Instructure
Product Privacy Notice
Languages:
Instructure Product Privacy Notice
Effective Date: October 10, 2023
To see the previous version of this policy please view here.
What’s Changed in this Notice?
Instructure has updated Section 9 to reflect the updates for the EU-US Data Privacy Framework.
Introduction:
Instructure is committed to protecting the information we process by doing our best to ensure that the information is used only to support students and education. We are guided in this mission by our foundational Privacy Principles:
- Transparency: We will work to ensure transparent data processing in our business.
- Accountability: We will demonstrate our commitment to privacy in concrete and tangible ways.
- Integrity: We will strive to ensure that the data entrusted to us is complete, consistent, and accurate.
- Security: We will implement and maintain appropriate technical, administrative, and organizational measures to protect data in accordance with regulatory requirements.
- Confidentiality: We will establish and maintain policies, procedures, and practices that limit access to data and protect against unlawful or unintentional access or disclosure.
As part of our commitment to protecting the privacy of students, educators, and institutions, we are a signatory to the Student Privacy Pledge and a member of the Future of Privacy Forum.
Instructure has also earned the TrustEd Apps Data Privacy Certification Seal.
We invite you to learn more about the data practices on our platforms that enable lifelong learning.
Contents:
- About our Users and our Products.
- Information Collection.
- Our Use of Your Information.
- Disclosure of Information.
- Children’s Privacy.
- Your Information, Your Control.
- Other Important Information.
- Security of Your Personal Information.
- EU-US Data Privacy Framework.
- Contact Information.
Instructure, Inc. and its affiliates and subsidiaries (“Instructure,” “we,” “our,” or “us”) prepared this Product Privacy Notice (“Notice”) to describe our privacy practices. This Notice governs information collected and processed by our products and services (collectively, “Products”), which are listed here: www.instructure.com/product/all-products.
1. About our Users and our Products.
How we use your information depends on our relationship with you. We primarily provide our Products to Academic Institutions, such as K-12 schools and higher education, and Corporate Edu that use our Products to amplify teaching, elevate learning, provide professional development opportunities, and improve student outcomes.
If you are an end user of an Academic Institution or Company that uses our products, it means that your institution determines how your personal information is used. This means that your institution’s privacy notice governs the use of your personal information. This privacy notice is intended to provide transparency related to our privacy practices only.
We have provided the following summary to help you understand what we do with the information we process through our Products and the relationship between our users and Products.
|
Users |
Products |
Examples |
|
Canvas by Instructure:
|
|
|
Mastery by Instructure:
|
|
|
Elevate by Instructure:
|
|
|
Impact by Instructure
|
|
|
Canvas Student ePortfolios Portfolium
|
|
2. Information Collection.
Now that you know about our Products, we want to tell you about the information our Products collect and process.
|
Personal Information |
|
|
Information that may singly identify you, either alone or in combination with other information, such as:
|
We collect your personal information when:
|
|
Product Usage Information |
|
|
Information processed while using our Products, such as:
|
When you use our Products, we collect information about how you use our Products |
|
Communications and Other Interactions with Us |
|
|
Any information, including personal information, you submit during your interactions with us, such as:
|
We collect information from and about your communications and interactions with us. For example, we collect information when you:
|
|
Device Information |
|
|
Information, including personal information, from and about your device, such as:
|
When you use our Products on a device, like most Internet services, we automatically gather and store device information each time you use our Products
|
|
Professional Information |
|
|
Information about your career and professional achievements, such as:
|
We collect this information, for example, when you apply for a job posted on Portfolium or student ePortfolios and activate an account created by your Academic Institution
|
3. Our Use of Your Information.
Now that you’ve learned about the information we process, let’s go over what we do with it.
Please note that if we process your personal information for a purpose other than the purpose for which it was collected, we will provide you with notice in advance of the new processing and obtain consent if required.
We limit our collection and use of your personal information only to those elements required to operate our Products, or as otherwise disclosed in this Privacy Notice. We do not engage in automatic decision making, advertising to students, or profiling.
To provide, analyze, and improve our Products. We use the information described above to provide, analyze, and improve our Products, including to:
- Create and maintain your account
- Identify you as a user
- Notate and assign support tickets
- Provide, operate, maintain, and improve our Products
- Personalize and improve your experience
- Contact you and communicate with you, including to respond to your comments or inquiries
- Provide customer support
- Solicit feedback about our Products, including by asking you to respond to surveys or questionnaires (with your permission)
Please see the “Third-Party Websites” section below for more details about sharing information with third-party websites or platforms.
De-identified or aggregate use. We may create and use de-identified or aggregate information – information removed of specific identifiers so that it cannot singly identify you (i.e., non-personal information) – for any purpose.
4. Disclosure of Information.
Now we will review how we share or disclose information, including personal information. Please note that we share information, and permit you to share information, only as described in this Privacy Notice. We do not sell or rent personal information to third parties.
4.1. Instructure’s Disclosure of Information.
Instructure may share information with the following recipients or as set forth below.
Commonly owned entities. We may share your information, including personal information, with companies under common ownership or control of Instructure, including affiliates and subsidiaries, to help provide our Products.
Third-party service providers. We may share your personal information with authorized third-party service providers for the sole purpose of providing you with our Products.
We do not permit our third-party service providers to use personal information we share with them for their own advertising or marketing purposes, or for any other purpose other than in connection with the services they provide to Instructure. Additionally, we do not sell or rent your personal information to third parties.
As required by law. In certain circumstances, we may be required to disclose information, including personal information, in order to:
- Comply with legal or regulatory processes (such as a judicial proceeding, court order, or government inquiry)
- Enforce the Instructure Acceptable Use Policy and other applicable policies
- Respond to claims that any content violates the rights of third parties
- Protect the rights, property, or personal safety of Instructure, its employees, its users, its clients, and the public
Change of Control. We may share information about you in connection with or during negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company. In the event that information is shared in this manner, notice will be posted on our website at www.instructure.com.
With your consent or at your direction. We may share information other than as described in this Privacy Notice with your consent, or at your specific direction, for example, if you choose to use the Products with social networking platforms (e.g., Facebook, YouTube, Twitter, etc.).
De-identified or aggregate use. We may share de-identified or aggregate information – information removed of specific identifiers so that it cannot singly identify you (i.e., non-personal information) – for any purpose without limitation, unless prohibited by applicable law.
4.2. Disclosure of Information through Instructure’s Products.
Our Products have features that share information (including personal information) with authorized third parties or that allow you to share information with third parties or the public. These disclosures are described below.
Academic Institutions, course providers, or parents. We may share your personal information with the Academic Institution or company which is linked to your use of our Products. Where permitted, we may also share your information with relevant parties associated with the Academic Institution, such as educators or fellow students, or parents of students using our Products or fellow users.
For example, this would apply:
- If your Academic Institution uses our Products as a learning management platform and has given you access to the Products; or
- If you are taking a course via the Products, we will share your personal information you provided upon account registration and coursework registration with the educator and/or Academic Institution
Other Third Parties. You may choose to share information through our Products, such as Portfolium, with other users of the Products or the public when you post content or otherwise provide information about yourself. We are not responsible for others’ use of the available information, so you should carefully consider whether and what to post or how you identify yourself.
If you use Portfolium, examples of sharing your personal information may occur when you:
- Create an account, your name and other profile information will be viewable and searchable by other users and Employer Partners (as noted above)
- Post content to Portfolium, such as videos, photos, school projects, and comments, which are displayed on Portfolium and viewable by other users by default
- Access public blogs, community forums, or the newsfeed within the Product
- Post to our public blog, which is operated by a third-party application. Our Privacy Notice does not cover the practices of these third parties, and your interactions with these third-party applications are governed by their separate privacy policies
On Portfolium, we do not make a child user’s account publicly available; only parents and Academic Institutions have access to a child user’s account. And we do not make users’ accounts or data publicly available on Canvas LMS & Mastery Connect.
With your consent or at your direction. As noted, we may share information other than as described in this Privacy Notice with your consent, or at your specific direction, for example, if you choose to use the Products with social networking platforms (e.g., Facebook, YouTube, Twitter, etc.).
5. Children’s Privacy.
For users of Canvas LMS and the Mastery suite of products, we may take steps intended to comply with the Children's Online Privacy Protection Act (“COPPA”). Please see our Children’s Online Privacy Protection Act Privacy Notice.
Except for authorized users of Canvas LMS, Canvas Studio, Canvas Student Pathways, or the suite of Mastery products, if you learn that a child under thirteen years of age has provided us with personal information, please alert us at privacy@instructure.com.
6. Your Information, Your Control.
We provide you with several ways to control your information.
Parents and Academic Institutions. Parents and educators may review information collected from children, request deletion of this information, or request no further collection or use of this information by contacting us at privacy@instructure.com or submitting a help desk ticket through our Products.
Account Information. You may change some of your personal information by editing your Product profile. You may also request that we modify or delete your information by emailing us at privacy@instructure.com or submitting a help desk ticket through our Products. We will respond to your request, when permitted by law and subject to exceptions, within 30 days. We may be unable to delete information that resides in our archives.
Portfolium Account Closure. If you wish to delete your Portfolium account, you can go to the "Privacy" tab under "Account Settings" and click "Disable Account." Once your account has been disabled, you can request deletion of your account by selecting "Permanently Delete" from the “disable” account screen. After requesting deletion, you have fifteen days to change your mind before we cannot undo your deletion request.
Employer Communications. Portfolium users (that are over 18 years of age) may receive private messages through Portfolium from approved employers. At any time, Portfolium users may unsubscribe from all employer-generated private messages. Portfolium users may also use the privacy settings in their account to opt out of their information being shared with employers.
Push Notifications. If you would like to stop receiving push notifications, please use the settings on your mobile device to opt out. Please note that opting out of receiving push notifications may impact your use of our Products (such as receiving a notification that you have a new message). Please note that the opt-out process differs depending on the mobile device you are using.
Location. Some Products may collect precise location information about your mobile device, but only with your consent. If you wish to revoke permission to collect precise location information, you can change the location settings on your mobile device.
If you require access to personal information not otherwise available through any of the mechanisms described above, please contact us at privacy@instructure.com or submitting a help desk ticket through our Products.
7. Other Important Information.
Student Data Privacy Agreements. When providing our Products to certain US Academic Institutions, we may sign a state-level Student Data Privacy Agreement (“SDPA”) with a Local Educational Agency (“LEA”). The LEAs make these SDPAs publicly available. You can access the SDPAs that we have signed with LEAs on the Student Data Privacy Consortium website located here.
Third-Party Websites. Our Products may contain links to third-party websites or services that allow you to leave our Products and go to another website when you click on such a link. Your information, including personal information, may be collected by those separate entities. We have no control over, do not review, and cannot be responsible for these outside websites or their content.
Please be aware that the terms of this Notice do not apply to these outside websites or content, or to any collection of data after you click on links to such outside websites. The links to third-party websites or locations are for your convenience and do not signify our endorsement of such third parties or their products, content, or websites.
Google APIs.
Our use of information received from Gmail APIs will adhere to Google's Limited Use Requirements.“Our Product’s use and transfer to any other application of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.”
8. Security of Your Personal Information.
Instructure takes reasonable steps to help protect your personal information in an effort to prevent unauthorized access, use, or disclosure. You can find more details about our security program by visiting our security webpage here and reviewing our Security and Due Diligence Documents.
Despite these measures, you should know that we cannot fully eliminate security risks associated with personal information. No method of transmission over the Internet, or method of electronic storage, is 100% secure. Therefore, we cannot guarantee absolute security. Any content you post or input you provide while using our Products is at your own risk.
Please be aware that the personal information we collect may be transferred to and maintained on servers or databases located outside your county, and personal information may be accessible to law enforcement and national security authorities in those jurisdictions.
9. EU-U.S. Data Privacy Framework
Instructure complies with the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”) as set forth by the U.S. Department of Commerce. Instructure has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (“EU-U.S. DPF Principles”) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. Instructure has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (“Swiss-U.S. DPF Principles”) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (“DPF”) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.
Instructure commits to subject to the DPF Principles all personal data received from the EU, UK, and Switzerland in reliance on the relevant DPF.
Instructure is accountable for the processing of personal data it receives under the EU-U.S. DPF Principles and the Swiss-U.S. DPF Principles (collective, “DPF Principles”) and subsequently transfers to a third party. Instructure complies with the DPF Principles for all onward transfers of personal data from the EU, UK, and Switzerland, including the onward transfer liability provisions. The Federal Trade Commission has jurisdiction over Instructure’s compliance with the EU-U.S. DPF, UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.
Instructure may be required to disclose personal data in response to law requests by public authorities, including to meet national security and law enforcement requirements.
Residents of the EU, UK, and Switzerland have the right to access the personal data that Instructure maintains, and in some cases, have choices to limit the use and disclosure of personal data. These rights are described more fully in the Product Privacy Policy: the Your Rights section of the European Union Region Product Privacy Notice Addendum. To exercise these rights, contact us at privacy@instructure.com.
In compliance with the EU-U.S. DPF, UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Instructure commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU, UK, and Swiss, individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF should first contact Instructure as described in the “Contact Information” section below.
In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Instructure commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF to TRUSTe, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit: https://feedback-form.truste.com/watchdog/request for more information or to file a complaint. The services of TRUSTe are provided at no cost to you. Under certain conditions, more fully described on the DPF website, you may be entitled to invoke binding arbitration when other dispute resolution procedures have been exhausted.
10. Contact Information.
Instructure welcomes your comments or questions regarding this Privacy Notice. Please email us at privacy@instructure.com, or contact us at the following address or phone number:
Instructure, Inc.
6330 S 3000 E, Suite 700
Salt Lake City, UT 84121
United States of America
+1 (801) 869-5000
Instructure Global Ltd
New Penderel House, 4th Floor
283-288 High Holborn
London, UK WC1V 7HP
0900 358 4330
To contact our Data Protection Officer, please use the following email address: privacy@instructure.com.
Changes to this Privacy Notice. We may change this Privacy Notice from time to time. If we make any changes to this Notice, we will change the “Effective Date” above. If such changes are material, a notice of the changes will be posted along with the revised Privacy Notice. We encourage you to visit this page from time to time for the latest on our privacy practices.
Previous Versions
You can access the previous version of our Product Privacy Notice here.