Staff & Instructor Privacy Notice

This Privacy Notice is provided in Japanese and English. If there is any inconsistency between the two versions, the Japanese version prevails.

1. Introduction

This Privacy Notice explains how ELT Education Inc. ("we", "us" or "our") handles the personal data of users of the business system "ELT Core Platform" (the "System") that we operate.

This notice does not form part of any employment contract or service agreement with users.

1.1 Who this notice applies to

Staff and instructors are together referred to as "users".

1.2 What data this notice covers

This notice covers the personal data of the users themselves.

In this notice, "personal data" means personal information and personal data as defined in Japan's Act on the Protection of Personal Information (APPI). For users to whom the UK GDPR or the EU GDPR applies, it also includes personal data as defined in those laws.

The personal data of customers (students and guardians) that users view in the course of their work is not covered by this notice. Users are obliged to protect the personal data of customers that they learn through their work. The details are set out in their contracts and our internal rules.

1.3 Applicable law

We handle personal data in accordance with Japan's APPI. The statements and rights in this notice that are based on the UK GDPR (United Kingdom) and the EU GDPR apply where, and to the extent that, those laws apply.

2. Who we are and how to contact us

2.1 The business operator

2.2 Privacy contact

We accept questions, requests and complaints about how personal data is handled at the following contact.

2.3 Our relationship with the UK company

The UK company ELT School of English Limited is a separate legal entity from us. We operate the System, and employees and contractors of the UK company also use it as staff. In addition, some instructors have their contract with the UK company.

For this reason, we and the UK company use users' personal data jointly as follows.

The role of each company under the UK GDPR / EU GDPR, by purpose of processing, is as follows.

Requests and complaints about processing carried out as joint controllers can be made to the contact in 2.2.

3. Personal data we collect and where it comes from

The main personal data we handle in the System is as follows.

3.1 Data common to staff and instructors

3.2 Data for instructors only

3.2a Work records of staff

Activity logs and audit logs (3.4) are also treated as work records of staff.

3.2b Meeting records

The System contains records of meetings with customers (such as counselling sessions and trial lessons). Users are recorded as the person responsible for a meeting.

3.3 Data we obtain from sources other than the user

3.4 Data recorded automatically

3.5 Special category data and photographs

We do not aim to collect special care-required personal information such as health information (special category data under the GDPR) in the System. However, such information may be included in free-text fields or attachments such as CVs, notes and meeting records. If so, we handle it in accordance with this notice.

If we handle photographs of instructors and staff (such as profile photos) in the future, we will set the purpose and retention period, revise this notice and let you know.

4. Purposes of use and legal bases

We use personal data for the following purposes.

The legal basis under the GDPR is determined for each company that carries out the processing (2.3). For people who have a contract with the UK company, processing carried out by the UK company relies on the UK company's legal basis; all other processing relies on our legal basis.

4.1 Our legitimate interests

For processing based on "legitimate interests", the interests we seek to protect are as follows.

4.2 Instructor notes and customer ratings (instructors only)

5. Information you need to provide

Users for whom we have made multi-factor authentication (MFA) mandatory cannot log in without setting it up.

6. Usage analytics (PostHog)

To improve the screens and features of the System, we use the usage analytics tool PostHog (provided by PostHog Inc., United States). We send PostHog only events from our servers that show the results of tasks.

6.1 Information we send

We do not send names, email addresses, free text and the like. PostHog is configured to anonymise IP addresses.

If we start measuring on-screen interactions or recording screens, we will revise this notice and let you know in advance, and obtain any consent required by law.

6.2 Purpose and uses we exclude

The usage data sent to the analytics tool (6.1) is used to improve the System and is not used to evaluate individuals (including the quality management of instructors and the performance evaluation of staff). The purposes of use of work records (such as lesson records, instructor notes and meeting records) are as described in Section 4.

You can object to this processing through the contact in Section 13.

6.3 Retention and transfer

Retention is described in Section 11 and the transfer to the United States in Section 10.

7. Storage on your device and transmission to external parties

7.1 Storage on your device (browser)

The System stores information in the browser's local storage to keep you logged in, for security, and for screen settings and convenience. This is not used for advertising or behavioural tracking.

7.2 Content loaded from external parties

Google's Privacy Policy (https://policies.google.com/privacy) and Terms of Service (https://policies.google.com/terms) apply to reCAPTCHA.

7.3 Communication for displaying teaching materials

To display teaching materials, the browser may communicate directly with the following recipients. The information sent to SoundCloud and Google Cloud Storage is described in Appendix A.

SoundCloud sets cookies in the browser to play audio. SoundCloud's Privacy Policy (https://soundcloud.com/pages/privacy) applies to SoundCloud's cookies.

8. Service providers and recipients

We entrust the handling of personal data to, or send personal data to, the following companies and others. We may add or change service providers as our business requires.

We are the contracting party for Google's services. For PostHog Inc.'s sub-processors, please see its list (https://posthog.com/subprocessors).

9. Provision to third parties and joint use

Apart from the service providers in Section 8 and the joint use in 2.3, we do not provide users' personal data to third parties, except where permitted by the APPI or other laws, such as where required by law.

For information sent directly from the browser to external services, please see Section 7 and Appendix A.

10. International transfers

We store or process personal data in the following countries.

Users may ask the contact in Section 13 for information about the safeguards put in place by our service providers outside Japan.

11. Retention periods

We keep personal data for as long as necessary to achieve the purposes of use, for the periods required by law, and for as long as necessary to respond to disputes and legal claims. The retention periods, or the criteria for determining them, for the main data are as follows.

If we receive a request for deletion or similar during the retention period, we will respond in accordance with Section 13 and the applicable law.

12. Security measures

We take the following measures to prevent the leakage, loss or damage of personal data and otherwise to keep it secure.

12.1 Response to breaches

If personal data is leaked, lost or damaged, or there is a risk of this, we will in principle respond as follows.

• Reporting to the person responsible: anyone who notices the incident reports it to the person responsible immediately.
• Preventing further harm: we take necessary measures, such as suspending accounts and resetting passwords.
• Investigating the facts and the cause: we find out what happened, when and how.
• Identifying the impact: we identify the individuals affected and the scope of the personal data involved.
• Preventing recurrence: we take measures suited to the cause.
• Reporting to supervisory authorities and notifying individuals: where required by law, we report to the Personal Information Protection Commission (and to the ICO or other supervisory authorities where users in the UK or the EU are involved) and notify the individuals affected.

13. Your rights and how to make a request

13.1 Rights you can exercise

Subject to the applicable law and the requirements of each right, users may be able to exercise the following rights.

Information that can be checked or changed in Account Settings (such as your email address and password) can be checked or changed there.

13.2 How to make a request

13.3 When we cannot comply with a request

To the extent permitted by the applicable law, we may refuse all or part of a request in the following cases. If we refuse, we will tell you so and why, to the extent required by law.

• Where we are legally required to keep the data (for example, records of fee payments)
• Where it is needed to respond to disputes or legal claims
• Where disclosure may harm the life, body, property or other rights and interests of you or a third party (such as customers or other staff and instructors)
• Where disclosure may seriously interfere with the proper conduct of our business or that of the UK company
• Other cases permitted by the applicable law

14. Automated decision-making

We do not make decisions in the System based solely on automated processing (including profiling) that produce legal effects on users or similarly significantly affect them.

15. Complaints and the right to complain to a supervisory authority

We accept complaints about how personal data is handled at the contact in Section 13.

Users may also lodge a complaint with the following supervisory authorities.

16. Changes to this notice

• We may revise this notice in response to changes in law or as our business requires. The date of revision and the version are shown at the top of this notice.
• We will notify you of significant changes, such as new purposes of use, new service providers or new international transfer destinations, in accordance with the law, on the System's screens, by email or by other appropriate means.

Appendix A: List of external transmissions

When you open the System's screens, the browser sends information to the following external recipients. Because of how internet communication works, your IP address and browser information (User-Agent) are sent to every recipient.

What our servers send is described in Section 8.