage of your electronic device (computer, phone, or tablet etc) when you visit a website. Cookies are used to improve the way the website works and can be used to remember the information you have provided, so that you do not have to re-enter it whenever you visit a new page.

Two types of cookies are typically used:

Session cookies: these are temporary and are removed when you close your browser or leave a website. These are used to remember visitors as they move from page to page on a website.

Persistent cookies: these remain on your device for much longer, even after you close the browser or restart the device. These remain until you remove them, or they expire, which can be up to 12 months. They are typically used to store information such as your name, language preferences or login information.

We use cookies to:
Distinguish you from other users of our website and provide a good experience.
Remember the information you have entered while on our website.
Find out how you use our website, so that we can improve it.

Consent for cookies

Not all cookies require consent. Those which are required for the operation of the website, known as ‘strictly necessary’ cookies do not require consent. Without these cookies the website cannot work as designed.

Other types of cookies do require consent. These include:
Analytical or performance cookies, which are used to help us improve the website.
Advertising or marketing cookies, which are used to target advertising on a website.

When you first visit our website using a new browser we will provide you with a cookie’s permission banner, seeking your consent to the use of certain cookies.

You can change your cookie preferences at any time through our cookie banner, but please be aware that opting out of cookies may affect your user experience on our website.

What rights do you have over your data?

Under the UK GDPR, individuals have the following rights in relation to the processing of their personal data:
to be informed about how we process your personal data. This notice fulfils this obligation.

to request a copy of the personal data we hold about you.
to request that your personal data is amended if inaccurate or incomplete.
to request that your personal data is erased where there is no compelling reason for its continued processing.
to request that the processing of your personal data is restricted.
to object to your personal data being processed.

If you have any concerns about the way we have handled your personal data or would like any further information, please contact us at

[email protected]

If we cannot resolve your concerns then you may also complain to the Information Commissioner’s Office, which is the UK’s data protection regulator. Their contact details are below:

Phone: 0303 123 1113 or via their

live chat

. Opening hours are Monday to Friday between 9am and 5pm (excluding bank holidays). You can also report, enquire, register and raise complaints with the ICO using their web form on

Contact us | ICO

Changes to this notice

We reserve the right to change this Privacy Notice at any time. We will normally notify you of changes that affect you. However, please check regularly to ensure you have the latest version.

This Privacy Notice was last reviewed in October 2024.