GDPR Compliance

Reading Solutions UK is fully GDPR Compliant.

The following information and links detail where your data is stored, how data is collected, how data is processed and on what lawful basis.

We also have a user-friendly GDPR FAQs PDF you can access here:

GDPR-FAQs

Additionally, we have created a pre-filled DPIA form using the ICO website template. Some sections will require your input. Please get in touch if you need any assistance or additional information to complete this.

Reading-Solutions UK DPIA Template

Documents applicable between Reading Solutions UK Ltd and Schools

1. Software as a Service Subscription Agreement

We have updated the Software as a Service Subscription Agreement that schools sign when they purchase or trial Reading Plus.  We have updated the relevant definitions at clause 1.1, the data protection provisions at clause 5 and added a copy of the Data Transfer Agreement that will be signed by each school and Reading Plus LLC as a new schedule 4 (see notes below re the data Transfer Agreement approach).  In particular, you will find the authority for Reading Plus to sign the Data Transfer Agreement on behalf of the school at clause 5.8.2.  We have prepared a new version of the agreement incorporating the updates which will be provided to any new school clients going forwards together with a Deed of Variation that will be provided to existing school clients that have already signed the old version of the Software as a Service Subscription Agreement.

2. Terms of Service

We have updated the Terms of Service that apply when Reading Solutions UK Ltd provides supplemental/support services that assist schools in implementing and using Reading Plus but which fall outside of the standard support offered under the Software as a Service Subscription Agreement. We have updated the relevant definitions at clause 1.1 and the data protection provisions at clause 8. We have cross-referenced the Data Transfer Agreement set out in the Software as a Service Agreement and repeated the authority for Reading Plus to sign the Data Transfer Agreement on behalf of the school at clause 8.6.2.

Privacy Policies

1. Reading Solutions UK Ltd Privacy Policy

We have prepared an updated version of the Reading Solutions UK Ltd Privacy Policy which reflects changes to legislation following Brexit, the new status of Reading Plus LLC as a processor and the new data transfer mechanism implemented in light of Schrems II.

2. Reading Plus Application Privacy Policy

We have prepared an updated version of the Reading Plus Application Privacy Policy which reflects changes to legislation following Brexit, the new status of Reading Plus LLC as a processor and the new data transfer mechanism implemented in light of Schrems II.  Note that this policy does retain references to Privacy Shield.  Reading Plus LLC has retained its registration under the Privacy Shield and is still therefore required to include relevant wording to this effect in its policy for the benefit of its EU customers.  We have flagged the fact that this only applies to EU data subjects in the updated policy.

Data Transfer Agreements

1. Data Transfer Agreement (Customer Contact Data)

This agreement has been prepared to cover names and contact details for individuals at schools who are potential Reading Plus customers that Reading Solutions UK Ltd may use as a data controller in relation to the promotion and sale of Reading Plus.  Whilst this data is not routinely shared with Reading Plus LLC, the parties have recognised that in individual cases Reading Plus LLC may provide support services to assist Reading Solutions UK Ltd in relation to its promotion and sales activities and that data of individuals may be shared with Reading Plus LLC in the USA in the course of this e.g. names/contact details appearing in email correspondence).  To the limited extent that any such data is shared, Reading Plus LLC will only use this a processor for Reading Solutions UK Ltd in this course of providing support services to it.  The Data Transfer Agreement has been prepared to ensure that such transfers are not overlooked as it is recognised that they would not be covered under the Data Transfer Agreement (Customer Personal Data) which is entered into between each school and Reading Plus LLC.  This agreement can be seen at Schedule 5 to the Deed of variation of the Reseller Agreement and will be executed by the parties at the same time as they executed the Deed of variation.

 

You will note that we have used the EU SCCs and have amended these for use in a UK context as per the ICO’s model document available via its website here https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-transfers-after-uk-exit/sccs-after-transition-period/).  Reading Plus LLC instructed specialist privacy lawyers in the US to advise on transfer risks and relevant mitigation measures in light of the decision in Schrems II.  The risk and supplemental measures implanted to address them are detailed in the additional commercial clauses found at section 19 – 29 of the Data Transfer Agreement.

 

2. Data Transfer Agreement (Customer Personal Data)

 

This agreement has been prepared to cover personal data that is processed by Reading Solutions UK Ltd as a data processor for each school in the course of its use of the Reading Plus application.  As you are aware, that data will be transferred to and processed by Reading Plus LLC in the USA.  The parties had previously considered that Reading Plus LLC was likely to be acting as a data controller for this purpose but they have reviewed the nature of the processing undertaken by Reading Plus LLC and determined that Reading Plus LLC is in fact acting as a processor.  As you may be aware, there are no SCCs for use between processors and sub-processors.  As such, the Data Transfer Agreement has been prepared between the school as controller and Reading Plus LLC as the processor.  In order to facilitate the signing process, an authorisation for Reading Solutions UK Ltd to sign on behalf of the school has been included in the updated Software as a Service Subscription Agreement and in the Terms of Service.   Reading Solutions UK Ltd and Reading Plus LLC will sign a copy of this document in respect of each individual school as part of the on-boarding process (or when the Deed of Variation of the Software as a Service Subscription Agreement is signed for existing schools).  As such, each school will separately enter into SCCs directly with Reading Plus LLC so there will be no confusion regarding obligations and liabilities between different schools and a clear paper trail showing the effective date that the SCCs came into effect for each individual school.

 

You will note that we have used the EU SCCs and have amended these for use in a UK context as per the ICO’s model document available via its website here https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-transfers-after-uk-exit/sccs-after-transition-period/).  Reading Plus LLC instructed specialist privacy lawyers in the US to advise on transfer risks and relevant mitigation measures in light of the decision in Schrems II.  The risk and supplemental measures implanted to address them are detailed in the additional commercial clauses found at section 19 – 29 of the Data Transfer Agreement.

All of the above documents have been reviewed by counsel in the U.K. and the U.S. and approved by the Data Protection Officer (DPO) at Gateshead Local Authority. All documentation is fully GDPR compliant, and there are no new obligations or liabilities to schools.

 ICO Registration

Reading Solutions UK Ltd are registered to the ICO you can view the certificate of registration by clicking here.