ESLeschool (“us”, “we”, or “our”) operates the https://www.esleschool.com website (the “Service”). The Service is an online English-language learning service used by learners of a wide range of ages, including children. Because some of our learners are children, this Privacy Policy explains in particular how we handle children’s personal data and how parents and guardians can exercise their rights.

This page informs you of our policies regarding the collection, use, and disclosure of personal data when you use our Service and the choices you have associated with that data. By using the Service, you agree to the collection and use of information in accordance with this policy. Unless otherwise defined in this Privacy Policy, terms used here have the same meanings as in our Terms and Conditions, accessible from https://www.esleschool.com

Information Collection And Use

We collect several different types of information for various purposes to provide and improve our Service to you and, where the learner is a child, only within the limits described in the “Children’s Privacy” section below.

Types of Data Collected

Account and learning data

When you (or, for a child, a parent or guardian on the child’s behalf) create and use an account, we collect and store:

• Account details — first name, last name, display name, username, and email address.
• Your password — stored only in encrypted (hashed) form; we never store or see your plain-text password.
• Date of birth — used to calculate age and to determine whether parental consent is required before we record a learner’s progress.
• Parent or guardian email address — collected for learners under the age of 13, solely to request and record verifiable parental consent (see “Children’s Privacy”).
• Parental consent records — the consent status, the date and time consent was requested and decided, and the IP address from which the decision was made, kept as a record that consent was given or refused.
• Learning and progress data — quiz and activity attempts and scores, points earned, level, any class a learner belongs to, and a chosen avatar (chosen from a fixed set of illustrated icons; we do not allow photo uploads).

Usage Data

We may also collect information on how the Service is accessed and used (“Usage Data”). This may include your computer’s Internet Protocol (IP) address, browser type and version, the pages of our Service that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers, and other diagnostic data.

Tracking & Cookies Data

We use cookies and similar tracking technologies to operate the Service and hold certain information. Cookies are files with a small amount of data which may include an anonymous unique identifier, sent to your browser and stored on your device.

You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our Service (for example, staying signed in).

Examples of cookies we use:

• Session Cookies. Used to operate our Service and keep you signed in.
• Preference Cookies. Used to remember your preferences and settings.
• Security Cookies. Used for security purposes.

Use of Data

ESLeschool uses the collected data for the following purposes:

• To provide, operate, and maintain the Service and the learner’s account;
• To record and display a learner’s own English-learning progress, points, and level;
• To determine, from date of birth, whether a learner is a child who requires parental consent;
• To request, obtain, and keep a record of verifiable parental consent for children under 13;
• To allow a learner’s own teacher at our school to view that learner’s progress in order to support their learning;
• To notify you about changes to our Service;
• To provide customer care and support;
• To detect, prevent, and address technical issues, and to keep the Service secure;
• To analyse and improve the Service.

Children’s Privacy

Our Service is intended to be used by children as well as adults, and we knowingly collect personal data about children only with verifiable parental or guardian consent and only to the extent needed to provide the learning service.

Verifiable parental consent for children under 13

When someone registers and their date of birth indicates they are under 13, we do not make their learning progress active until a parent or guardian has given consent. The process is:

• The child (or whoever is registering) provides a parent or guardian’s email address.
• We send that parent or guardian an email containing a secure, single-use link to a consent page that explains what we collect and why.
• The parent or guardian must take a deliberate action on that page to either approve or decline. We record the decision, together with its date, time, and originating IP address, as our record of consent.
• The consent request link expires if it is not used within 14 days.

What we collect about a child

For a child learner we collect only what is needed to operate the learning service: their name, email address, date of birth (to confirm age), the parent or guardian’s email address (for consent), and their learning activity and progress (quiz attempts and scores, points, level, class, and chosen avatar). We do not require or allow children to upload photographs of themselves, and we do not use children’s data for advertising or sell it to anyone.

Before consent is given

Until a parent or guardian gives consent, an under-13 learner’s progress is not credited or displayed. Where a child’s quiz activity is processed by the Service before a decision is made, that activity is deleted if consent is declined, withdrawn, or not provided within the consent window.

Rights of parents and guardians

A parent or guardian may at any time:

• review the personal data we hold about their child;
• refuse to allow further collection or use of their child’s data;
• withdraw a consent they previously gave; and
• request that their child’s personal data be deleted.

When consent is declined or withdrawn, we stop recording the child’s progress and delete the child’s quiz activity records. To exercise any of these rights, please contact us using the details in the “Contact Us” section. If we become aware that we have collected personal data from a child under 13 without verifiable parental consent, we will take steps to delete that information.

Older children and local law

The age threshold above is 13. Where the law that applies to a particular learner sets a higher minimum age for a child to give their own consent to online services, that higher age applies to them, and parental consent will be required up to that age.

Who Can See a Learner’s Data

Access to a learner’s personal data is limited to:

• the learner themselves (their own account and progress);
• a parent or guardian exercising their rights on behalf of a child;
• the learner’s own teacher at our school, who can view the progress of students in their own class to support their learning;
• authorised ESLeschool staff who administer the Service; and
• the service providers described below, only as needed to run the Service.

Data Retention

We keep account and learning data for as long as the account remains active, so that learners can see their continuing progress. We keep parental consent records for as long as needed to demonstrate that consent was obtained. When an account is deleted — whether by the learner, by a parent or guardian on a child’s behalf, or by us — we delete the associated account, progress, and consent records. Quiz activity records for a child whose consent is declined, withdrawn, or never given are deleted as described in “Children’s Privacy”.

Transfer Of Data

Your information, including Personal Data, may be transferred to — and maintained on — computers located outside of your state, province, country, or other governmental jurisdiction, where data-protection laws may differ from those in your jurisdiction.

If you are located outside Singapore and choose to provide information to us, please note that we may transfer the data, including Personal Data, to Singapore and process it there. Your submission of such information represents your agreement to that transfer. ESLeschool will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy.

Disclosure Of Data

Legal Requirements

ESLeschool may disclose your Personal Data in the good-faith belief that such action is necessary to:

• comply with a legal obligation;
• protect and defend the rights or property of ESLeschool;
• prevent or investigate possible wrongdoing in connection with the Service;
• protect the personal safety of users of the Service or the public; and
• protect against legal liability.

Security Of Data

The security of your data is important to us. We protect access to learner data, store passwords only in hashed form, transmit consent requests using secure single-use links, and limit who can view a learner’s data. However, no method of transmission over the Internet or method of electronic storage is 100% secure, and we cannot guarantee its absolute security.

Service Providers

We may employ third-party companies and individuals to facilitate our Service (“Service Providers”), to provide the Service on our behalf, to perform Service-related tasks, or to assist us in analysing how our Service is used. These third parties have access to your Personal Data only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose. Our Service Providers include our website hosting provider, our email-delivery provider, and the analytics provider described below.

Analytics

• Google Analytics — a web analytics service offered by Google that tracks and reports website traffic. You can opt out of Google Analytics by installing the Google Analytics opt-out browser add-on. For more information on Google’s privacy practices, see https://policies.google.com/privacy?hl=en.

Links To Other Sites

Our Service may contain links to other sites that are not operated by us. If you click a third-party link, you will be directed to that third party’s site. We strongly advise you to review the Privacy Policy of every site you visit. We have no control over, and assume no responsibility for, the content or privacy practices of any third-party sites or services.

Changes To This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the “effective date” at the top. Where the change materially affects children’s data, we will seek renewed parental consent where required. You are advised to review this Privacy Policy periodically.

Contact Us

If you have any questions about this Privacy Policy, or if you are a parent or guardian who wishes to review, refuse, withdraw consent for, or delete your child’s personal data, please contact us:

• By visiting our contact page on our website.