Educake shares limited data with third-party organisations in order to provide customer support, in order to allow users to reset their passwords if they've forgotten them, and for invoicing. Each of these is detailed below.
Data shared with Intercom for customer support
We share limited data with our customer support software, Intercom, including teachers’ names, school names and teacher email addresses. This allows us to help teachers with any technical problems quickly and easily, via email, or by an online chat system.
We do not share any student data with Intercom, unless a student emails us directly, in which case we store their email address.
Intercom is based in the USA and this data transfer is covered by the EU-US Privacy Shield. For more information please visit the following two pages:
https://ico.org.uk/media/1571/model_contract_clauses_international_transfers_of_personal_data.pdf
https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/eu-us-privacy-shield_en
For information on Intercom’s GDPR compliance please visit this page:
https://docs.intercom.com/pricing-privacy-and-terms/how-were-preparing-for-gdpr
Data shared with Twilio for two-factor authentication
For the text messages for the two-factor authentication system to allow users to reset their passwords we use Twilio. Twilio is ISO 27001 registered and data exchanged between Educake and Twilio is covered by the US-EU Privacy Shield:
https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/eu-us-privacy-shield_en
For more information about Twilio’s data policy relating to GDPR please visit this page:
https://www.twilio.com/gdpr
Phone numbers are removed from Twilio as soon as the message has been sent.
Data shared with Xero for accountancy
For our accountancy system we use Xero and store school addresses and the name and email of our contacts, e.g. finance office.