PRIVACY POLICY

1. Commitment

We at Vretta consider the privacy of your personal and sensitive information (together referred to as data in this Privacy Policy), which you share with us on our online platforms, to be of utmost importance. We are committed to protecting your data whether you are engaging in learning, conducting business with us electronically, or simply browsing our websites for information. As such, we have developed this Privacy Policy for you to understand how we collect, communicate, disclose,and make use of your data. Our commitment to ensuring privacy of your data is as follows:

• We will collect and use your data solely with the objective of fulfilling those purposes specified by us, or by any organization, ministry of education (or their agency), or academic institution with which we have agreements.
• We undertake to collect your data solely by lawful and fair means.
• We will not share your data with any third party, except as necessary to provide you with the services and products you have requested, or to comply with the law.
• We will not sell or rent your data under any circumstances.

Your rights are very important, and we are committed to being transparent about our use of your data.

2. Data Collection

We offer our products and services to organizations, ministries of education (and their agencies), and academic institutions (referred together as entities or our partners in this Privacy Policy). These entities are Controllers of the data that we collect. It is through these entities that students, educators, and administrators have access to our platforms. The Controllers instruct us on the means and purpose of processing the data. We are called the Processors of the data.

We have established protocols to handle data processing. Just as we guarantee the confidentiality and security of data, you can be assured that at the end of our service any data processed will be erased. Additionally, should a data breach occur, we will immediately report the event and its details to our data controller upon its identification.

We have a team of highly specialized data personnel responsible to process data and to ensure that we are fully compliant with data protection regulations. Our data team monitors data integrity, accuracy, and confidentiality and performs regular security reviews. The team keeps a record of all processing activities. When an inaccuracy is discovered the data is updated without undue delay.

Our Data Protection Officer (DPO) keeps our management updated on data protection responsibilities, risks, and issues. Our DPO also deals with access requests and approvals of any contracts with third parties that handle sensitive data. Since we handle large amounts of data on a regular basis, our DPO oversees our compliance with various data laws, including the General Data Protection Regulation (GDPR) of the European Union (EU) and the European Economic Area (EEA), the Personal Information Protection and Electronic Documents Act (PIPEDA) of Canada, and the Family Educational Rights and Privacy Act (FERPA).

When you access our website and platforms, we may collect the following information based on the requirement of the Controller:

• Personal Information: When you use our products, as instructed by your organization, ministry of education (or their agency), or academic institution, we may collect personal information such as your first name, last name, email address, phone number, and/or mailing address. In some cases, we may be instructed by the Controller to collect sensitive information. Any personal or sensitive information that is collected by us is in full compliance with the data protection regulations as per the data law of the jurisdiction we serve.
• Credentials: We collect usernames of users participating in our system.
• Device Data: Some of our products collect information on the version of the device, or operating system you are using while interacting with our products, the type of browser you are using, and your IP address.
• Language Data: If you are using any of our products that are provided in multiple languages, we collect data on the language of the application being used, as well as when the language is changed.
• Activity Data: We collect data about which components of the product you have used, how long you spend on them, whether you have completed them or not, and your scores on the questions that you have attempted.
• Other Data: We collect (and receive from the Controller) other administrative information such as your institution name, class name, professor/teacher name, and grade level. Some of our services require us to collect survey information on your level of education as instructed by the Controller.

Further, we acknowledge that we are designated as a “school official” with “legitimate educational interests” in your data and associated metadata, as those terms have been defined under FERPA and its implementing regulations, and we agree to abide by the limitations and requirements imposed by 34 CFR 99.33 9(a) on school officials. We will use your data only for the purpose of fulfilling our duties under this agreement and will not monitor or share such data with or disclose it to any third party except as require by law, or as authorized in writing by you.

3. Cookie Policy

We use cookies to enhance your browsing experience on our website and to provide functionalities that meet your needs. Cookies are small text files stored on your device (computer, tablet, or mobile phone) when you visit a website. They help us remember your preferences and ensure the smooth operation of our site.

For detailed information about the types of cookies we use, their purposes, and how you can manage your cookie preferences, please refer to our full Cookie Policy.

If you have any questions or concerns about our cookie use, please email our Data Protection Officer at dpo@vretta.com.

4. Data Protection

We are committed to protecting your data by utilizing security safeguards against loss, theft, unauthorized access, disclosure, copying, and unauthorized use or modification. We keep data confidential, accurate, and available when needed, and review our data protection measures on a regular basis. The data is stored on secure cloud servers that have stringent security standards which are regularly audited to maintain the following industry leading certifications: Cloud Security Alliance Controls, ISO 9001 (Global Quality Standard), ISO 22301 (Security and Resilience), ISO 27001 (Security Management Controls), ISO 27017 (Cloud Specific Controls), ISO 27701 (Privacy Information Management), ISO 27018 (Personal Data Protection), SOC 1 (Audit Controls Report), SOC 2 (Security, Availability, & Confidentiality Report), and SOC 3 (General Controls Report). The cloud servers are located in jurisdictions that fully comply with the data security requirements as specified by our Controllers and the related data laws of their respective jurisdictions.

4.1. Data Management Framework

Our Data Management Framework details our policies concerning the usage, storage, dissemination, and deletion of all data we collect. If you would like to know more, download our Data Management Framework by clicking the link below.

5. Data Use

We design, develop, and deliver educational assessments and learning products. Our contracts/agreements are with organizations, ministries of education, and academic institutions, through whom we provide our products and services to their students, educators, and administrators (together referred to as users) at primary, secondary, and post-secondary educational institutions and training organizations.

The data that is collected from the use of our products and services is used to serve the educational goals of our users. It is also used to enhance their learning and assessment experiences on our platforms. We may use account information being provided to connect teachers to the progress that students have on our platforms.

We may also track devices used and their version information to resolve any issues particular to a device, and provide support for different platforms.

5.1. Data Processing Activities

The following table summarizes the data processing activities related to the data that is collected from their sources.

6. Data Retention

We will retain your data only for the period of time that is necessary under the contract/agreement we have with the Controller of the data or as required by the data law of the jurisdiction we serve. If and when your information is no longer required for the purposes specified by the Controller, we will delete your data.

7. Data Recipients

8. Rights, Request, Consent, and Contact

9. Revision History

Please note that our Privacy Policy is reviewed, audited, and revised periodically without notice. It is your responsibility to review the Privacy Policy each time you use our website.

Download Policy