Bili is committed to protecting your privacy and we comply fully with UK and EU data protection law (GDPR). We have put in place physical, electronic and operational procedures intended to safeguard and secure the information we collect. All Bili staff have a legal duty to respect the confidentiality of your information, and access to your personal details is restricted only to those who have a reasonable need to access it.
By using the Website, you are accepting the practices described in this statement.
What does Bili do?
Bili provides an online languages exchange platform for schools to use to enable peer to peer learning of modern languages. Bili does not offer services directly to students and does not market third party services to students. Bili is registered in the UK with the Information Commissioners Office. The UK ICO is the lead data protection supervisory authority for all Bili’s activity.
Purpose and scope of this policy
This policy sets out why Bili collects personal data, both as Data Controller and as Data Processor, how Bili protects this data, what we do with it and the rights of individuals to see what personal data we hold on their behalf. The policy covers all personal data that is collected, held, stored and processed by Bili.
What personal data does Bili hold?
Bili collects and stores personal information for the following purposes:
Personal data about teachers and their schools is held to enable them to identify a suitable match for them with another school abroad. All data is provided by the respective school and Bili is acting in the role of Data Processor;
Personal data is held on students (children) to enable them to be matched on a 1:1 basis with students in another school abroad and for the exchange to be managed by their respective teachers. All data is provided by the respective school and Bili is acting in the role of Data Processor;
Personal data may be held on the legal guardian of the student to enable them to fulfil the controlling and monitoring role that is undertaken by teachers in support of the exchange. This role could take place in support of the teacher during term times or could be a substitute during holiday periods. All data is provided by the respective school and Bili is acting in the role of Data Processor;
Personal data may be provided by the student as part of their activity in completing tasks. This data is checked by respective teachers prior to being made available through Bili to the student on the other side of the exchange. All data is provided by the respective school and Bili is acting in the role of Data Processor; and Personal data held by Bili from schools, teachers and parents to enable Bili to provide them with Marketing material. All such personal data is provided by the individual on an opt in basis. All data is provided via the respective school and Bili is acting in the role of Data Controller.
Bili’s legitimate interest
Bili is a languages exchange platform that is approved by schools to support teachers in their goals of encouraging and teaching modern foreign languages. This gives rise to Bili’s legitimate interest in gathering, retaining and processing personal data as set out above. Gathering and holding personal data that has been provided by the school is necessary to enable the 1:1 exchanges to take place. Students are able to provide further personal information as part of the tasks they carry out and the provision of this information is entirely under the control of the student and their respective teacher. Bili stores this information, but does not use it other than to share with the nominated teacher and the exchange student. Bili also needs to be able to match students with the correct parent/guardian to ensure privacy from others in the class. Students right to privacy is balanced with Bili’s limited need to ensure that the correct match is made. The teacher will ensure that the balance is maintained whereby Bili is able to ensure that the correct matches are made but student, parent and school personal data is kept secure.
Cross-Border Data Transfers
Most of the data that Bili holds will only be shared within the EEA and the United Kingdom (UK), but this is not always the case. Where an exchange is set up between schools in the EEA and the UK the data will be held on secure servers within the EEA and the UK. Where an exchange takes place between a school within the EEA the UK and one outside (for example between France and Australia) it is necessary that the data can be shared outside the EEA and the UK. Bili will use the most appropriate location to securely store personal data and will ensure that the schools know where their data will be held. We use standard contract clauses approved by the European Commission or other suitable safeguard to permit data transfers from the EEA and the UK to other countries.
Our approach to Data Protection is based on a number of principles:
Our approach is based on the concept of Privacy by Design whilst ensuring that the legitimate activity of Bili is enabled;
All users must create passwords and are responsible for keeping their login details and passwords secure;
Generic school information is shared with registered and verified schools to enable suitable matched to be made. No personal details are shared at this point, which is then entirely at the discretion of each teacher;
If schools enter into a partnership (i.e. both parties accept an exchange invitation), teacher names will be shared with corresponding teachers; student first names and first letters of surnames will be shared between corresponding teachers and students. No contact information is shared. Teachers are responsible, as controllers of their own classes for ensuring that their students do not share personal information; and We do not share the information with any third parties, and will only use personal contact details to alert users of messages or notifications, and occasionally of additional features we offer through the platform.
All data subjects have the Rights to access the data concerning themselves, to require rectification if incorrect, and to refuse consent for the collection of sensitive personal data. Any enquiries, issues or concerns in connection with Data Protection matters should be raised in the first instance with Bili’s Data Protection Officer – Charles Foot. Further complaints may be made to the Information Commissioner (www.ico.org.uk/concerns).
Data related to the profile of the user are kept for one year after the user’s last login. After one year from the last login, the user profile will automatically be set to inactive, i.e., no longer visible to other users or the outside world. A notification is sent to the user to inform the user that their profile has been set to inactive and that they can re-activate their account by logging in again. A second and final reminder is sent after two additional years informing the user that, 3 years after their last login, their profile will be deactivated permanently. All personal information is then made anonymous. If an exchange agreement ends between schools, the school profiles remain active to enable them to connect with other schools. Student data will be held but not visible to any other users, and their profiles made visible when the student’s account is reactivated when they are connected through a new exchange. However, if a school administrator asks for the deactivation of their profile or the profile is automatically deactivated, no data will be visible to other users. Data will be kept only in an anonymous form that does not allow for personal identification. If schools with a deactivated profile want to continue using the platform, they will need to register again. The data remain solely for research and monitoring purposes in an aggregated format.
Updating your details and contacting us
Updated on: May 2021
Effective from: May 2021