30 June 2020
In this policy, we often refer to “Kubify,” “we,” or “us”. By this, we mean Kubify BV, which controls the information that our platform collects when you use our Services. Kubify provides as part of its services the Learning Toolbox platform (“Learning Toolbox”) for the exchange of information, documents, videos, and other multimedia content, which is accessible by Users either through a web browser or a mobile application (‘App’). The App is free of charge and its use is subject to the User Conditions available on the Website and in the App. Kubify also runs a website that includes support pages. In this policy, we refer to Learning Toolbox, the App, and website as “Services”.
Information we collect about you
The information we collect about you is either provided directly by you to us, or it is automatically created when you use our Services, or it comes from other sources.
Information you directly provide to us
Learning Toolbox account information: When you register for a Learning Toolbox account, we collect information about you such as your email and optionally your name.
Stack content: When you use our Services, we collect and store content that you upload, link to, and share. This includes any information that you choose to make available through a Stack. It also includes files and web URLs that you upload to the Stack. And it includes any information that you choose to share through the Stack chat channel.
Information sent to our support channels: When you experience a problem with our Services, we offer you an email ticketing system, subject to your subscription plan, where you can report the issue and get help. In the course of providing the support to you, we will ask certain information from you, for instance your email, a description of the problem, possibly screenshots and other supporting documents.
Payment information: When you buy a domain in Learning Toolbox, we collect certain billing information from you such as your contact details, VAT number, and billing address. You will also provide payment information such as credit card details, which we collect through a secure payment processing service partner.
Information automatically created when you use our Services
When you use our services: When you access and interact with our Services, we collect certain information. This includes the Stacks you use, the Tiles you click on in the App, the Stack search terms you use, and the names, sizes, and types of files that you upload through Learning Toolbox.
Devices: Kubify logs the use of the App on basis of the unique device ID
Information about you from other sources
Other Learning Toolbox users: In some cases, other users may provide information about you when they are submitting content, for instance when they upload a photo where you appear, mention your name in the Stack chat, or upload a file that has information about you.
Third-party authentication: When you use as social media account, such as Google, Facebook, LinkedIn, or Microsoft, to register or sign in to our Services, we receive your name and email address as permitted by your social media provider settings so that we can authenticate you.
How we use information about you
To provide our Services to you: We use your information to provide you with our services, for instance to authenticate you when you log in to Learning Toolbox or when we provide support to you via email. We also collect information about how you use the Stacks that you open in our App in order to combine this information into statistics that are shown to the authors of the Stacks. This enables Stack authors for instance to improve their Stacks by understanding what content matters most to their audience.
To communicate with you about our Services: We use the contact information you provided to us to email you, for instance to confirm your registration, to send you a ‘forgotten password’ link, to remind you when your subscription expires, to respond to your inquiries about our Services, to provide support when you request it, and sending you any other technical or administrative notifications that you need so you are better able to use our Services. In some cases an opt-out from these communications is available as part of the communication itself or in the account settings. When you subscribe to a Stack by favouriting it, we also send you mobile notifications about activities in that Stack. You can easily opt out from notifications by unfavouriting a favourited Stack or by changing the notification settings on your mobile device.
To provide you with customer support: When you encounter technical difficulties with our Services, we use your information to respond to your support requests and, in cases where this is necessary to fix the problem, to replicate your issue and analyse log files on the server. In cases where this is necessary and where you give us permission, we also analyse the error log file from the App on your mobile device.
To safeguard our Services and your content: To protect you and our Services, we use information about you to verify logins into your account and to monitor activities on our servers, to detect suspicious activities and violations of terms of service and other contractual agreements.
To protect our legal rights and legitimate business interest: We use information about you when required by law or when we need to protect our rights and interests or those of others. For example, we might use information about you when dealing with legal claims or regulatory compliance, or when we merge or sell our business.
To research and innovate: We will collect over time information about how you use our Services so that we better understand your needs and preferences, choose what to focus our development resources on, and how to create Services that are better and more useful to you. For instance, when you and other users work with Learning Toolbox or otherwise use our Services, we collect information about the data load on our servers to determine potential bottlenecks and plan for better resource use or to expand our cloud infrastructure.
For other purposes, with your consent: For any other purpose not listed above, we use information about you only when you give us your explicit consent.
Users of the EEA (European Economic Area): If you are a resident of the EEA, we only collect and process information about you where we have a legal basis for. More specifically, we use information about you only if we require it as part of our Services, or if it serves a legitimate interest such as to improve our Services, to provide support, or to protect our legal rights and business interests, or if you have provided explicit consent to do so for a particular use, or where we are legally required to do so.
For those cases where you have provided us with explicit consent, you have the right to change your mind and withdraw consent for any future use of information about you for the particular purpose you originally consented to. Where we or a third party such as the organisation you work for have a legitimate interest to use information about you, you have the right to object to that use. However, in some cases this will mean that you will not any longer be able to use our Services.
How we share information about you
With other users of our Services
For sharing, collaboration, and communication: The content that you create or upload to Learning Toolbox might contain information about you, and depending on the permissions you as an author or administrator have set, others are able to see, download, share, or copy that content. If you use the Stack chat or if you upload content to a stack, we show the initials of the name that you have provided when you registered with our Services. When you join a domain or when an administrator adds you to a domain, every administrator will see your email address. Please be aware that authors and administrators will be able to change settings so that in certain cases content from you that could previously not be seen, shared, copied, or downloaded by other users can then be seen, shared, copied, or downloaded respectively. You can check the privacy settings for the Stack and for your content directly in the App.
For domains administrators: If you access the Services through a domain that is owned by your employer or organisation, certain information about you including your email address, content, and past use of Stacks you access may become accessible to that organisation’s administrator and other Service users sharing the same domain. If you are an administrator for a particular domain within the Services, we may share your contact information with current or past Service users, for the purpose of facilitating Service-related requests.
With third parties
External service providers: We use external service providers for our website hosting, for our application servers, and for payment processing. These third parties might need to access information about you, in which case they do this under instructions from us and under procedures established to protect your information.
For other purposes, with your consent: Apart from the cases listed above, we do not share information about you with third parties unless you give us explicit consent. We will under no circumstances sell information about you to other organisations or individuals.
Financing, merger, and sale
We might share information we have collected about you in case of a financing deal, a merger, or a sale of Kubify to another company. If this happens, you will be notified through our Services and we will inform you about the rights you have regarding the transfer of the information.
How we store information about you
Where we store information about you
All information about you is stored securely on servers located in the European Union. We have taken all reasonable technical and organisational measures to protect your personal data against loss and fraudulent access, including storage of your information in secure data servers using encrypted passwords and secure backups, restricted access to your information through your personal account protected with a unique username and password, and use of encryption protocols and secure services for payments.
While we take every precaution to store and process your information securely, there exists unfortunately no completely failsafe security system and we cannot guarantee that information stored on the servers and transmitted via the Internet is 100% safe from unauthorised access by others. Where we detect an intrusion that puts the security of your information at risk, we will take countermeasures within a reasonable timeframe.
How long we keep information about you
Account information: We keep information about you that you provided when you registered and information about you that we automatically collected from your use of our Services until you delete your account. In some cases, for instance because we are legally required to do so or because we want are continually improving our Services, we might keep information after you deleted your account. Where we keep information to improve our Services, we will not use this information to analyse personal characteristics of you and we also delete information that directly identifies you.
Information you share: When you delete your account, some information about you that you shared with others remains in place. In some cases, for instance in the Stack chat where we identify your messages by the initials of the name you registered with, we anonymise this information. In cases where we you have co-authored a Stack, the information that you shared remains in the Stack but where we identify the content uploaded by you by your initials, we will anonymise these.
Domains you are a member of: Where you have joined a domain administered by others, some of the Services such as the ability to create stacks are made available to you through the organisation (for instance your employer or your college) that controls the domain. As the administrator of these Services, the organisation is responsible for the domain it controls and the end user it invites into their domain. In that case, please direct any of your privacy queries to the domain administrator, since your use of our Services is subject to that organisation’s policies and security practices.
How you can control information about you
There are a number of choices available to you about the collection, use, sharing, and storing of information about you. Specifically, you have the right to request an electronic copy of your information or the deletion of information about you that we store on our servers. To exercise some of your rights to control your information effectively, we provide you with the necessary tools within the settings in our Services.
Where you are a member of a domain that you are not an administrator of, you might have to contact the administrator of that domain first with your request. For example, an administrator of the domain you are a member of can change your authoring permissions so that you might not be able to delete certain content in your Stack anymore unless you delete your account. Please see the “Notice to End Users” below for more information.
For all other requests, you can contact us at firstname.lastname@example.org.
Limitations of your rights
There might be limitations regarding your rights to obtain or delete information, for example when your request would reveal information about another user or when your request requires deleting information which we or your domain administrator has a legitimate interest to keep. For instance, if you are an employee of an organization and have created stacks for them, you might be legally or otherwise prohibited to delete that information without prior consent of your employer. Please refer to the “Notice to End Users” below for further details.
If you feel that any of your concerns regarding your information are not resolved to your satisfaction, you should consider contacting the data protection authority in your country of residence.
Access and update your information
Within our Services we provide you with the ability to access and update your information. For example, you can update information about you such as your contact details from within your account settings. You can also access, update, change, and delete content you have uploaded to your stacks or those of others. If you are a member of a domain that you are not an administrator of, an administrator of the domain might restrict your ability to make changes to your stacks or the content you have uploaded. See “Limitations of your rights” above for examples where this might be legitimate.
Discontinue your domain membership
Where you are a member of a domain, you or an administrator can remove you from the domain. Please be aware that removing you from a domain doesn’t delete the stacks you are an author of from that domain. After you have been removed from a domain, a domain administrator might restrict your ability to access, edit, or delete your stack or the content in your stack. For example, if you are an employee of an organisation that administers a domain, they might have a legitimate interest in or be the legal owners of the content or stack that you created. Please refer to the “Notice to End Users” below for further details. For more information about how to delete your information, see below.
Delete your information
Using our Services, you can delete certain information about you. You can use the stack editing tools to delete content that you added to stacks that you are an author of or you can delete full stacks that you own. If you have uploaded content to a stack via the App, you can delete that content directly from the App. Please be aware that we might have to keep certain information to comply with our legal obligations or because the administrator of a domain has a legal right or legitimate interest in the information. For example, if you created a stack as part of employment in the domain administered by your employee, you might not have the right to delete some or all information about you related to the stack. Please refer to the “Notice to End Users” below for further details.
Ask for a copy of your information
You can request an electronic copy of your account information such as contact data, current plan, and so on.
Ask us to stop using information about you
Where you believe we don’t have the appropriate rights to access, use, share, or store information about you, you can request us to stop doing so. For instance, if you are no longer an active user, you can request us to delete your account. If at any point you gave us consent to use information about you in a particular way, you can withdraw that consent at any time by contacting us, although this will not affect any processing that has already taken place. See “Limitations of your rights” for further cases where your rights might be restricted.
Opt out from communications: You can opt out or withdraw consent from any promotional communications by clicking on the ‘unsubscribe’ link in our emails to you or by contacting us using our contact details below. Please be aware that after you have opted out of promotional emails, you will still receive technical and service emails from us regarding our Services.
Notice to end users
Our Services are intended for business and institutional use only. Where you have joined a domain, some of the Services such as the ability to create stacks are made available to you through the organisation (for instance your employer or your college) that controls the domain. As the administrator of these Services, the organisation is responsible for the domain it controls and the end user it invites into their domain. In that case, please direct any of your privacy queries to the domain administrator since your use of our Services is subject to that organisation’s policies and security practices. Please be aware that we are not responsible for that organisation’s privacy policies and practices, which may be different to those outlined in this policy.
Domain administrators can restrict your access rights in their domain, for instance they can restrict your author privileges or remove you from their domain. They can also add new authors to your stack, move your stack, delete it, or prevent you from deleting your stacks. For example, if your employer controls the domain, you might not be legally allowed to delete stacks or remove content without their prior consent. If you do not want a domain administrator to assert control over your stacks or content, you should deactivate your membership from that domain. Be aware that you might not have access to your stacks afterwards depending on whether the domain administrator has restricted the access. However, after you have joined a domain managed by your organisation, and depending on your organisation’s policies, you might not be able to withdraw your membership without the domain administrator’s prior approval. Please contact your organisation and consult your organisation’s policies for more information.
Where an individual is under 16, they will need the permission of a parent or guardian to create an account with their personal information and exercise their rights under this policy.
3513 EA Utrecht