Charanga Global Privacy Notice

Charanga Ltd is a UK-based music education and technology company that provides a configurable online music teaching and learning platform for schools worldwide. Charanga is part of the WiseMusic group, which includes MusicFirst based in the US.

Please contact us via our Privacy Team

By email: privacy@charanga.com

By mail:

Charanga Ltd
3rd Floor
Castle Square House
9 Castle Square
Brighton
BN1 1EG
UK

Personal data (also called personal information) identifies you as an individual.

Some examples are outlined below:

• Personal data is anything that may identify you, for example, your name, address, bank account details, internet protocol (IP) address, username or another identifier.

Some personal data is unique to you and, therefore, requires greater protection. This data is referred to as sensitive or special category data, and it includes information regarding your health, religious or philosophical beliefs, race or ethnicity, to provide a few examples. We do not intend or wish to collect sensitive or special category data. For more information, please refer to Section 6.

To operate effectively, we may request and collect information about you.

We collect personal data from you:

Directly:

when you enter, send us, or share with us information, such as if you request a free trial, register with us, purchase, review, or evaluate a product, contact us (including via email or customer contact forms) at conferences, events and exhibitions, subscribe to our newsletters or other communications, apply for vacancies and send us CVs, book to attend professional development and training, or send us feedback; and

Indirectly:

from school marketing agencies, social media such as LinkedIn, Facebook comments about Charanga, X, from our educational partners, music hubs, and your browsing activity while on our website; we will usually collect information indirectly using the technologies explained in the section on ‘Cookies and other tracking technologies’ below.

We may collect, use, store and transfer different kinds of personal information about you depending on our relationship with you:

• Identity data: may include first name, job title, role, organisation membership, and any other identity data that you may include in your communication with us.
• Contact data: this includes email address, school or educational facility name and address, work telephone number(s) and addresses.
• Marketing and communications data: includes your preferences in receiving marketing from us, your newsletter subscription preference and our third parties, and your communication preferences.
• Candidate data: includes information you have provided to us in your curriculum vitae, cover letter and/or application form, including name, title, address, telephone number(s), personal email address, date of birth, job title, job role, location, employment history, qualifications, areas of specialisms and registrations with professional bodies.
• Professional and employment data: employer, referee, profession, music speciality, skills and specialisms.
• Location data: we may collect your or your country, state, county, region, school district or local authority location data.
• Technical data: we may collect your IP address, login data, browser type and version, time zone setting and location, browser plugin types and versions, operating system and platform, and other technology on the devices you use to access our website.
• Usage data: includes information about how you use Charanga websites and resources on Charanga’s platform.

Sensitive or Special Category Data is personal data that needs more protection because it is sensitive. We do not intend or wish to collect this type of personal data from you in the course of providing our platforms or services or during our interactions with you.

Where you choose to provide us with this information in your communication with us, we will only process that sensitive personal information in such jurisdiction if and to the extent permitted or required by applicable law.

We need your personal information to conduct our business and provide you with our platform, website and services. Most commonly, we will use your personal information in the following circumstances:

• Where you have consented before the processing.
• Where we need to perform a contract, we are about to enter or have entered with you.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where we need to comply with a legal or regulatory obligation.

We will only collect, process and/or use the personal information where we are satisfied that we have an appropriate legal basis to do so.

EEA and UK residents: For more information on how we use and process your information, see section 18. Further information for EEA and UK residents.

Californian residents: For more information on how we use and process your information, see section 19. Further information for Californian residents.

Other State residents: For more information on how we use and process your information, see section 20. Further information for Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah and Virginia residents

If we rely on your consent to process your personal information, which may be express or implied consent according to the applicable law, you have the right to withdraw consent at any time. You can withdraw your consent by contacting us at privacy@charanga.com.

Please note that this will not affect the lawfulness of the processing before the withdrawal, nor will it, when applicable law allows, affect the processing of your personal information on the basis of any other lawful ground other than consent.

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We will review, monitor and update these security measures to meet our business needs, changes in technology and regulatory requirements. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties that have a business need to know. They will only process your personal information according to our instructions and are subject to a duty of confidentiality.

Unfortunately, the transmission of information via the Internet is not completely secure. Although we will do our best to protect your personal information, we do not have any control over what happens between your device and the boundary of our information infrastructure. You should be aware of the many information security risks that exist and take appropriate steps to safeguard your own information.

We have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

We will keep your personal information in accordance with our retention policy and applicable law for no longer than necessary to fulfil the purposes we collected it for, including satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal information, we consider the amount, nature and sensitivity of the personal information, the risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.

Insofar as reasonably necessary for us in delivering our products and services to you and for the purposes set out in this Privacy Notice, we may share your personal information with the below parties that help us manage our business and deliver our products or services:

• companies within the WiseMusic group.
• third parties we use to help deliver our products and services to you.
• other third parties we use to help us run our business, eg marketing agencies or website hosts.
• third parties approved by you eg rostering services such as Google Classroom which you choose to link your account.

We only allow those organisations to handle your personal information if we are satisfied that they take appropriate measures to protect it. We also impose contractual obligations on them to ensure they can only use your personal data to provide services to us and to you.

We or the third parties mentioned above occasionally also share personal data with:

• our and their external auditors, eg in relation to the audit of our or their accounts, in which case the recipient of the information will be bound by confidentiality obligations.
• our and their professional advisors (such as lawyers and other advisors), in which case the recipient of the information will be bound by confidentiality obligations.
• law enforcement agencies, courts, tribunals and regulatory bodies to comply with our legal and regulatory obligations.
• other parties that have or may acquire control or ownership of our business (and our or their professional advisers) in connection with a significant corporate transaction or restructuring, including a merger, acquisition, asset sale, initial public offering or in the event of our insolvency – usually, information will be anonymised, but this may not always be possible. The recipient of any of your personal data will be bound by confidentiality obligations.

We will not share your personal data with any other third party without your consent.

The specific kind of information we share will depend on your activities with us and only to the extent as required or permitted by law, and/or with your consent.

Please note however that this Privacy Notice does not apply to sharing of personal information by third party providers who may collect personal information from you and may share it with us. In these situations, we strongly advise you to review the applicable third party provider’s privacy notice before submitting your personal information. For further information please refer to Section 13.

We do business globally and may centralise certain aspects of our information processing activities and data storage in different countries. We may therefore have to share and transfer your personal information from one country to another, or even across multiple jurisdictions. Your personal information may therefore be subject to privacy laws that are different from those in the country where the personal information is collected or those in your country of residence.

We will ensure your personal information has an appropriate level of protection and will undertake appropriate due diligence and risk assessments prior to transferring the information. We will ensure the transfer of your personal information in line with applicable data protection law. Often, this protection is set out under a contract with the organisation that receives your personal information. You can find more details of the protection given to your information when it is transferred overseas by contacting us at privacy@charanga.com

Please note, however, that this Privacy Notice does not apply to the sharing of personal information by third-party providers who may collect personal information from you and may share it with us. In these situations, we strongly advise you to review the applicable third-party provider’s privacy notice before submitting your personal information.

You should be aware that information about your use of our website (including your IP address) may be retained by your ISP (Internet Service Provider), the hosting provider, and any third party that has access to your Internet traffic.

Our platform may contain links to third-party websites, plugins and services. If you choose to use these websites, plugins, or services, you may disclose your information to those third parties.

We are not responsible for the content or practices of those websites, plugins or services. The collection, use, and disclosure of your personal information will be subject to the privacy notices of these third parties and not this Privacy Notice. We urge you to read the privacy and cookie notices of the relevant third parties.

You may always choose what personal information (if any) you wish to provide to us. Please note, however, that our products and services cannot be provided to you if you choose not to provide certain details. For example, we cannot reply to you without your name or contact details; we cannot provide you with a login to our platform without your name and email address.

We also need your personal information to be able to assess your application for our vacant job roles.

If you provide us with your contact details (eg email address), we may contact you to let you know about the products, services, promotions and events offered that we think you may be interested in.

You can unsubscribe from our marketing and promotional communications by clicking on the unsubscribe link in the emails or by contacting us at privacy@charanga.com

You will then be removed from the marketing list; however, we may still communicate with you, for example, to send you service-related messages that are necessary to respond to requests for support or for other non-marketing purposes.

Each time you interact with our website, we may, depending on the consent provided and your jurisdiction, automatically collect personal information, including technical data about your device, your browsing actions and patterns, content and usage data. We collect this data using cookies, server logs and other similar technologies like pixels, tags and other identifiers in order to remember your preferences, to understand how our website is used, and to customise our marketing offerings.

Please see more information in our Cookie Notice here.

In some regions and states, such as Canada, California, Colorado, the EEA and the UK, you have rights that allow you greater control of and access to your personal information.

These may include your rights:

• to request and obtain a copy of your personal information
• to request rectification and/or erasure of your personal information
• to restrict the processing of your personal information
• regarding data portability (if applicable)

In certain circumstances you may also have the right to object to the processing of your personal data. You can make a request to exercise your rights by contacting us at privacy@charanga.com.

We will consider and act upon any requests in accordance with applicable data protection law.

We are subject to the UK General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation (EU GDPR) in relation to goods and services we offer to individuals and our wider operations in the UK and European Economic Area (EEA).

1. Details about our processing of your personal information

   The table below describes the ways we plan to use your personal data and which lawful basis we rely on to do so. We have also identified what our legitimate interests are where appropriate.

   LAWFUL BASIS	PURPOSE EXAMPLES
   Contract We use your personal information on the basis that it is necessary for us to evaluate applications and candidates for a vacant role prior to entering into an employment contract for that role with the most suitable candidate.	Recruitment of candidates (contractors, employees and providers) We will use the personal information we collect about you to assess your skills, qualifications and suitability for the role for which you applied. We may use the following personal data: identity data contact data location data candidate data
   Legitimate interest When we rely on this, we will carry out a Legitimate Interests Assessment to ensure we consider and balance any potential impact on you (both positive and negative) and your rights under data protection law. Our legitimate business interests do not automatically override your interests – we will not use your personal data for activities where our interests are overridden by the impact on you unless we have your consent or are otherwise required or permitted to by law.	Managing our business We process personal data for our own legitimate business interest. This relates to us managing our business to enable us to maintain and monitor the performance of our website, platform, products and services and to constantly look to improve the website platform, products and the services we offer to our customers and users, including when we respond to your queries and complaints. We may use the following personal data: identity data contact data technical data marketing and communications data Provide and maintain our websites To provide and maintain our website and platform, including to monitor the usage of these, troubleshooting, data analysis, network security and system testing necessary for our legitimate interests in maintaining the useability, security and integrity of our website and platform. We may use the following personal data: identity data location data transaction data technical data Recommendations and marketing To make recommendations to you about our products and services that may interest you. We may use the following personal data: identity data contact data technical data marketing and communications data usage data To measure and analyse the effectiveness of the advertising we serve you. We may use the following personal data: identity data contact data location data technical data marketing and communications data usage data To make suggestions and recommendations to you about goods or services that may be of interest to you and necessary for our legitimate interests (to develop our products/services and grow our business). We may use the following personal data: identity data contact data location data technical data marketing and communications data usage data Rights and claims To enforce or apply our website and Platform Terms of Use, our policy terms and conditions or other contracts. To exercise our rights, to defend ourselves from claims and to keep to laws and regulations that apply to us and the third parties we work with. We may use the following personal data: identity data contact data transaction data technical data profile data usage data Data subject rights Verifying your identity when you exercise your data subject rights. Fulfilling data subject rights requests. We may use the following personal data: identity data contact data location data technical data usage data candidate data Operating our business Necessary for our legitimate interests – for running our business, provision of administration and IT services, network security, to prevent fraud, and in the context of a business reorganisation or group restructuring exercise. We may use the following personal data: identity data contact data location data technical data marketing and communications data usage data
   Legal obligations We may use your personal data to comply with laws (for example, if we are required to co-operate with a police investigation after a court order orders us to).	Legal requirement The processing is necessary for compliance with legal obligations, such as but not limited to security requirements. To comply with applicable law, for example in response to a request from a court or regulatory body, where such request is made in accordance with the law. Criminal activity To detect fraudulent or criminal activity, we may share information with forces such as the police.
   Consent We may have to get your consent to use your personal data, such as about you or when we want to send you marketing. Wherever consent is the only reason for using your personal data, you have the right to change your mind and/or withdraw your consent at any time by clicking the unsubscribe button at the bottom of an applicable email or by contacting us.	Marketing To measure and analyse the effectiveness of the advertising we serve you. We may collect IP addresses and store cookies on visitors’ devices. We may use the following personal data, depending on what you consent to: identity data contact data location data technical data marketing and communications data usage data candidate data Data analytics We use data analytics to improve our website, products/services, marketing, customer relationships and experiences. We may use the following personal data: identity data transaction data technical data profile data usage data

2. Your rights

   Please see more details about your rights in the table below. In most circumstances, you do not need to pay any charge for exercising your rights. We have one month to respond to you.

   YOUR RIGHT	DETAILS
   Right to be informed	We have a legal obligation to provide you with concise, transparent, intelligible and easily accessible information about your personal information and our use of it. We have written this notice to do just that, but if you have any questions or require more specific information you can contact us at privacy@charanga.com.
   Right of access	You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information. When you request this data, this is known as making a data subject access request (DSAR). In most cases, this will be free of charge; however, in some limited circumstances, for example repeated requests for further copies, we may apply an administration fee.
   Right to rectification	You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies.
   Right to erasure	You have the right to ask us to erase your personal information in certain circumstances. We have the right to refuse to comply with a request for erasure if we are processing the personal data for one of the following reasons: To exercise the right of freedom of expression and information. To comply with a legal obligation. To perform a task in the public interest or exercise official authority. For archiving purposes in the public interest, scientific research, historical research or statistical purposes. For the exercise or defence of legal claims.
   Right to restriction of processing	You may ask us to stop processing your personal data. We will still hold the data but will not process it any further. This right is an alternative to the right to erasure. If one of the following conditions applies, you may exercise the right to restrict processing: The accuracy of the personal data is contested. Processing of the personal data is unlawful. We no longer need the personal data for processing, but the personal data is required for part of a legal process. The right to object has been exercised and processing is restricted pending a decision on the status of the processing.
   Right to object to processing	You have the right to object to processing in certain circumstances. You can also object if the processing is for a task carried out in the public interest, the exercise of official authority vested in you or your legitimate interests (or those of a third party).
   Right to data portability	This right only applies if we are processing information based on your consent or for the performance of a contract and the processing is automated.

3. Complaints

   We hope that we can resolve any query or concern you raise about our use of your information. Please contact us at privacy@charanga.com first and title your email ‘Complaint’. All complaints will be treated in a confidential manner, and we will try our best to deal with your concerns.

   You have the right to lodge a complaint with a supervisory authority in the EEA member state where you work or normally live, or where any alleged infringement of Data Protection Law occurred.

   The details of European supervisory authorities can be found here: Our Members | European Data Protection Board (europa.eu)

   The supervisory authority in the UK is the ICO, which may be contacted at https://ico.org.uk/concerns or by telephone on 0303 123 1113.

1. Rights of California residents

   We do not sell your personal information.

   Under California’s Shine the Light law, website visitors who are California residents may request and obtain a notice once a year about the personal information we share with other businesses for their direct marketing purposes. Such a notice includes a list of the categories of personal information that was shared (if any) and the names and addresses of all third parties with which the personal information was shared (if any). The notice covers the preceding calendar year. To obtain such a notice, please contact us at privacy@charanga.com.

   Verified California residents have the right to:

   • Request and receive a copy of the personal information we have collected about them during the prior 12 months. We will endeavour to provide the information in a format that is readily useable, including by mailing you a paper copy or providing an electronic copy.
   • Request and receive disclosure of our information-sharing practices during the prior 12 months, including a list of the categories of personal information sold with the category of third-party recipients and a list of the categories of personal information that we disclosed for a business purpose.
   • Request that we not sell personal information about them.
   • Request that we delete (and direct our service providers to delete) their personal information subject to certain exceptions.

   For purposes of the CCPA, personal information means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household.

   In order to make a request for disclosure, California residents may contact us at privacy@charanga.com. We will ask you for information that allows us to reasonably verify your identity (that you are the person about whom we collected personal information) and will use that information only for that purpose.

   For requests for deletion of your information please understand that California law permits us to retain certain information and not to delete it under certain circumstances. By way of example, we are not required to comply with a request to delete information if the information is necessary for us to complete a transaction for you or otherwise perform a contract; to detect, protect against, or prosecute security incidents, fraud or illegal activity; to use the information only internally in ways reasonably aligned with your expectations as our customer (such as maintaining sales records), and to comply with legal obligations. If we receive such a request from you, we will notify any service providers we have engaged to delete your information as well.

   We will not discriminate against you as a result of your exercise of any of these rights.

   In addition, under this law, you are entitled to be advised how our site handles ‘do not track’ browser signals. We do not use technology that recognises do not track signals from your browser.

Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah and Virginia provide (now or in the future) their state residents with rights to:

1. Confirm whether we process their personal information.
2. Access and delete certain personal information.
3. Correct inaccuracies in their personal information, taking into account the information's nature processing purpose (excluding Iowa and Utah).
4. Data portability.

5. Opt-out of personal data processing for:

   • targeted advertising (excluding Iowa);
   • sales; or
   • profiling in furtherance of decisions that produce legal or similarly significant effects (excluding Iowa and Utah).
6. Either limit (opt-out of) or require consent to process sensitive personal data.

The exact scope of these rights may vary by state. To exercise any of these rights please contact us at privacy@charanga.com setting out the state in which you are resident and the rights you wish to exercise. To appeal a decision regarding a consumer rights request, please contact us at paulfletcher@charanga.com.

Nevada provides its residents with a limited right to opt out of certain personal information sales. Residents who wish to exercise this sale opt-out rights may submit a request to this designated address: privacy@charanga.com. However, please know we do not currently sell data triggering that statute's opt-out requirements.

If you have any questions, concerns or complaints about this Privacy Notice, or our privacy practices in general, please email us at privacy@charanga.com.