Welcome to the Kognity Privacy Notice

This is where we explain how we process your personal data collected through our websites, the Kognity teaching and learning platform or through any other channel or source, and what we do to respect your privacy. In addition, you’ll find information on how we process your personal data if you’re applying for a position with Kognity.

If you’re a customer or user of the Kognity teaching and learning platform and want to learn more about how your school collects and processes that data, you should instead refer to your school’s privacy notice. If your school is located in the United States, you can also refer to our US Customer Privacy Policy.

Privacy Notice

Last Updated: 15 December 2023

1. Introduction

First and foremost, thank you for using our websites or otherwise interacting with us! We firmly believe that privacy is important and we take your privacy seriously. As used in this privacy notice, “Kognity” or “we” means Kognity AB, Reg. No. 559023-5080, and its subsidiaries and affiliates as applicable depending on the context. Kognity is the data controller in relation to the processing of your personal data in accordance with this privacy notice. Except as explicitly set out in this privacy notice, your school is the data controller for the collection and processing of your personal data on the Kognity teaching and learning platform.

This notice applies to our processing of personal data about (i) website visitors, (ii) job applicants, (iii) persons who otherwise interact with us outside of our services (e.g., customer representatives and representatives of potential customers, event attendees and teachers providing feedback), and (iv) platform users outside of the United States.

2. How we process your personal data

Below you can see what data subject category you belong to, find out what personal data we process about you, for what purpose and with what legal basis. It’s possible that you belong to more than one category, so make sure to read all categories that might be relevant for you.

Data subject category	Categories of personal data	Purpose(s)	Legal basis
Website visitors	Personal data collected from your visit to our websites, including IP address, geolocation, information about your device and information on your use of the website.	Our main purposes for the processing of the personal data are to improve our website and the Kognity teaching and learning platform.	Our legitimate interest to (i) manage and improve our websites and services, or (ii) market our services.
Representatives of customers and potential customers	Personal data submitted by you or the company you represent on the forms on our websites or submitted on another accessible source, including information we’ve received about you from other channels or sources, e.g., name, contact information, occupation/role, school, etc.	Our main purposes for the processing of the personal data are to administer the potential or existing contractual relationship. We may also use your contact information for marketing purposes, as set out below under “Marketing and Distribution of Information”	Our legitimate interest to (i) market and provide information on our services, or (ii) administer existing or potential contractual relationship(s).
Event attendees	Personal data submitted by you or the company you represent on the forms on our websites or submitted on another accessible source, including information we’ve received about you from other channels or sources, e.g., name, contact information, occupation/role, school, etc. in relation to any events hosted by us.	Our main purposes for the processing of the personal data are to administer the potential or existing contractual relationship. We may also use your contact information for marketing purposes, as set out below under “Marketing and Distribution of Information”	Our legitimate interest to (i) market and provide information on our services, (ii) administer existing, or potential contractual relationship(s), or (iii) improve and administer events.
Platform users	Personal data provided through Kognity’s teaching and learning platform, including name or IP address.	The personal data are used for analytics purposes. IP addresses are collected in security logs to enforce platform security and resilience.	Our legitimate interest to manage and improve the Kognity teaching & learning platform. Our legitimate interest to enforce product security and resilience and detect fraud and other harmful activities, and comply with Legal obligations.
Teacher feedback	Personal data provided by teachers or school administrators in relation to product feedback, including name and school attribution.	The personal data is processed to improve the Kognity teaching and learning platform.	Our legitimate interest to (i) market and provide information on our services, or (ii) administer existing or potential contractual relationship(s).
Job applicants	Personal data provided by you in the recruitment process (e.g., name, CV, personal letter, etc.) and personal data generated by us (e.g., assessments). In addition, we source information from third parties, such as Facebook, Linkedin and other public sources, or occasionally, employees or others that make recommendations about potential applicants.	The personal data is processed with the purpose of managing and facilitating recruitment of new employees to our business.	Our legitimate interest to ensure that the right candidate becomes a Kognite.

If you want to learn more on how we have balanced your interest against ours, feel free to contact us using the contact information below.

The forms on our website and elsewhere are not targeted to children and require age verification to ensure we’re not knowingly collecting personal information from children under the age of 18. If we inadvertently collect information on anyone under the age of 18, we’ll immediately take the necessary steps to ensure that such information is deleted from our systems. If you learn that a child has provided us with personal information in violation of this privacy notice, we ask you to alert us using the contact details below.

3. How long we keep your personal data

We store your personal data only for as long as we need the personal data to fulfill the purpose it was collected for. In addition, we could be required to keep your personal data longer to fulfill legal obligations, but in that case, we won’t process the personal data for any other purpose.

We anonymize or delete personal data of potential customers, including event attendees except that personal data relating to the event as such will be deleted within three months from the event, if there hasn’t been any interaction in the past 365 days. If you’re a platform user or a customer representative, we anonymize your data when services are no longer being provided subject to a grace period during which we take measures to ensure that all our interactions are terminated. We will, however, retain IP addresses in relation to security logs for a period of one year from collection. Personal data in relation to teacher feedback is kept for a period of twelve months from collection. In the recruitment process, we anonymize the data 30 days from our last point of contact – unless you consent to us keeping your application for future open positions. If you’re a website visitor but not a potential customer, refer to our Cookie Policy to read more about how long we process your personal data for.

4. How we share your personal data

We share your personal data with other companies in the Kognity group of companies. In addition, we may share your personal data with trusted third parties that provision services to us (including hosting service providers, data analysis providers (such as Google Analytics) and CRM providers), or other business partners. In the recruitment process, we rely on and share your personal data with our recruitment partner Ashby.

5. Third country transfers

Your personal data may be processed outside the EU/EEA. When we transfer personal data from the EU/EEA to a country outside the EU/EEA, we’ll make sure that the transfer is lawful and safe by undertaking necessary security and contractual measures, such as (i) an adequacy decision by the EU Commission, the UK or the Swiss data commissioner of the Federal Council, as applicable, or (ii) implementing standard contractual clauses for the transfer of personal data to third countries (EUSCC) or the UK’s international data transfer agreement (IDTA). As concerns third country transfers. If you’re a platform user, we mainly process your personal data in the US and Singapore. We may also process your personal data in the Philippines, India, El Salvador, and Mexico. If you’re a non-platform user we mainly process your personal data in the United States.

We’re committed to ensure and adequate protection of your personal data – regardless of where it’s processed. Hence, we implement additional technical, organizational and contractual security measures, where necessary. We keep these measures under review in order to keep our systems and the personal data we process safe.

6. Marketing and distribution of information

If you interact with us as a company representative, we may send marketing and other information to you before or during our contractual relationship. You can always opt-out from the marketing, either directly in the marketing e-mail or by contacting us using the contact details at the bottom of this notice. However, it’s not possible to opt-out from our distribution of information that is not marketing but information relating to the provisioning of our services or similar.

7. Our use of cookies (and similar technologies)

Our websites use cookies, tags, tracking scripts, and pixels to enhance your experience and to improve our websites and services. Refer to our Cookie Policy for more information. By using our websites you consent to the use of website cookies in accordance with the Cookie Policy, in which you can also read more about how you can block, erase or withdraw your consent to these cookies.

8. Your rights

8.1 Right to information and access

You have the right to know if we process personal data about you. If we do, you have the right to information about the personal data we process and why we do it. You also have the right to receive a copy of all personal data we have about you. If you’re interested in specific information, do indicate this in your request. For example, you can specify if you are interested in a certain type of information (e.g., what contact information we have about you) or if you want information from a certain time period.

8.2 Right to have erroneous data corrected

If the data we hold about you are incorrect, you have the right to have it corrected. You also have the right to supplement incomplete information with additional information that may be needed for the information to be correct. Once we have corrected your data, or it has been supplemented, we’ll inform those we have shared your data with about the update, provided that it is not impossible or too cumbersome. If you ask us, we’ll also tell you who we have shared your data with. If you request to have data corrected, you also have the right to request that we limit our processing during the time we investigate the matter.

8.3 Right to erasure

In the following cases you have the right to have your data deleted: (i) the data is no longer needed for the purposes for which we collected it; (ii) you withdraw your consent, if applicable; the (iii) data is used for direct marketing and you unsubscribe from it, (iv) you oppose use that is based on our legitimate interest and we cannot show compelling grounds that outweigh your interests; (v) the personal data has been used illegally, and (vi) deletion is required to fulfill a legal obligation.
If we delete data following your request, we’ll if needed inform those we have shared your data with, provided that it is not impossible or too cumbersome. If you ask us, we’ll also tell you who we have shared your data with.

8.4 Right to request restriction

Restriction means that the data is marked so that it may only be used for certain limited purposes. The right to restriction applies: (i) when you believe the data are incorrect and you have requested correction, and if so, you can also request that we limit our use while we investigate if the data are correct or not; (ii) if the use is illegal but you do not want the data to be deleted; (iii) when we no longer need the data for the purposes for which we collected it, but you need it to be able to establish, assert or defend legal claims, and (iv) if you object to the use, if so, you can request that we limit our use pending the verification if our legal grounds override yours.
Even if you have requested that we restrict our use of your data, we have the right to use it for storage, if we have obtained your consent to use it, to assert or defend legal claims or to protect someone’s rights. We may also use the information for reasons relating to an important public interest. We’ll let you know when the restriction expires. If we limit our use of your data, we’ll inform those we have shared your data with, provided that it is not impossible or too cumbersome. If you ask us, we’ll also tell you who we have shared your data with.

8.5 Right to object

You have the right to object to processing that is based on our legitimate interest. If you do, we’ll, based on your particular situation, evaluate if our interests in using the data outweigh your interests in the data not being used for that purpose. If we’re unable to provide compelling legitimate grounds that outweigh yours, we’ll stop using the data you object to – provided we do not have to use the data to establish, exercise or defend legal claims. If you object to the use, you also have the right to request that we restrict our use during the time we investigate the matter. You always have the right to object to, and thus unsubscribe from, direct marketing.

8.6 Right of data portability

Data portability means that you have the right to obtain the data we have collected about you, from you, in a structured, publicly available and machine-readable format and that you have the right to transfer it to another controller.

The right to data portability only applies to: (i) to data that has been collected from you about you; (ii) where the use is based on your consent or for the performance of a contract with you; and (iii) the processing is automated.

8.7 Right to complain

Feel free to contact us if you are unhappy with how we process your personal data or have questions about how we do it. Hopefully we can work it out together. You always have the right to lodge a complaint with the supervisory authority where you live or work, or where you believe an infringement is taking place. The Swedish Authority for Privacy Protection (IMY) is the Swedish supervisory authority for our use of your personal data.

9. US Privacy Policy

California: California residents should read our Supplemental Privacy Statement for California Residents in conjunction with this privacy policy. The Supplemental Privacy Statement for California Residents explains our commitment to comply with California law and applies to personal information collected in connection with our websites and hiring and recruitment processes. Our US Customer Privacy Policy addresses our collection of non-public education records from California residents in our role as a service provider to California schools and districts.

Nevada: This section applies if you are a resident of the state of Nevada. While we do not sell personal information, as defined in Nevada law, Nevada residents may email a request for no sale of their personally identifiable information to [email protected].

How to contact us

Feel free to send us an email if you have any questions and requests: [email protected].

You can also use regular mail. Our address is: Linnégatan 87D, 115 23 Stockholm, Sweden.

Updates to our notice

We may update this privacy notice from time to time. You can look at the last revised date at the top of this notice to see when this notice was last revised. Any changes to this notice will become effective when we post the revised notice on our websites. In case of substantive changes, we’ll inform you specifically (provided that we have your contact information).