Privacy Policy of the Service

Who is in charge of your data?

Because your school or the organisation that manages it, such as Multi-Academy Trust, provides this service to you, they are the data controller. This means they are responsible for how your information is used.

Somis Enterprises Oy (SomeBuddy) acts as the data processor. This means we look after the service, keep the data safe, and provide the technical tools.

Our UK-GDPR Representative is:

Rickert Services Ltd UK

- Somis Enterprises Oy (SomeBuddy) -

PO Box 1487

Peterborough

PE1 9XX

United Kingdom

art-27-rep-somebuddy@rickert-services.uk

What is “personal data”?

Personal data is any information from which you can be directly or indirectly identified. This could be, for example, your name, email, username, or an IP address (which is like a digital home address for your phone, laptop, or tablet).

What information do we process?

We only process personal data that is needed for the purposes described in this Privacy Policy. Find your role below to see what applies to you.

(1) Students

We want you to feel safe when sharing your story. 

This is why your data is handled in two different “buckets”. The other bucket is for your login information and the other one is for anything you tell in the app:

• Login info (kept in a separate, highly secure vault): Depending on your school, you either enter your own contact info (email/phone) or use a school login/username. When you log in, we receive your contact info or school ID and the name of your school.
• Confidential reports and messages: This is voluntary and the school staff don’t automatically see who is reporting or asking for help. The report may include a description of what happened, when and where it happened, who was involved, and how it has affected you. You can choose to tell your name so the school knows who to help. This also includes the private chat you have with the school’s responsible person.

(2) Staff and Professionals

If you are a member of staff using our teaching tools or the case management platform, we process the following:

• Login and organisation info: Your professional email or username and school information. This is either given to us by your organisation (through system integration) or provided by you using an activation code.
• Records: When you use the case management platform, we record which reports are assigned to you and the messages you send, and other relevant info to fulfill safety and auditing requirements.

(3) Everyone

We use cookies to improve your user experience. Cookie information may include your IP address, browser type, and operating system.

A separate Cookie Policy applies to the use of cookies. The purpose of using cookies is not to identify individual users, but to improve the user experience. However, if an individual can be identified from them, the data will be processed in accordance with this Privacy Policy.

From where do we collect the information?

• From your school: If your school has integrated SomeBuddy with their own systems, they may provide us with your basic login info or student ID so you can access the service easily.
• Directly from you: You give us information when you type into the Help Button to ask for help or send messages. You also give us your details if you sign up yourself using your phone number or email.
• Automatically: When you use the service, our system automatically detects your IP address to ensure a secure connection.

How do we use personal data and on what basis?

Helping the school keep you safe

The school has a legal obligation or a legitimate interest to make sure you are safe. They use SomeBuddy to fulfill this duty. We process your data to perform this agreement. We handle data to:

• Allow you to report incidents and concerns to a person at your school, and let you message with this person.
• Help the school identify risks (like bullying trends) and measure the impact of Online Safety lessons by turning data into statistics. You cannot be recognised from the statistics.

Keeping the service safe and improving it

We want to make SomeBuddy the best possible helper. We have a legitimate interest in processing certain data to improve the service, fix bugs, and ensure it’s secure.

For service development, we primarily use de-identified data (information where your name and identity have been removed). We will never use information about your health or well-being for development purposes unless it has been de-identified first.

How long do we keep your information?

We only store your personal data for as long as it is necessary to fulfil the purposes set out in this Privacy Policy. Once personal data is no longer needed, we de-identify or delete it.

Our standard policy is to de-identify all reports, delete login information and other possible personal data, at the latest two years after the last contact with a user, unless the law or our agreement with the organisation requires otherwise.

Who handles your information?

At school: When you send a message through the Help Button, the conversation is private between you and the designated person or personnel that your school has chosen to manage these cases (like a designated safeguarding lead).

At SomeBuddy: SomeBuddy is responsible for the technical environment where your data is stored. Our technical staff only access data when necessary for system maintenance, data encryption, fixing technical issues, security monitoring or to otherwise fulfill the agreement between the organisation and us. Troubleshooting is done through secure connections, and all staff are bound by strict professional secrecy.

Trusted partners: We use trusted partners for example, for technical maintenance, storing data securely, or sending login codes. These service providers do not have independent access to personal data. They may not use your information for any purposes other than the ones we have specified to carry out the purposes described above.

Who can my information be shared with?

Confidential help: Your reports and messages can only be seen by the specific, named people who have been chosen to handle these cases at your school (like the designated safeguarding lead). We make sure your report and conversation you have with the school personnel stays private.  We do not share your confidential reports or messages with third parties (such as parents or guardians) unless your school permits it.

Safety: Since your school or employer is in charge of your data, they have their own legal duties. It is important to know that if the school personnel believe that you or someone else is in danger, they may have a legal duty to step in. To keep you safe, they might need to contact emergency services, the police, or other professionals. If this happens, the school may need to find out who you are, even if you chose to send your report without your name.

Other exceptions: In addition, there are two exceptions when we can share your information to third parties:

• Legal reasons: if it is required by law, for example, to respond to a summons or in connection with legal proceedings.
• Business transfer: if we are involved in a merger, acquisition or other business transaction.

Do we transfer your data internationally?

As a priority, we only process data within the European Economic Area (EEA) and the UK. Some technical providers (e.g. error monitoring and use statistics) may transfer to the United States.

Where we use such services to handle your information, we rely on the adequacy decision known as the UK Extension to the EU-US Data Privacy Framework (the UK-US Data Bridge). For any other international transfers where an adequacy decision does not apply, we use accepted standard safeguards, such as standard contractual clauses (SCC), whereby our service provider commits to appropriate data protection measures to safeguard your personal data.

How do we protect your information?

We pay strong attention to data protection and security in the design, production and maintenance of our services.

We use reputable data hosting service providers to host the information we collect, and we have appropriate technical, administrative and physical security measures in place to protect your information from loss, destruction, misuse and unauthorised access.

We use strict access restrictions to protect your data at every level. Only the specific, named personnel (such as the digital safeguarding lead) have the right to log in and see your reports. Other teachers or staff members cannot access your private discussions. 

We continuously implement data protection and security, for example by training our staff and regularly reviewing our compliance with data protection legislation and good data security practices.

What are your rights?

You have the right to:

• Request access to your own personal data
• Request correction of inaccurate or incorrect personal data
• Request the erasure (the “right to be forgotten”) of your personal data
• Object to the data processing based on our legitimate interest
• Request restriction of processing of your data
• Receive your personal data in a machine-readable format and transfer the data to another controller, provided that you have given us the personal data in question
• File a complaint with the competent supervisory authority. In the UK, this is the Information Commissioner’s Office (ICO). You can find more information at www.ico.org.uk.

Changes and updates

We are constantly developing our services. As a result, we may need to change and update this Privacy Policy. Changes may also be based on changes in legislation. If we make changes to this Privacy Policy, we will update the new version of it on our website with the date of the update.