Privacy Notice

Who is Tribal?

Tribal is a global provider of software and services to the education sector. To provide our software and services we collect, store, and process personal data about our customers, potential customers, suppliers, contractors, partners, and staff. We are also contracted to process information, including personal data, on behalf of our customers.

We are committed to ensuring that whenever we handle personal data, we do so in a transparent and reasonable manner, and in conformance with our legal obligations and consistent with the expectations of the affected individuals.

Is Tribal your Data Controller?

In order to answer this question, it is important to understand what a Data Controller is. A Data Controller is an organisation which has determined that it needs: to hold your personal data, exactly what information to collect from you and if there are any instances in which such personal data will be shared with others.

The Data Controller is responsible for informing you of your rights and giving you access to your personal data, if you request it.

Because Tribal acts as a Data Controller in some instances, and processes personal data on behalf of our customers in other instances, it might not always be clear who the Data Controller is . The table below should help you decide:

Tribal is your Data Controller if you are…

Your school, college, university or the company you work for is your Data Controller if you are...

A prospective, current, or previous member of Tribal staff; An individual working for a customer of Tribal, who has been named as a contact for the purposes of the relationship with Tribal; An account manager or relationship manager of a supplier of products or services to Tribal; A contractor or associate, supplying a service to Tribal or working on behalf of Tribal to deliver its products and services; A person who has consented to receiving products and services communications from Tribal and/or anyone who has expressed an interest in Tribal products and services; An individual who has completed an i-graduate survey.

A student or member of staff at a further or higher education institution which uses a Tribal Student Management System and associated Tribal products; A student or member of staff at a further or higher education institution, or other organisation which uses Tribal services to host or analyse data; A member of staff in an organisation which uses Tribal products to support the delivery of work-based learning; A member of staff or student in an education institution which uses Tribal training, inspection and improvement services.

The Data Protection Officer

Tribal has a Data Protection Officer which oversees the activities we undertake to ensure personal data is handled ethically and in conformance with our legal obligations worldwide.

Any questions about the way in which we collect, hold or process your data can be addressed to our Data Protection Office at DataPrivacy@tribalgroup.com. Our Data Protection Officer is Paul Duller.

What is personal data?

Personal data is any information about an individual from which the individual may be identified. It might be possible to identify the individual through a single, specific identifier, such as a name; or by combining a number of different identifiers, such as job role and team. Some information is considered particularly sensitive because of the serious impact that it might have on the individual concerned if the data was lost or stolen. This ‘special category’ data includes personal data in respect of:

• Racial or ethnic origin;
• Political opinions;
• Religious or philosophical beliefs;
• Trade union membership;
• Health;
• Sex life or sexual orientation;
• Genetic and biometric data (such as your fingerprints).

The personal data we collect

The following categories of personal data are, as applicable, processed by Tribal:

• Identity Data such as your first name, last name, title, date of birth and gender;
• Contact Data such as your e-mail address, address, and telephone number;
• Financial Data such as bank account details and national insurance number;
• Transaction Data such as details of the software products and services you have obtained from us, purchase order details, and payments made to/from us;
• Education Data such as your educational history and qualifications;
• Technical Data such as your internet protocol (IP) address, login data, operating system and platform;
• Usage Data such as how and when you use our website, performance and other communication data;
• Marketing Data such as your marketing and communication preferences; and
• Survey Data such as your comments and opinions provided in response to a survey.

In addition, we may collect the following categories of personal data relating to job applicants, employees and ex-employees:

• Recruitment Data such as details of your employment history, training and skills development, nationality, entitlement to work in the UK, security clearances, criminal record (if your role requires this) and equal opportunities monitoring information;
• Employment Data such as the terms and conditions of your employment, salary, benefits, work patterns, attendance, holidays, sickness, disciplinary or grievance issues, medical or health conditions, disabilities for which Tribal needs to make reasonable adjustments; and information about your private vehicle, driving licence, MOT and insurance documents if you drive on company business;
• Performance Data such as performance reviews and ratings, timesheet information, performance improvement plans and related correspondence;
• Activity Data such as the websites our staff visit while using a Tribal computer or Tribal network, and the activity logs held within Tribal systems and databases;
• Communications Data such as the emails you send or receive via the Tribal email system; and
• Emergency Contacts Data includes information about your marital status, next of kin, dependants, and personal and emergency contacts details to be used in the event of an emergency.

Aggregated data

We also collect, use and share Aggregated Data such as statistical or demographic data for business purposes, as applicable. Aggregated Data may be derived from your personal data but is not considered personal data in law when anonymised and does not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy notice.

CCTV

We may capture information by CCTV when you visit a Tribal office. Our cameras can be located in our reception areas, stairwells, car parks, entrances/exits, blind spots, server rooms and other key areas. The cameras are in operation 24 hours a day, 7 days a week, 365 days a year. There are signs which tell you that CCTV cameras are in operation and who to contact for further information. Our cameras do not capture images which are not relevant to the purposes of the monitoring. Surveillance systems are not used to record sound and there are no cameras in areas where there is an expectation of privacy (e.g. toilets or changing rooms).

Cookies, analytics and targeting advertising

We use a range of analytics and targeted advertising tools to deliver relevant website content and information to you. For example, we use tools such as Google Analytics to target and improve our marketing campaigns, marketing strategies and website content. We may also use tools provided by other third parties to perform similar tasks. You can opt-out of the Google Display Advertising Features using Ad Settings or the Google Analytics opt-out browser add on. In addition, the Digital Advertising Alliance (which includes companies such as Google and Facebook) provides a tool called WebChoices that can perform a quick scan of your computer or mobile devices and adjust your browser preferences accordingly.

How we use your personal data

Your personal data is used by Tribal to support a range of different activities in our business. These are listed in the table below together with the types of personal data used and the legal basis upon which we are entitled to process them, including where appropriate, our legitimate interests.

We are required to inform you of the legal basis for collecting and processing your personal data, where we are the Data Controller. These include:

• Performance of contract: In most cases, we will have a contract with you to either provide a product or service to you, or to receive something from you.
  Examples include: employment contracts; non-employed worker / associate contracts; Software and Services Agreements for the provision of our products and services; and procurement contracts.
  We are also acting under the performance of contract if we collect or process your information for the purposes of entering into a contract, if you have expressed an interest in working with us;
• Legitimate interests: We may have a legitimate interest in processing certain personal data, which does not relate to the performance of a contract agreed with you. If we rely on our legitimate interests to justify processing your personal data, we will have conducted an assessment to evaluate the appropriateness of this; and will only undertake the processing if it is necessary to do so and will not cause undue risk to you, taking into account your interests;
• Consent: Where we do not have a contract with you but would like to be able to contact you about our products and services, we will seek your consent to retain your contact details for that purpose. Your consent must be informed, explicit, and freely given – there will be no ‘pre-ticked’ boxes and you must expressly opt-in. You have the right to withdraw your consent at any time;
• Legal obligation: We may be legally obliged to process certain information about you, for example to protect employee safety while travelling on Tribal business. In some cases, we are obliged to share personal information with third parties, such as the Inland Revenue.

Table: How we use your data

Purpose / Activity	Category of Data	Lawful Basis (including basis for legitimate interest)
To create an account and register you as a new customer	Identity Contact	Performance of a contract with you
To process and deliver your order including: recording your order details; keeping you informed about the order status; processing payments and refunds, collecting money owed to us; and assisting fraud prevention and detection	Identity Contact Financial Transaction Marketing	Performance of a contract with you Necessary for our legitimate interests (e.g. to recover debts due to us)
To manage our relationship with you, including: providing you with any information, products and services that you request from us; notifying you about changes to our products, services, events, terms and conditions or privacy notice	Identity Contact Marketing	Performance of a contract with you Necessary for our legitimate interests (to keep our records updated and to analyse how customers use our products and services)
To use data analytics to: improve our website, products, services, marketing, customer relationships and experiences; and for market research, statistical and survey purposes.	Technical Usage Marketing Survey	Necessary for our legitimate interests (to define types of customers for our products and services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy)
To register you for email updates, and recommend products and services and events that may be of interest to you	Identity Contact Technical Usage	Consent
To gather your opinions on our products and services, or on your educational experiences.	Identity Contact Education Opinion Survey Marketing	Consent
To seek to recruit, select the right people into our business, and manage their employment with us, including job role and responsibilities, salary payments, provision of benefits, progression, training, performance management, and disciplinary or grievance procedures.	Identity Contact Recruitment Financial Transaction Activity Education Employment Performance Marketing	Performance of a contract with you
To arrange travel for you on Tribal business and making appropriate safety arrangements for this, including monitoring your travel. To advise you during any emergency affecting Tribal employees or offices.	Identity Contact Emergency contact	Performance of a contract with you Necessary to comply with a legal obligation
To protect the security of commercial and personal sensitive information in our care by securing and monitoring activity within our network, internet and email.	Identity Technical Usage Activity Communications	Necessary for our legitimate interests (protecting the data entrusted to us by customers and commercially sensitive information about our business)

How we share your personal data?

We have offices all over the world, both inside and outside of the UK and the EEA, and we sometimes share personal data between offices in order to deliver our services effectively. We may also transfer your personal data to third party suppliers based in different countries around the world.

When transferring personal data across borders, we ensure that this is in conformance with applicable data protection legislation and that appropriate safeguards are in place which are compliant with the high standards set by the EU General Data Protection Regulation (“GDPR”), the Data Protection Act 2018 and the GDPR as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (“UK GDPR”), as applicable. These apply to all internal and external transfers.

Please contact us if you want further information on the countries to which we may transfer personal data and the specific mechanisms used by us when transferring your personal data between regions, including outside the UK and EEA.

CCTV

Authorised personnel can access the CCTV recordings, images and live feeds where necessary. We will also check live feeds from CCTV cameras, if for example we need to protect health and safety. We can share images from our CCTV system, if for example someone's car has been broken into on our premises. However, we are not responsible for the use individuals make of such images. Law enforcement agencies can view or remove CCTV footage in the detection or prosecution of crime. CCTV recordings are only retained for a short period of time, in line with our retention policy.

Your Rights

Your personal data belongs to you; your rights as the owner of your personal data are protected by applicable data protection legislation around the world. A summary of your rights is presented below:

• Access your data: You can access the personal data Tribal holds on you at any time, by making a Data Subject Access Request. The more specific you can be about what you want to know, the better. We will need to confirm your identity before we release information to you.
• Rectify your data: You can ask us to correct any personal data we hold about you that is inaccurate.
• Request erasure: You have the right to ‘be forgotten’, in certain circumstances. This right does not apply if it would prevent the performance of a contract with you, or if there is another legal requirement for us to retain your personal data. If erasure is not possible, you may be able to ask us to restrict processing.
• Request the restriction of processing of your personal data: You may ask us to suspend the processing of your personal data under certain circumstances, for example pending a review of the accuracy of the personal data, or you have objected to our use of the personal data and we need to establish whether we may lawfully continue processing it.
• Request the transfer of your personal data: In some cases, you can ask us to transfer the personal data you originally provided to us to yourself or to another company. This only applies to information you provided directly, or that we observed about you through automated means.
• Object to the processing of your personal data: You can object to our processing of your personal data for direct marketing purposes, or when processed the basis of our legitimate interests (as set out above). In some cases, we may have compelling legitimate grounds to process your personal data which may override your rights and freedoms.
• Object to automated decision-making: You can also object to the processing of your personal information where profiling is being used to make assumptions about your behaviours or preferences, for example to target marketing communications. You have the right not to be subject to automated decision-making and can require that any such decisions are reviewed by a human.
• You can lodge a complaint with the Supervisory Authority: If your personal data is being handled in a way that breaches applicable data protection legislation, you can lodge a complaint with us at DataPrivacy@tribalgroup.com. You also have the right to complain to the relevant Supervisory Authority. In the UK this is the Information Commissioner’s Office; in Australia the Office of the Australian Information Commissioner; and in the Philippines the National Privacy Commission.

How to contact us

We take the handling of your personal data very seriously.

If you have any questions or concerns about the way in which we collect, hold or process your personal data, or simply wish to exercise your rights in this respect, please contact us directly. The address for our Data Protection Office is DataPrivacy@tribalgroup.com.

If you are located in Australia

If you are located in Australia please view the Australian Privacy Policy.  

 

Last Reviewed 26th February 2024.