Grupop Classroom Limited trading as Grupop (‘Grupop’, ‘we’, ‘us’ or ‘our’ in this privacy notice) respects your privacy and data protection rights.
This privacy notice explains how we protect your personal data and outlines your data protection rights.
Who we are
Grupop is an online classroom rewards platform for schools.
Data controller and data processor
Under GDPR, there is an important distinction between the party who decides why and how personal data is processed (the Data Controller) and the party who processes it on their behalf (the Data Processor).
When using Grupop, the following applies:
- The school is the Data Controller for pupil/student (pupil) data. The teacher uses Grupop under the authority of their school and is responsible for ensuring that use complies with their school’s applicable policies and procedures.
- Grupop is the Data Processor of the pupil data. Grupop processes pupil data on behalf of the school or teacher and for the purpose of providing the services, the Grupop platform.
- Grupop is the data controller of account data (e.g. email address, subscription details).
Detail regarding personal data we process on behalf of the teacher/school is provided at Annex 1.
The following information relates to Grupop’s role as data controller:
What information we collect and why
Teacher accounts
When a teacher registers for Grupop we collect:
- Email address
- Password (stored as a secure hash - we never store your actual password)
- Subscription and billing information (processed securely by Stripe - we do not store your card details)
- Any information provided to us to enable us to provide our services and/or respond to enquiries
When a teacher asks to be notified pre-launch when registration opens, we collect:
- Email address
How and why we use your personal data
We use your personal data to manage your account, process your subscription, and contact you about your account or service updates.
We only use your personal data when we have a legal basis to do so. The legal bases for the processing of your personal data are:
- Contract performance: To provide our services and manage customer relationships
- Legitimate interests: For website administration, and business operations
- Legal compliance: To meet regulatory requirements
- Consent: For marketing communications
How we share your data
We do not sell your personal data. We share or permit processing of personal data only with the following trusted service providers who help us operate Grupop:
- Microsoft Azure - cloud hosting, database storage, and file storage (servers located in West Europe)
- Stripe - payment processing for teacher subscriptions (Stripe’s privacy policy applies to payment data)
- LetsHost and Postmark - email delivery for account and service notifications
- Plausible - privacy-focused website analytics (no cookies and no personal data collected for advertising or cross-site tracking)
Data retention
- We retain your information only as long as necessary for the purposes outlined in this notice or as required by law.
- Teacher account data - retained for as long as your subscription is active and up to and including 31 October. Account data of unrenewed subscriptions is deleted on 31 October of each year
- Subscription and billing records - retained for 7 years as required by Irish tax law
- Email address for notification of when registration opens - retained until registration opens, then deleted immediately after the email has been sent
International transfers
Grupop is hosted in the EU.
In some circumstances, it may be necessary for us to transfer your personal data to a country outside the European Economic Area (“EEA”). We will only transfer your personal data where the transferee is based in a country that has been granted adequacy status by the EU Commission, or where there are appropriate safeguards in place to protect your personal data. If you would like further information about the appropriate safeguards in place to govern the transfer of your personal data, please contact welcome@grupop.ie.
Data security
We have in place appropriate technical and organisational measures to prevent your personal data from being accidentally lost, used or accessed without authorisation, altered or disclosed, which include:
- All data transmitted between your browser and Grupop is encrypted using HTTPS
- Passwords are stored using industry-standard hashing (never in plain text)
- Access to personal data is restricted to authorised personnel only
- Data is stored on Microsoft Azure infrastructure which maintains its own extensive security certifications
- Microsoft Defender for Storage is enabled on our file storage to detect and prevent malicious uploads
- Personal data will only be processed by third parties on our instructions, who are subject to appropriate data protection, security and confidentiality terms
Your data protection rights
You have the following rights (subject to certain limitations and exemptions) regarding your personal data:
- Right of access - you can request a copy of the personal data we hold about you
- Right to rectification - you can ask us to correct inaccurate data
- Right to erasure - you can ask us to delete your data (subject to legal retention obligations)
- Right to restriction - you can ask us to limit how we process your data
- Right to data portability - you can request your data in a machine-readable format
- Right to object - you can object to certain types of processing
You may exercise any of the above rights by contacting: welcome@grupop.ie
You may lodge a complaint with your local supervisory authority with respect to our processing of your personal data. The supervisory authority in Ireland is the Data Protection Commission: www.dataprotection.ie
Cookies
Grupop uses a small number of cookies and similar technologies necessary to operate the service. Please see our Cookie Notice for full details.
Changes to this notice
We may update this Privacy Notice from time to time. Any changes will be posted with an updated revision date.
Contact us
For any queries about this Privacy Notice please contact us at welcome@grupop.ie
Annex 1
When using Grupop, the following applies:
The school is the Data Controller for pupil data. The teacher uses Grupop under the authority of their school and is responsible for ensuring that use complies with their school’s applicable policies and procedures.
Pupil data includes the following:
- Pupil first name only
- Avatar customisation choices (predefined digital illustrations provided by Grupop - no photos or images of pupils)
- Group membership within the class
- Pop count (reward progress)
In addition the configuration data for teacher resources, pupil’s internal ID, the class ID, the teacher’s ID, the type of action (e.g. pupil removed, name corrected), and the date/time (timestamp) are processed.
Pupil surnames, email addresses, dates of birth, photographs, or any other pupil personal information other than outlined above are not required to use Grupop.
Grupop takes its data protection obligations seriously. Privacy by design and default was at the forefront in the design, build and functionality of Grupop.