The Legal Bit

There is no escaping the fact that we need some legal Terms and Conditions, but we’re teachers and you’re more than likely a teacher too (this doesn’t mean that you must be a teacher to continue reading) so we have included a summary of the legal jargon to make it nice and simple.

You will be purchasing an annual subscription to Kangaroo Maths Online which includes two levels of login (for teacher use and for your students). For ease, the below are the main points:

• This licence is for your school and your school only. User names and passwords should not be passed to other schools and you must make every effort not to make them publicly available.
• For the term of your subscription, the resources can be saved onto any of your schools computers, on your internal network, your VLE and/or any part of the school/college website that is accessible to pupils and staff only. So basically any pupil or member of staff can use them for study, classroom teaching or lesson planning— but not for any private profit-making activities and cannot be uploaded to external third-party sites.
• This is an annual licence which means 370 days (yes we know it’s longer than 1 year!), and shortly before the renewal date we will write to you inviting you to renew the licence.
• Please respect that we have put a lot of time and effort (read that as “blood, sweat and tears”) to produce the resources available at Kangaroo Maths Online.

Terms & Conditions (The real small print)

Introduction

Kangaroo Maths has several responsibilities as a data processor under the Data Protection Act (DPA) and the General Data Protection Regulation (GDPR). We are registered with the Information Commissioners Office (ICO) with registration reference C1478973.

Whilst there can be no such thing as a completely secure system, Kangaroo Maths will endeavour to take all reasonable measures to ensure that data integrity and security is maintained at all times.

This policy was last updated on 28^th February 2018.

The service

Kangaroo Maths is a cloud-based service currently running on servers controlled by WPEngine based within the UK. WPEngine computing environments employ a number of virtual, physical and environmental controls to maintain data security and are ISO 27001:2013 certified. Further information about how WPEngine maintains the security of their environment can be found on their website.

We may also use other third parties in order to provide services, we will carefully select these third parties to ensure they have appropriate security measures in place to ensure your data security and integrity.

GDPR

The GDPR applies from 25^th May 2018. As part of this, here are some useful things you may wish to know:

• Kangaroo Maths is defined as a ‘processor’ with respect to school data. This means we will always act upon any authorised requests to add, update and delete data from Kangaroo Maths wherever possible.
• Kangaroo Maths has decided not to process any data that falls under article 9 of the GDPR (Special categories of personal data). This means we do not process data such as ethnicity, political opinions, genetic data etc.
• Kangaroo Maths’s data protection representative is Faisal Khawaja. He can be contacted via fize@justmaths.co.uk.
• Kangaroo Maths does not process schools data based on consent, nor does it recommend that schools do so. Our legal basis’s for processing schools data are as follows:
  • The processing is necessary because of a legal obligation that applies to you. Schools have a legal obligation to provide students with an education. Kangaroo Maths are working on behalf of schools to help them support them in providing this.
  • The processing is necessary for administering justice, or for exercising statutory, governmental, or other public functions. Schools provide a public function and Kangaroo Maths are working on behalf of those schools.
  • The processing is in accordance with the “legitimate interests” condition. Schools have asked Kangaroo Maths to process this data and there is no “prejudicial effect on the rights and freedoms, or legitimate interests, of the individual”.
  • The processing is necessary in relation to a contract the individual has entered into. Kangaroo Maths would expect every stakeholder to have signed a contract with the school explaining the IT services that are necessary as part of the education services provided, therefore this fourth legal basis will apply in most cases.

Subject access requests

Under the DPA & GDPR, all individuals who are the subject of personal data held by Kangaroo Maths are entitled to:

• Ask what information the company holds about them and why
• Ask how to gain access to it
• Be informed how to keep it up to date

Kangaroo Maths will provide school administrators with an automated subject access requests routine that will enable them to retrieve data related to stakeholders in the system. If we receive any requests directly, we may pass these back to the school’s Kangaroo Maths administrator where relevant, or will provide the requested information within 30 days of the request (provided we can verify the identity and authority of the person making the request).

Deletion of data

Upon the cancellation of a subscription, we will delete all personal data relating to your school from our Kangaroo Maths servers within 30 days.

We will keep a history of contact with the school for a period of up to 5 years after cancellation, to allow us to accurately answer any questions that may arise in the future.

3^rd party processors

In order to provide our service, we work with trusted 3^rd parties. Currently these are as follows: WPEngine, AWS, Apple, Microsoft, Google and Campaign Monitor. Kangaroo Maths will ensure that any 3^rd parties have appropriate security credentials such as ISO 27001 certification and EU-US Privacy Shield compliance.

Security measures

We will endeavour to ensure that:

• A SSL connection between the Kangaroo Maths service and the client’s computer is active at all times for any logged in user
• All Kangaroo Maths servers will have security updates applied regularly
• All Kangaroo Maths servers will use a firewall that enforces strict rules on who can access what services
• All Kangaroo Maths servers will have appropriate security settings to minimise the opportunities for malicious activity to take place
• When a user changes their own password, it is encrypted, using the secure hashing and salting method
• Administration passwords to the Kangaroo Maths.co.uk servers are not shared with any 3rd parties or employees who do not need access as part of their role
• Any personally identifiable information provided by schools is not shared with any 3rd parties.
• Access to the Kangaroo Maths offices are secured with appropriate physical measures
• All Kangaroo Maths office computers and mobile devices use disk encryption
• All Kangaroo Maths office computers and mobile devices have strong passwords or another secure authentication method
• When sold or passed on, all Kangaroo Maths office computers and mobile devices will have their data securely erased
• Kangaroo Maths staff will receive adequate training on data security and intrusion prevention
• Kangaroo Maths staff will delete copies of school data from their own computers as soon as they no longer need it.

Redundancy, backup and disaster recovery

We will endeavour to ensure that:

• The main Kangaroo Maths database has a mirror database, ready to take over or restore from in the case of problems with the main database
• We also keep daily server-level backups
• Additional database-level backups are taken four times a day
• Backup and restoration procedures are tested on a regular basis
• Load balancing is employed when necessary
• All servers are actively monitored for any disruption
• Any disruption reported is investigated as soon as possible
• Any disruption found is resolved as soon as possible

Changes to this policy

Changes may be made to this policy at any time, without prior notice.

Introduction

Kangaroo Maths is a cloud-based service offered to educational establishments and organisations (hereafter referred to as ‘schools’) on an annual subscription basis. Schools using the service must confirm that they have read, understood and agree with all of the terms included in this service agreement.

It is the responsibility of the person(s) in charge of Kangaroo Maths at the school to ensure that any person(s) taking over their role in the future are made aware of this service agreement.

This agreement was last updated on 28^th February 2018.

Data protection & security

As a UK company, we are registered with the Information Commissioners Office (ICO) with registration reference C1478973. You will always be in control of your school’s data, either directly within the platform or by requesting action from us. The Kangaroo Maths service is hosted in the UK, currently at WPEngine. We also work with a few trusted 3^rd party service providers that enable us to offer functionality that schools need. For further details, please see our Data Protection and Security Policy.

GDPR statement

The General Data Protection Regulation states that whenever a controller uses a processor it needs to have a written contract in place. This service agreement, and its related policies form that contract.

Kangaroo Maths (the processor) processes data on behalf of the school that purchased the subscription (the controller). The purpose of the Kangaroo Maths service, is to motivate, engage and support teachers, students, parents, leaders and employees through a variety of educationally focussed tools. We will not pass any personally identifiable data onto any 3^rd parties, except where necessary to provide the service.

For details of the types of data we process, duration of the processing, or data deletion protocols and other related matters, please see our Data Protection and Security Policy.

As per ICO guidance we have included the following terms:

• We will only act on the written instructions of the school as defined in this service agreement and related policies (unless required by law to act without such instructions).
• We will ensure that people processing the data are subject to a duty of confidence through vetting, training and enforcement of policies.
• We will take appropriate measures to ensure the security of processing as detailed in our Data Protection and Security Policy.
• By approving this service agreement, you authorise us to engage with sub-processors as defined in the Data Protection and Security Policy in order for us to provide the service.
• We will assist the data controller in providing subject access and allowing data subjects to exercise their rights under the GDPR.
• We will assist the data controller in meeting its GDPR obligations in relation to the security of processing, the notification of personal data breaches and data protection impact assessments.
• We have defined how personal data will be deleted at the end of the contract in our Data Protection and Security Policy.
• We will submit to audits and inspections and provide the controller with whatever information it needs to ensure that they are meeting their Article 28 obligations. We will tell the controller immediately if it is asked to do something infringing the GDPR or other data protection law of the EU or a member state.
• Please note that nothing within this contract relieves the processor of its own direct responsibilities and liabilities under the GDPR.

Service availability

We will endeavour to provide access to the Kangaroo Maths service at all times. The exceptions are in the case of planned maintenance (usually in the UK school holidays), or an unforeseen event that causes the service to be unavailable.

In the event of planned maintenance that will cause significant disruption and is expected to last more than 30 minutes, we will endeavour to make sure schools are made aware of the expected downtime at least one week in advance of that downtime, via the main contact’s email address. In the event of any other planned maintenance we will endeavour to notify users via our website and Twitter in advance.

In the case of an unforeseen event that is causing significant disruption to the service and lasts more than 30 minutes, we will endeavour to let schools know what is happening as soon as possible, via their main contact’s email address. In the case of any other unforeseen event causing significant disruption, we will keep schools informed via Twitter as to what is happening.

Supported systems

As a cloud-based service, Kangaroo Maths has few requirements and can run in most browsers on most hardware platforms. However, there may be out-dated or seldom used hardware/software platforms that we cannot support. We will aim to support most common browsers (i.e. Edge, Internet Explorer 11, Safari, Chrome, Firefox, Opera) released in the past 3 years. Please note that this does not include Internet Explorer 10 and below, which Kangaroo Maths will not support. We recommend all schools run the latest version of the browser of their choice, in order to get the best experience. Cookies must be enabled.

Please ensure you are running the latest operating system version if you wish to use our mobile apps. Although it is likely the apps may still work as expected, we will not provide support for iOS/Android devices running outdated operating systems released 12 months ago or more.

If you’re concerned about whether the service will run on your hardware and/or software, contact us for more information.

School contacts

Kangaroo Maths will use email as our primary form of communication with our school contacts. Schools must always have a main contact and we can add additional contacts if they wish to be included. Schools must inform us of a change of any contacts via email.

Contacts will receive emails including our half termly update, and half termly feature focus. We will also use email to communicate on occasions such as a service disruption event, special events or to request feedback.

Updates and improvements to the service

Kangaroo Maths is constantly improving and evolving and as such features are often added or removed. We will aim to keep our users informed of any upcoming changes that may have a significant impact on the way they use the system through our half-termly update emails.

Signing up for the service

Schools wishing to sign up for the service must provide a purchase order number which will allow us to set up their subscription and provide them with an invoice.

Renewals

Subscriptions are automatically renewed each year unless cancelled (see below). Invoices will be generated and sent to schools in the month before the renewal date.

Cancellations

Schools must inform Kangaroo Maths that they wish to cancel their subscription a minimum of 30 days before their renewal date. If they do not inform Kangaroo Maths 30 days before the renewal date, the full cost of the annual subscription will be due.

Payment terms

Kangaroo Maths will invoice the school when the next payment is due. Schools will have 7 days to make payment, after which statutory interest on the invoice may be charged.

Limits and liability

Whilst we are very careful to ensure data security and system compatibility, it is important to note that there is no such thing as a completely secure system and reliability or compatibility problems can occur in all software.

Schools using the Kangaroo Maths service and running any related software on their own systems, do so in the knowledge that we will not be held liable for more than the original sum paid to Kangaroo Maths, in the event of any issues that arise, however they are caused.

Complaints and refunds

Should schools be unhappy with the Kangaroo Maths service, and feel that it has not met the terms of this service agreement, they should write to support@kangaroomaths.co.uk, detailing their complaint. A refund may be applied, on a pro rata basis, depending on the nature of the complaint.

Changes to this agreement

From time-to-time, we may need to update this service agreement to include more information or clarify existing statements. Schools will be informed of the change via their main contacts’ email address.