Student Privacy Policy

2.1 Purpose of Personal Information

We have set out below, in a table format, a description of all the ways we plan to use your Personal Information, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

2.2 Advertising and Marketing

In our advertising and marketing practices, we strictly adhere to guidelines established for individuals under the age of 13 or any other designated age as specified by law.

We are committed to never targeting advertising or utilizing information for marketing purposes towards students, those under the age of 13, or individuals falling under any other designated age as specified by law. Furthermore, we guarantee that we will never engage in the sale of student or any user information.

2.3 System Logs & Cookies

We may use cookies to track content usage and traffic on the Website, App and/or Service.If you opt in to receive cookies, we use third-party ad companies such as Facebook or Google Ads to help provide some of our advertising services. These third parties may place cookies on your computer and collect data about your online activities across websites or online services.

Our cookies also keep track of which websites referred you to Goosechase and which pages you visit on our Website. If you have a Goosechase account, this information may be linked to your account; however, Goosechase only uses this information to address a customer support issue or otherwise in the aggregate to track Website performance.

Our webpages may also contain electronic tags known as web beacons that we use to help deliver cookies on our websites and count users who have visited those websites.

For more information, please see our Cookie Policy located at http://goosechase.com/cookie-policy.

5.1 Data Retention

We will keep your Personal Information for as long as it remains necessary for the identified purpose or as required by law, which may extend beyond the termination of our relationship with you. We may retain certain data as necessary to prevent fraud or future abuse, or for legitimate business purposes, such as analysis of aggregated, Non-personal Information, Account recovery, or if otherwise required by law. All retained Personal Information will remain subject to the terms of this Student Privacy Policy and our Privacy Policy at http://goosechase.com/privacy.

We will only share your information provided within our company and with third parties for functionality purposes.

This will involve, if you are based in the European Union, transferring your data outside the European Economic Area (EEA).

Many of our external third parties are also based outside the European Economic Area (EEA) so their processing of your Personal Information will involve a transfer of data outside the EEA.

If you are based in the European Union, whenever we transfer your Personal Information out of the EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• Where the country has been deemed to provide an adequate level of protection for Personal Information by the European Commission.
• Where we use certain service providers, we may use specific contracts approved by the European Commission which give Personal Information the same protection it has in Europe.
• Where we use providers based in the U.S., we may transfer data to them if they are part of the Privacy Shield which requires them to provide similar protection to Personal Information shared between Europe and the U.S.

5.2 Data Deletion

Every user has the right to request the deletion of any Personal Information collected and retained by Goosechase. Any data deletion requests, if eligible, will be completed within 28 days of receiving the request.

Upon receiving your request and verifying your identity, we will review it to determine if any exceptions apply to retaining the information. We may deny deletion requests if retaining the information is necessary to complete a transaction, detect security incidents, comply with legal obligations, or protect against malicious activity.

Data deletion requests can be made on behalf of underage users by a parent, guardian, or educational institution.

To initiate a data deletion request, you can:

1. Send an email to hi@goosechase.com,
2. Fill out the relevant form on our website, or
3. Delete your account and associated data directly from the web or mobile app.

We aim to respond to data deletion requests within 10 days of receipt, and if eligible, delete the data within 28 days.

6.1 GDPR

If you are a resident of the European Economic Area (EEA), you have certain data protection rights. Goosechase aims to take reasonable steps to allow you to correct, amend, delete, or limit the use of your Personal Data.

If you wish to be informed what Personal Data we hold about you and if you want it to be removed from our systems, please contact us using the contact information set out below.

In certain circumstances, where we act as Data Controller, you have the following data protection rights:

• Request access to your Personal Information (commonly known as a "data subject access request"). This enables you to receive a copy of the Personal Information we hold about you where we are the data controller and to check that we are lawfully processing it.
• Request correction of the Personal Information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected, though we may need to verify the accuracy of the new information you provide to us.
• Request erasure of your Personal Information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal information to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
• Object to processing of your Personal Information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal information for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
• Request restriction of processing of your Personal Information. This enables you to ask us to suspend the processing of your Personal Information in the following scenarios: (a) if you want us to establish the information's accuracy; (b) where our use of the information is unlawful but you do not want us to erase it; (c) where you need us to hold the information even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your information but we need to verify whether we have overriding legitimate grounds to use it.
• Request the transfer of your Personal Information to you or to a third party. We will provide to you, or a third party you have chosen, your Personal Information in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
• Withdraw consent at any time where we are relying on consent to process your Personal Information. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain services to you. We will advise you if this is the case at the time you withdraw your consent.

Please note that we may ask you to verify your identity before responding to such requests.

You have the right to complain to a Data Protection Authority about our collection and use of your Personal Data. For more information, please contact your local data protection authority in the European Economic Area (EEA).

If you wish to exercise any of the rights set out above, please contact us using the contact details below.

You will not have to pay a fee to access your Personal Information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your Personal Information (or to exercise any of your other rights). This is a security measure to ensure that Personal Information is not disclosed to any person who has no right to receive it.

We may also contact you to ask you for further information in relation to your request to speed up our response.

6.2 FERPA

Our platform may be accessed by teachers, schools, universities, and other educational institutions. Through access to our platform, we may unknowingly, inadvertently, and indirectly collect personally identifiable information from or about students, which may include educational records as defined and governed by the Family Educational Rights and Privacy Act (FERPA).

Should we collect such data, We would consider this data to be strictly confidential and would not use any such data for any purpose other than providing and improving our platform for the relevant educational institution or on that educational institution's behalf.

6.3 COPPA

We do not knowingly collect any information from individuals under 13 years of age and our platform should not be used by individuals under the age of 13 unless and/or until the relevant institution has acquired consent and authorization for an individual under the age of 13 to use our product, and for Goosechase to collect information from such individual in a manner compliant with this Privacy Policy and permitted by COPPA.

Where consent and authorization are acquired, we would only collect data that is necessary to provide and improve our experiences. Please note that individuals under the age of 13, Game Creators, or legal guardians, may delete or withdraw consent for the processing of the individual's information at any time.

If you have any questions about reviewing, modifying, or deleting the personal information of a child under the age of 13, please contact us at hi@goosechase.com. Similarly, please contact us as soon as possible at hi@goosechase.com if you believe we have inadvertently collected the personal information of a child under 13 without proper consent so that we may delete such data.

6.4 SOPIPA

Please note that We do not use student data for targeted advertising purposes. We do not use collected information to create an identifiable profile of a student and would only use de-identifiable and aggregated data to improve our platform.

Our collection, use, and disclosure of such data are governed by our contracts with educational institutions; in which, the provisions of COPPA, FERPA, SOPIPA, and other applicable laws that relate to the collection and use of personal information of minors and/or students, but not by the provisions contained in this Privacy Statement.

6.5 CCPA

If you are a California resident, California law may provide you with additional rights regarding our use of your personal information. Amongst other things, the CCPA provides Californian consumers with specific rights regarding their personal information. This section describes your CCPA rights and explains how to exercise those rights.

6.6 California Online Privacy Protection Act (CalOPPA)

In alignment with California Online Privacy Protection Act (CalOPPA) requirements, Goosechase ensures transparency and adherence to privacy standards for all users, including those in California. Our compliance includes the following:

6.7 The Texas Data Privacy and Security Act (TDPSA)

If you are a Texas resident, you have certain data protection rights under the Texas Data Privacy and Security Act (TDPSA). Goosechase aims to facilitate the exercise of these rights to ensure the protection of your personal data.

If you wish to exercise your data protection rights under the TDPSA or inquire about the personal data we hold about you, please contact us at http://goosechase.com/contact.

In certain circumstances, as specified by the TDPSA, you have the following data protection rights:

Data Request: You have the right to request access to your personal information, allowing you to receive a copy of the data we hold about you in a structured, commonly used, machine-readable format within 45 days of receipt of the request.

Data Correction: You can request correction of any incomplete or inaccurate personal information we hold about you, ensuring the data's accuracy.

Data Deletion: You have the right to request the deletion or removal of your personal information where there is no legal basis for its continued processing.

Consent Withdrawal: You can withdraw your consent to the processing of your personal information at any time. Goosechase does not sell any user data.

Childrens Data: Goosechase will refrain from intentionally processing any sensitive data of a child under age 13 in a manner that falls outside the parameters outlined by COPPA.

Please note that we may need to verify your identity before fulfilling any requests related to your personal information. Additionally, exercising your rights under the TDPSA is free of charge.

6.8 Texas House Bill No. 2087, also known as the Student Privacy Act

Goosechase is committed to complying with the provisions of the Student Privacy Act and protecting the privacy of students' information.

Prohibited Use of Covered Information: Goosechase complies with this provision by not engaging in targeted advertising based on any information acquired through the use of our platform for a school purpose.

Additionally, Goosechase does not use information to create profiles about students unless it's for a school purpose.

Furthermore, Goosechase does not sell or rent any student's covered information.

Allowed Disclosure of Covered Information: Covered information on Goosechase may be disclosed for school purposes, such as facilitating educational activities or assessments. We ensure that any covered information disclosed is not further disclosed unless necessary for operational or functionality purposes.

Allowed Use of Covered Information: Goosechase uses covered information solely for improving our platform. We do not associate this information with identified students and only use de-identified and aggregated data to enhance functionality.

Deletion of Covered Information:If a school district requests the deletion of a student's covered information from Goosechase, We will comply within the specified timeframe of 60 days. The requests are typically complete within 28 days. Alternatively, if the student or their parent consents to the continued maintenance of the covered information, Goosechase will retain it accordingly.

6.9 The Texas Information Disposal Act (IDA) - House Bill No. 698

If you are a resident of Texas, you hold specific rights concerning the protection of your data under the Texas Information Disposal Act (IDA). Goosechase is committed to assisting you in exercising these rights to safeguard your personal information.

In accordance with the IDA, you may have the following data protection rights:

Data Deletion Practices: In line with the IDA requirements, Goosechase implements secure data disposal practices to safeguard sensitive information. When data is no longer needed for its intended purpose or upon request for deletion by users, Goosechase ensures that the data is securely disposed of to prevent unauthorized access or disclosure.

Data Deletion Procedures: Upon user request or at the end of the data retention period, Goosechase employs secure deletion procedures to permanently remove sensitive information from its systems. This includes erasing data from databases, servers, and any other storage devices in a manner that ensures irretrievable deletion.

Data Retention Policies: Goosechase maintains clear data retention policies that align with the provisions of the IDA. We only retain data for as long as necessary, or until a deletion request is made, to fulfill the purposes for which it was collected or as required by law.

6.10 National Institute of Standards and Technology (NIST)

To ensure the safety and security of Goosechase's platform We consider many aspects of the security framework set out by the National Institute of Standards and Technology (NIST) to maintain a safe and secure platform. NIST provides a flexible and customizable approach for improving cybersecurity posture.

The primary purpose of the NIST Cybersecurity Framework is to:

• Provide Guidance: The framework offers guidance and best practices for organizations to better understand, manage, and mitigate cybersecurity risks effectively.
• Enhance Cybersecurity: It helps organizations develop and implement cybersecurity practices that enhance their resilience to threats and vulnerabilities.
• Support Risk Management: The framework helps organizations to identify, assess, prioritize, and mitigate cybersecurity risks in alignment with their business objectives and risk tolerance.
• Facilitate Compliance: While voluntary, the framework can also help organizations align with regulatory requirements, industry standards, and best practices related to cybersecurity.