Our Privacy Policy

LAST UPDATED: March 16, 2021

SECTION I: Introduction

This Privacy Policy applies to activities by Loop Data (founded under the name Obi LLC) and all affiliates, subsidiaries and related entities (collectively “Loop Data,” “we” or “us”). The terms "You" and "User" refer only to organizations that have entered into a contract with Loop Data or may do so in the future and to the specific employees and contractors of such organizations that regularly interact with student data (typically information technology staff members). Teachers, students and parents are not included in the definition of "You."

The core purpose of Loop Data is to help education institutions manage student and other data securely, efficiently and with the greatest respect for student data privacy. This privacy policy (“Privacy Policy”) describes our policies and procedures about the collection, use, disclosure and sharing, or other processing of your personal information when you use our websites, as well as when you interact with or participate in our events, programs, trainings and our other services and offerings (collectively, the “Services”).  The policy also describes our policies and procedures about the collection, use, disclosure and sharing, or other processing of personal data regarding students, teachers and other people that may be included in the data you store and manage with Loop Data services. The Privacy Policy does not apply to information collected about Loop Data employees or other Loop Data personnel.

For purposes of the GDPR and similar laws using the same terms, Loop Data is the controller of your personal information. Where processing of personal information is undertaken by our affiliates, subsidiaries and related entities, they are a joint controller with Loop Data for your personal information.

Capitalized terms that are not defined in this Privacy Policy have the meaning given them in our Terms of Use (the “Terms”).  In this Privacy Policy, “personal information” includes references to “personal data” as defined under applicable laws. Your use of our Sites and Services, and any dispute over privacy, is subject to this Policy and the relevant Terms, including the applicable limitations on damages and the resolution of disputes.  The Terms are incorporated by reference into this Policy.

SECTION II: Integration Personal Data—What We Collect About Your Institution's Students, Staff, and Interested Third Parties

Loop Data's services are primarily about data interoperability; as such we collect, store, transform and transmit Integration Personal Data. Integration Personal Data is defined as personally identifiable information about students, faculty, other staff members, parents, guardians and other persons when such data is available in records provided to Loop Data by the customer for use in automated interoperability efforts. Persons may request viewing, modification or removal of their records from the Integration Personal Data; in such cases Loop Data will work with the institutional customer to fulfill the request. Loop Data does not collect information about students, faculty or any other persons listed through any means other than as just described (except for Users, who are typically only the customer's information technology staff, as described in Section III).

FERPA School Official Exception: In the United States, Integration Personal Data regarding students is subject to the Family Educational Rights and Privacy Act (FERPA) and relevant regulations. We comply with the requirements imposed by the US Department of Education under the “school official exception.”

Transmission to Third Parties. The core of Loop Data's service is to transmit Integration Personal Data between software applications used by the institutional customer, but only as designated and authorized by the customer. Some of these applications may be operated or hosted by third parties. We strongly recommend that our institutional customers carefully review the privacy commitments of their vendors before sharing data with them.

Platform Providers. Loop Data uses a platform provider, Kimono, to store and manage data. Kimono has committed to similar principles of data protection as Loop Data. See https://web.kimonocloud.com/privacy for details. In order to use Loop Data's services you will have to also agree to Kimono's Terms of Use and Privacy Policy. If Loop Data uses other platform or infrastructure providers we will contractually ensure the security and privacy of all data in accordance with the latest version of the Student Privacy Pledge signed by us at that time.

De-identified Information. We will not de-identify and aggregate Integration Personal Data except as directed in writing by the originating customer and then only for customer purposes.

SECTION III: Personal Information That Loop Data Collects About Users (You)

We collect personal information about Users directly from individuals, from educational institutions, from other third parties, and automatically through the operation of our products and services. You do not have to provide us your personal information.  However, if you choose not to disclose certain information, we will not be able to provide you with access to our services and features.

User Registration Information. We collect personal information when your employer is a customer of Loop Data and an authorized person adds a user account with your name or email address.

Business Information. In the normal course of business we collect contact information for people we serve or work with, such as customers, prospective customers, partner organizations, contractors, and vendors.

Your Content. We collect and store the information and content that you create in working with our services, including your support requests as well as configuration changes and the data resulting from those changes.

Communications. When you communicate with us (via email, phone, through our support site or otherwise), we may maintain a record of your communication.

Payment Information. To purchase services (including registering for events, training and certification exams), users may be asked to be directed to a third-party site, such as Paypal or Quickbooks, to pay for their purchases. If applicable, the third-party site may collect payment information directly to facilitate a transaction. Loop Data will also records the result of the transaction and any other data about the transaction record provided by the third-party site.

Automatically Collected Information. In addition, Loop Data may automatically collect the following information about your use of our sites or services through cookies, web beacons, and other technologies: your domain name; your browser type and operating system; web pages you view; when you open certain emails we send; links you click; your IP address; your country of location; the length of time you visit our sites and or use our services; and the referring URL, or the webpage that led you to our Sites. We may combine this information with other information that we have collected about you, including, where applicable, your user name, name, and other personal information.

De-identified Information. We may de-identify and aggregate certain User personal information we collect such that the information no longer identifies or can be linked to a particular user or an individual data subject (“De-identified Information”), subject to the terms of any applicable user agreements. We may use this information to improve our Services, analyze trends, publish market research, and for other marketing, research or statistical purposes, and may disclose such information to third parties for these specific purposes.

Purposes and Legal Bases for Our Using of Personal Information

Purposes and Legitimate Interests For Integration Personal Data
Loop Data uses the Integration Personal Data for our legitimate business interests, which include the following purposes:

• Providing our services. To provide for the data integration needs of each customer as requested by authorized employees of that customer.
  
• Compliance. To comply with legal obligations and requests. For example, to comply with laws that compel us to disclose information to public authorities, courts, law enforcement or regulators, maintain records for a certain period, or maintain records demonstrating enforcement and sublicensing of our trademarks.
  
• Business and Legal Operations. As part of our general business and legal operations (e.g., accounting, record keeping, and for other business administration purposes), and as necessary to establish, exercise and defend (actual and potential) legal claims.
  
• Prevent Misuse. Where we believe necessary to investigate, prevent or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person or violations of this Privacy Policy or any relevant contractual terms.
  
  

Purposes and Legitimate Interests For User Information
Loop Data uses the personal information we collect about Users and other persons not included in the Integration Personal Data for our legitimate business interests, which include the following purposes:

• Providing our services. To provide the services, to communicate with you the User about your use of our services, to respond to your inquiries, provide troubleshooting of the services and for other purposes to support users and the community.
  
• Personalization. To tailor the content and information that we may send or display to you, to offer location customization and personalized help and instructions and to otherwise personalize your experiences.
  
• Marketing and Promotions. For marketing and promotional purposes, such as to send you news and newsletters, special offers, and promotions, or to otherwise contact you about new features, events, trainings or other information we think may interest you related to Loop Data, and, subject to applicable law, our affiliates, subsidiaries and managed services entities.
  
• Advertising. For targeting advertising to you on our sites and third-party sites and measuring the effectiveness and reach of ads and services (through third-party ad networks and services).
  
• Analytics. To gather metrics to better understand how Users access and use our sites; to evaluate and improve the sites, including personalization, to develop new services; and to understand metrics regarding the health of our services.
  
• Compliance. To comply with legal obligations and requests. For example, to comply with laws that compel us to disclose information to public authorities, courts, law enforcement or regulators, maintain records for a certain period, or maintain records demonstrating enforcement and sublicensing of our trademarks.
  
• Business and Legal Operations. As part of our general business and legal operations (e.g., accounting, record keeping, and for other business administration purposes), and as necessary to establish, exercise and defend (actual and potential) legal claims.
  
• Prevent Misuse. Where we believe necessary to investigate, prevent or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person or violations of this Privacy Policy or any relevant contractual terms.
  
  

Purposes and Legal Bases

Purposes of Processing (see above)	Legal Bases of Processing (EU Users)
Providing our services	Our Legitimate Business Interests Where Necessary to Enter into or Perform a Contract with You (upon your request, or as necessary to make the Services available) Compliance with Law Where permitted, with Your Consent (where we process any sensitive personal information you voluntarily provide – e.g., for diversity-related purposes)
Personalization	Our Legitimate Business Interests
Marketing and Promotions	Our Legitimate Business Interests With Your Consent
Advertising	Our Legitimate Business Interests With Your Consent
Analytics	Our Legitimate Business Interests Where permitted, with Your Consent (where we process any sensitive personal information you voluntarily provide – e.g., for diversity-related purposes)
Compliance	Our Legitimate Business Interests Compliance with Law As Necessary to Establish, Exercise and Defend Legal Claims
Business and Legal Operations	Our Legitimate Business Interests Compliance with Law Necessary to Establish, Exercise and Defend Legal Claims
Prevent Misuse	Our Legitimate Business Interests Compliance with Law As Necessary to Establish, Exercise and Defend Legal Claims

Sharing of Personal Information
We disclose personal information of all types as set forth below:

• Service Providers. We may share your information with third party service providers who use this information to perform services for us, such as payment processors, hosting providers, integration providers, auditors, advisors, contractors and consultants.
• Affiliates. The information collected about you may be accessed by or shared with subsidiaries and affiliates of Loop Data, whose use and disclosure of your personal information is subject to this Privacy Policy, unless an affiliate has its own separate privacy policy which is equally or more protective of individual privacy.
• Organizational Events. We may disclose or transfer information, including personal information, as part of any merger, sale, and transfer of our assets, or restructuring of all or part of our business operations, bankruptcy, or similar event, including in negotiations, due diligence, and integrations related to such transactions. We promise hereby to require any such acquiring organization to sign the Student Privacy Pledge 2020 (or later) or to enter into equivalent binding contractual requirements as a condition of such transaction.
• Legally Required. We may disclose your information if we are required to do so by law (including to law enforcement in the U.S. and other jurisdictions).
• Protection of Rights. We may disclose information where we believe it necessary to respond to claims asserted against us or, comply with legal process (e.g., subpoenas or warrants), enforce or administer our agreements and terms, for fraud prevention, risk assessment, investigation, and protect the rights, property or safety of Loop Data, its Users, participants in its events or Projects, or others.

Cookies, Tracking, and Interest-Based Ads
We and our third-party providers use cookies, clear GIFs/pixel tags, JavaScript, local storage, log files, and other mechanisms to automatically collect and record information about Your usage and browsing activities on our web site and across third party sites or online services. We may combine this information with other information we collect about Users. Below, we provide a brief summary these activities.

• Cookies. These are small files with a unique identifier that are transferred to your browser through our websites. They allow us to remember users who are logged in, to understand how users navigate through and use the sites, and to display personalized content and targeted ads (including on third party sites and applications).
• Pixels, web beacons, clear GIFs. These are tiny graphics with a unique identifier, similar in function to cookies, which we track browsing activities. We sometimes use these in our emails to let us know when they have been opened or forwarded, so we can gauge the effectiveness of our communications.
• Analytics Tools. We may use internal and third-party analytics tools, including Google Analytics. The third-party analytics companies we work with may combine the information collected with other information they have independently collected from other websites and/or other online products and services. Their collection and use of information is subject to their own privacy policies.

Please note that Loop Data does not respond to browser “do not track” signals or other similar mechanisms intended.

Targeted Ads. We may work with third party advertisers to display more relevant ads on third party sites; these third parties may display ads to you based on your visit to our sites and other third party sites.

Data Security
We have implemented commercially reasonable precautions designed to protect the information we collect from loss, misuse, and unauthorized access, disclosure, alteration, and destruction. Please be aware that despite our best efforts, no data security measures can guarantee 100% security.

You should take steps to protect against unauthorized access to your passwords, phone, and computer by, among other things, signing off after using a shared computer, choosing robust passwords that nobody else knows or can easily guess, not using a password for more than one site or service, and keeping your logins and passwords private. We are not responsible for any lost, stolen, or compromised passwords or for any activity on your account via unauthorized password activity.  We ask you to promptly notify us if you become aware that any information provided by or submitted to us is lost, stolen, or used without permission at privacy@loopdataservices.com.

Marketing Choices
You may opt out of or withdraw your consent to receive direct marketing emails from us by using the unsubscribe or opt out mechanisms included in our marketing emails or by emailing privacy@loopdataservices.com. You may also unsubscribe from mailing lists via the applicable mailing list’s subscription website or, in some cases, by using the unsubscribe mechanisms included in such emails.

Retention of Your Personal Information
We generally keep personal information only for as long as required to fulfill the purposes for which it was collected. However, in some circumstances, we may retain personal information for other periods of time, for instance where we are required to do so in accordance with legal, tax and accounting requirements, or if required to do so by a legal process, legal authority, or other governmental entity having authority to make the request, for so long as required.  In specific circumstances, we may also retain your personal information for longer periods of time corresponding to a statute of limitation, so that we have an accurate record of your dealings with us in the event of any complaints or challenges.

International Transfers
If you are located within the European Economic Area, the United Kingdom or Switzerland, you should note that your personal information will be transferred to countries outside these jurisdictions, including the United States where Loop Data is located.  The U.S. is deemed by the European Union to provide inadequate data protection.  If you deem it necessary, contact us about applying European Commission approved Standard Contractual Clauses and other means to provide for adequate safeguards to protect personal information transferred outside these jurisdictions.  You have a right to obtain details of the mechanism under which your personal information is transferred outside of the EU by emailing privacy@loopdataservices.com.

Children’s Privacy
We do not knowingly collect or solicit personal information from anyone under the age of sixteen (16), or knowingly allow such persons to become Users. Most Integration Personal Data stored and transmitted by Loop Data will include data about persons under the age of sixteen (16); regardless of age, the protections outlined under Section II above will always apply to Integration Personal Data.

Links to Third Party Sites and Services
Our web site and services may contain links to third party sites or online services. Please refer to the privacy policies of the relevant third party websites or services to find out more about how they process and handle personal information.

Your Rights

Access and Amendment. You may contact our privacy coordinator at privacy@loopdataservices.com for help accessing or amending your personal information.

Additional Rights. Individuals in the European Economic Area (and other jurisdictions where applicable) have additional rights under applicable law:

• to obtain a copy of your personal information together with information about how and on what legal basis that personal information is processed;
• to rectify inaccurate personal information (including to have incomplete personal information completed);
• to erase your personal information (in limited circumstances, such as where it is no longer necessary in relation to the purposes for which it was collected or processed);
• to restrict processing of your personal information under certain circumstances;
• to export certain personal information in machine-readable format to a third party (or to you) when we justify our processing on the basis of your consent or the performance of a contract with you and the processing is carried out by automated means;
• to withdraw your consent to our processing of your personal information (where that processing is based on your consent, without affecting the lawfulness of processing based on consent before its withdrawal);
• to obtain, or see a copy of the appropriate safeguards under which your personal information is transferred to a third country or international organization; and
• to object to our use and processing of your personal information that is conducted on the basis of our legitimate interest. You also have the right to object at any time to any processing of your personal information for direct marketing purposes, including profiling for marketing purposes.

Lodging a Complaint. You also have the right to lodge a complaint with your local supervisory authority for data protection, or privacy regulator. A list of data protection supervisory authorities is available here.

Submitting a Request. To exercise the above rights or contact us with questions or complaints regarding our treatment of your personal information, contact us at privacy@loopdataservices.com. Please note that we may request proof of identity, and we reserve the right to charge a fee where permitted by law, especially if your request is manifestly unfounded or excessive. We will respond to your request within the applicable timeframes set out by law.

California Privacy Rights
California law permits users who are California residents to request and obtain from us once a year, free of charge, a list of the third parties to whom we have disclosed their personal information (if any) for their direct marketing purposes in the prior calendar year, as well as the types of personal information disclosed to those parties. If you are a California resident and would like to request this information, please submit your request in an email to privacy@loopdataservices.com. We may ask you to verify your California residency.

Contact Us
If you have any questions about our practices or this Privacy Policy, please contact us at privacy@loopdataservices.com, or write to us at: Loop Data, Attn: Legal Department, 26 S. Rio Grande Street, Suite 2072, Salt Lake City, UT 84101, USA.

Changes to the Privacy Policy
This Policy is current as of the effective date set forth above. If we make any changes to this Privacy Policy that materially change how we treat your personal information, we will endeavor to provide you with reasonable notice of such changes, such as via prominent notice on our web sites or to your email address of record, and where required by law, we will obtain your consent or give you the opportunity to opt out of such changes.