Arc Pathway Privacy Policy

This annex describes our privacy policy for people who access the Arc Pathway early years software service, (https://yourschool.arcpathway.com) and through the Arc Pathway iOS and Android app. This policy is intended to be shared with any person who uses Arc Pathway as part of their “right to be informed” under UK or EU data protection law. Since we operate as a Data Processor for our customers, the Data Controller (the childminder, educator, nursery, school or similar educational organisation), will need to provide extra information to fulfil the “right to be informed”.

We describe this extra information briefly in ‘Annex A: Arc Pathway Data Protection’ and you can get more guidance from the UK Information Commissioner’s Office: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-be-informed/.

We are Arc Pathway Ltd, a company registered in England with company number 11504592 and a registered address of 4th Floor, 58-59 Great Marlborough Street, London, England, W1F 7JY.

Our customers are childminders, educators, nurseries, schools or similar educational organisations.

You are someone who has been given access to Arc Pathway by one of our customers. For example, you could be a member of staff, a relative of a child, the child themselves, or someone acting on behalf of a child.

You may have rights under UK or EU Data Protection legislation relating to information we store about you. These rights are described here: https://ico.org.uk/for-the-public/. If you want to exercise those rights, please contact the customer who is storing data in Arc Pathway in the first instance (e.g., the school or nursery). If they want help in carrying out your request, they can contact us.

Our lead supervisory authority for data protection is the UK Information Commissioner’s Office (https://ico.org.uk).

The Service

Our customers pay us to provide them with a service that allows them to create online learning journals for children under their care, monitor those children’s progress and share this information with their staff and, if they wish, those children’s parents and relatives.

What data do we collect?

Our customers may choose to store some of the following data on our service:

• The names and email addresses of their staff
• The names, gender, dates of birth, SEN status, spoken language, funding status and ethnicity of their children
• The names, contact telephone number, relationship to child and email addresses of the parents and relatives of their children

The contents of a learning journal:

• assessments of children’s performance
• notes, photographs and videos by and of the children
• comments by staff and relatives

A record of the children’s care:

• what they ate and drank
• toileting
• how they slept
• whether they had any accidents
• comments by staff

Reflections on particular children, particular activities or particular aspects of the customer’s setting:

• comments and additional reflections by other staff
• documents that the customer needs to manage or share with relatives

Our customers store this information in order to manage their setting and record, analyse and, if they wish, share the progress of their children.

Our customers have the freedom to choose what data they store and who they store it about. They also choose who has access to the data and are able to correct and delete data at will.

Our customers must tell you, as part of your right to be informed, what data they are storing, why they are storing it and who they are sharing it with.

In providing the service, we will send automated emails to staff and parents in order to confirm email addresses, reset passwords and notify them of events relating to the customer (such as when a new observation is added about a child).

We ONLY access the data stored by our customers in order to carry out our customer’s instructions, to maintain or improve the service or to fix faults.

We use sub-contractors to process some of the data, but we do not otherwise share this data with other organisations. A list of our sub-processors is available at https://arcpathway.com/sub-processors.

When you visit the Arc Pathway web site, our data collection includes:

• IP address
• Information your computer sends about its web browser and operating system
• What pages you look at on the Arc Pathway websites (metadata only)

We use this information to monitor the security of our service, to help us improve the service, and to enhance our marketing. We do not share this information.

If you use our phone or tablet application, our data collection includes:

• The IP address of the network your device is on
• The make and model of your device
• The version of your device’s operating system
• Details of any crashes that occur in the application
• Which screens you look at (metadata only)

We use this information to monitor the security of our service and to help us improve it. We do not share it.

What is the lawful basis for storing this data?

Our customers decide and must tell you the lawful basis for the data they add to Arc Pathway. Consent is not the only basis, and others may apply depending on their legal responsibilities.

Whose data is it?

We do not claim ownership of the data entered into Arc Pathway. We only use it according to our customer’s instructions to provide the service.

Formally, our customers are the "Data Controller" and we are the "Data Processor".

We are a "Data Controller" only for:

• Our billing system (see Annex E)
• Our customer relationship management system (see Annex E)
• Email marketing when users opt in

Who do we share data with?

We do not share data except as explicitly requested by our customers with written consent.

Our customers may share data with others (e.g., parents, staff, government, or new educational institutions). We ONLY access stored data for purposes directly related to service operation and improvement.

How do we collect the data?

Most data is entered directly by our customers via our website or apps. In some cases, parents or relatives may contribute data. Some technical data is collected automatically by browsers or the apps. Cookies may be used to identify login sessions and store preferences.

Can I see my data that is stored on your system?

Yes. The educational organisation that stores your data (e.g., a nursery or school) can provide you with a copy.

Can I have my data corrected or deleted?

Yes. Your organisation can correct or delete the data. Deleted data goes through a staged removal process including final deletion from backups.

What are our customer’s responsibilities?

Customers must:

• Ensure a legal basis for storing and sharing data
• Determine appropriate sharing permissions
• Respond to data access requests
• Train staff in data protection
• Delete unneeded data
• Manage user access carefully
• Instruct parents in line with safeguarding policy

Contacting Us

You can contact us at info@arcpathway.com

We also have a Data Protection Officer, who can be reached at dpo@arcpathway.com