Panorama's Privacy Statement

Privacy Statement

This Privacy Statement applies to the information Panorama collects about you through the services operated by or on behalf of Panorama (“Services”), including the products specified in the quote or contract with Schools, School Districts, and Departments of Education (“Clients”)  or other entities who have signed the quote or contract. It does not apply to information collected about employees, former employees, job candidates, or independent contractors.

WHAT INFORMATION IS PROVIDED BY OUR CLIENTS?

Panorama Clients who use our Services provide certain information about their students, parents, guardians, teachers, counselors, and administrators to create accounts.  These Clients may provide some or all of the following, depending on the particular Services contractually acquired (“Personal Data”):

• Student-identifying information including name, academic, attendance, name of school, and demographic data:
• School-identifying information including name, location, and ID:
• Student roster information including student demographics, academic data, attendance data, behavior data, student transcript data, and other student, teacher, administrator and staff data collected through surveys or system of record integration;
• Data entered into the system such as intervention progress, student support notes, behavior incidents, and support referrals and associated workflow action records;
• Name and contact information of guardian and connection to the student; 
• Check-in forms completed by students;
• Opt-out information from parents;
• Access logs for intervention plans shared with a parent or family member;
• Employee information including name, email, school, and role. 

WHY IS PERSONAL DATA ACCESSED, COLLECTED, AND PROCESSED BY PANORAMA?

Generally.

Panorama accesses and collects Personal Data only to fulfill contractual requirements between Panorama and its Clients, in strict accordance with applicable laws.  
Panorama’s access, collection, and processing of Personal Data,  in most instances, is as a “school official” with “legitimate educational interests” pursuant to The Family Educational Rights and Privacy Act (“FERPA”) when a Client outsources administrative functions to Panorama that would, for example, be otherwise cost or resource prohibitive.

Specifically.

Unless otherwise limited by applicable law or contract, the following describes more specifically the processing of Personal Data accessed or collected by Panorama’s Services.

Clients Own and have Control over Personal Data

Panorama only has access to, and collects Personal Data made available or inputted by, Clients and their users in accordance with the terms of the contract with the respective client and applicable law.  Moreover, Panorama relies on the Client to instruct their users as well as notify Panorama of any limitations.

No Sale of Personal Data for Advertising Purposes

Panorama does not sell Personal Data to third party marketers, third party data brokers, or any organization that buys or sells Personal Data for advertising purposes.

User Support and Improvement of Panorama Services

Panorama may use information about the use of Panorama Services and feedback (including interviews, focus groups and/or live events)  provided to Panorama from Clients and their users to:

1. Analyze, improve, maintain, operate and provide Panorama’s Services;
2. Fulfill Client requests, so long as they comport with applicable laws and regulations;
3. Contact and communicate with Clients and their users, including responding to comments, feedback and inquiries;
4. Creating and maintaining accounts;
5. Identifying authorized users;
6. Improve and personalize users’ experiences;
7. Provide support services; and
8. Solicit feedback about Panorama Services, including by asking for a response to surveys or questionnaires (in accordance with applicable laws).

De-identified or Aggregated Data

Unless otherwise limited by law or contract, Panorama may create and use de-identified and/or aggregated information (e.g., information that has been removed of specific identifiers in accordance with industry or other reasonable standards so that such de-identified and/or aggregated information cannot singly identify an individual, “Blind Data”).  

This Blind Data may be used, for example, to fulfill a contractual obligation to provide Clients’ information to remain compliant with obligations such as the No Child Left Behind Act and based on Clients’ consent, instructions, and limitations to Panorama.

Client-Controlled Access to Artificial Intelligence Features

Panorama offers optional Artificial Intelligence-based features that are only made available if the Client opts its users into having access to that feature.

Additionally, Artificial Intelligence is not used to make automated decisions without human intervention.  Instead, Panorama informs Clients to use any Artificial Intelligence features as a reference and to not rely on Artificial Intelligence outputs as conclusive.

Any development and deployment of Artificial Intelligence-based features are subject to applicable Panorama policies, procedures and governance. 

WITH WHOM DOES PANORAMA SHARE PERSONAL DATA?

Generally.

Panorama may share information with authorized recipients as necessary to:

1. Fulfill a contractual obligation with a Client;
2. Comply with an instruction by the Client;
3. Comply with applicable law; and/or
4. As necessary to comply with obligations from applicable government agencies and institutions.

Panorama may also share information expressly authorized by applicable law, court order or law enforcement instructions.

Specifically.

Unless otherwise limited by law or by a Client, the following describes more specific information about the processing of Personal Data accessed or collected by Panorama’s Services.

Commonly Owned Entities.

Panorama may share information, including Personal Data, with companies under Panorama’s common ownership or control.  This includes companies acquired by Panorama and is shared for purposes described in the “User Support and Improvement of Panorama Services” section set forth above.

Third-Party Vendors.

Panorama’s authorized third-party vendors may have access to Personal Data for the sole purpose of providing Clients with Panorama Services.
Panorama either limits or does not permit third-party vendors to use Personal Data.  This includes limiting use for their own advertising or marketing purposes, or for any other purpose other than in connection with the products and services they provide to Panorama.
Additionally, Panorama does not sell or rent Personal Data to third parties.

Google API Services

In some instances, Clients rely on Google API Services to establish accounts or access to Panorama’s Services.  This includes Google Sign-In which may be used as part of an authentication and authorization framework that enables the ability to connect directly with Google users and, upon request, access to Google user data authorized and instructed by a Panorama Client.

Compliance with Law/Law Enforcement.

Panorama may be required to disclose information, including Personal Data, in order to:

1. Comply with legal or regulatory processes (such as a judicial proceeding, court order, or government inquiry);
2. Enforce Panorama’s Terms of Service and provisions of contracts with Clients;
3. Execute and maintain reasonable information security;
4. Respond to legal claims of Panorama or a third party related, but not limited to: intellectual property; defamation, slander, false light or otherwise incorrect information about Panorama or its Services; or
5. Protect the rights, property, or personal safety of Panorama, its employees, its contractors, its users, its Clients, and the public.

Change of Control

Panorama may disclose Personal Data  in connection with a merger, financing, acquisition, bankruptcy, dissolution, transaction, or proceeding involving sale, transfer, divestiture, or disclosure of all or a portion of our business or assets to another organization (or in connection with related due diligence). In these circumstances, Panorama will only disclose such information with an organization that has agreed to confidentiality obligations to protect such Personal Data.

As Informed by Panorama Clients of Legitimate Consent or Directions

Upon a Client’s instruction and assurance that a third party has provided legitimate consent or direction, Panorama may share information other than as described in this Privacy Statement.

Use Authorized by Law

Panorama may share information that is permitted by law to share.  This is primarily for Blind Data (e.g., information devoid of specific identifiers in accordance with industry or other reasonable standards so that such de-identified and/or aggregated information cannot singly identify an individual) for any purpose without limitation, unless prohibited by applicable law.

Disclosure of Information through Panorama’s Services 

Panorama’s Services  may include features that share information (including Personal Data) with authorized third parties or that allow Clients to share information with third parties or the public. Unless expressly prohibited by operation of law (regulation, court order, contract, etc.), these disclosures include:

Limited Service Providers and Instructors Permitted in Accordance to Client-Provided Information

Panorama may share Personal Data with a company that is or is linked to the use of Panorama Services such as those that provide such things as life services, holistic learning, mental health and well-being, personal and social responsibility training, soft skills development, resilience building, civic learning, or any form of student support authorized in accordance with applicable law.  

Academic/Research Organizations

Panorama may share Personal Data with academic and research organizations that are not expressly prohibited by law or by a Client in writing, including for the purposes of fulfilling joint research projects funded by federal or state grants.  

Client Associated Parties

Where permitted by law or based on reliance of assurance of and instructions by a Client, Panorama may share information with relevant parties associated with the Client, such as educators, school districts, state officials and administrators or other similar parties.

Other Third Parties

Clients may choose to share information with other users of Panorama’s Services or the public when content or otherwise provide information about an individual.  Panorama will rely upon and comply with Client assurances, direction and requests to disclose.  

Panorama cannot be responsible for use of the information that is made available as a result of applicable law, instructions, or assurance made by a Client (including verification of an authorized requestor to disclose).  

Panorama cannot be responsible for Personal Data shared by a user of Panorama’s Services that is either not authorized by Panorama and/or based on or under control of a Client.

Panorama’s Privacy Statement does not cover the practices of these third parties, and interactions with these third parties are governed by settings and/or their respective and separate privacy notices.

HOW LONG DOES PANORAMA RETAIN PERSONAL DATA?

Panorama retains Personal Data as dictated by contract, as instructed by Clients, as required by applicable law, or as reasonably determined necessary without violating the law.

Any data created by Personal Data that reasonably cannot directly or indirectly be identifiable to an individual (including Blind Data), may be kept until keeping such data is either: (a) no longer permitted by law; or (b) there is no legitimate purpose or use for such data (whichever is sooner).

HOW DOES PANORAMA DISPOSE OF PERSONAL DATA?

Panorama destroys Personal Data using confidential procedures in accordance with Panorama’s security program or as agreed to with the Client, so long as the aforementioned comports with applicable law and industry standards.

NOTE: For security purposes including to prevent recovery or attempts to halt destruction of Personal Data that is or is scheduled to be destroyed, Panorama can only provide limited information about its procedures.

OTHER INFORMATION

No International Transfers

Panorama does not engage in international transfer of any Personal Data.

OTHER OPERATIONAL INFORMATION RELATING TO PRIVACY

Breach Notification of Personal Data

Panorama complies with both contractual and regulatory requirements related to the notification of the breach of Personal Data.

Panorama notifies its Clients of any confirmed “breach” where “breach” is defined either by contract and if no definition in contract,  the meaning ascribed by applicable state law on breach notification.

Panorama also examines applicable state law(s) on breach notification in determining notification timing, recipients, content of notice and other information.

Privacy Audits and Assessments

Panorama conducts periodic audits and assessments of its privacy program.  For more information, contact the designated Data Privacy and Protection Officer by emailing: privacy@panoramaed.com

NOTE: Disclosure of certain information may not be permitted due to obligations of confidentiality or as a matter of trade secret or other business and/or legal justification.

Privacy By Design/Default

Panorama has been implementing applicable portions of the:

1. Privacy-by-Design approach to systems engineering formalized in a 1995 joint report on privacy-enhancing technology by a joint team of the Information and Privacy Commissioner of Ontario (Canada), the Dutch Data Protection Authority, and the Netherlands Organization for Applied Scientific Research; and
2. Privacy-by-Design Framework published in 2009 and adopted by the International Assembly of Privacy Commissioners and Data Protection Authorities in 2010.

Privacy by Design is intended to be implemented throughout the whole engineering process.

Privacy Records

Panorama has been working to formally record information about processing Personal Data to address changes to applicable laws and enactment of new laws including, but not limited to:

1. Privacy Impact Assessments; and
2.  Records of Processing Activity

Protection of Personal Data Related to Panorama as a Vendor of Education Technology More information about Panorama’s Information Security Program is available by contacting security@panoramaed.com.

Revisions and Updates

Prior versions of information on Panorama’s Privacy Program are available upon written request.  Please contact: privacy@panoramaed.com

Terms of Service

Panorama rigorously maintains its confidentiality obligations with Clients.  Please contact the relevant Client for the applicable terms of service governing the use of the Services sold to them.

HOW AN INDIVIDUAL CAN CONTROL PERSONAL DATA ACCESSED/COLLECTED BY PANORAMA SERVICES

Panorama’s Ability and Process to Fulfilling a Data Subject Request (“DSR”)

Panorama cannot feasibly fulfill a DSR pursuant to applicable laws related requests made by an individual until after the requestor has been verified to have a legitimate right to make the request.  Panorama Clients are the best resource to verify with access and collection authorized by Clients. Accordingly, Panorama must rely on Clients to verify that requests and requestors are legitimate as well as follow the instructions of the client in terms of responding to a DSR.  

Any requests from individuals or entities related to Personal Data accessed or collected by Panorama Services are acknowledged and also forwarded to the applicable Client (once identified) for verification and instructions before any further action can be taken by Panorama.

Despite the limited ability to fulfill an exercise of a privacy right without support from a Panorama Client, Panorama strives to support the data privacy and protection rights of individuals.  Accordingly, feel free to contact Data Privacy and Protection Officer with any questions or to facilitate the response of a privacy by emailing: privacy@panoramaed.com.

Privacy Rights Recognized by Panorama

Subject to applicable laws and other legal requirements, Panorama recognizes the following privacy rights of individuals whose Personal Data is related to Panorama’s role as a vendor of education technology:  

Right to Be Informed

This includes information about

1. what Personal Data about the individual (or “Data Subject”) that Panorama has custody or otherwise access to;
2. third parties (such as subcontractors) used by Panorama to process Personal Data (if not expressly prohibited by applicable law, Panorama may describe or categories such third parties rather than provide the legal name or identity for the purposes of maintaining reasonable security);
3. retention period of Personal Data; 
4. other information requested and mandated for disclosure by applicable law

Right of Access

Right of access is dependent on applicable law and may vary based on each individual and circumstance; however, in general the right to access includes:

1. A right to see and receive copies upon request of the information subject to:
   1. what Panorama can reasonably provide that is not unduly burdensome or disruptive;
   2. a reasonable fee; and
   3. a reasonable time to provide within the allowable period and parameters defined by applicable law
2. Subject to applicable law, a right to information such as
   1. the purposes for processing their Personal Data;
   2. the categories of Personal Data processed;
   3. the recipients or categories of recipients;
   4. the planned duration of storage or criteria for their definition;
   5. information about the applicable rights of the individual in accordance with applicable law which may or may not include the following:
      1. rectification,
      2. erasure or restriction of processing
      3. the right to object
      4. instructions on the right to file a complaint with the applicable authorities
      5. information about the origin of the Personal Data when such Personal Data was not collected by Panorama directly from the data subject; and
      6. any existence of an automated decision-taking process, including profiling, with meaningful information about the logic involved as well as the implications and intended effects of such procedures.

Right to Rectification

This includes the right to:

1. correct inaccurate Personal Data, and 
2. complete or supplement incomplete Personal Data

If required by law or other obligation, this right may also include making reasonable efforts to communicate an amendment to others in the network identified by the individual as needing the amendment, as well as generally to other parties that are known to have the information about the individual.

Right to Deletion/to be Forgotten ¹

The right to be forgotten involves having removed or having requested and obtained removal of content or information posted by the individual on a website, application, or online service controlled by Panorama.

NOTE: any deletion of information for the purposes of accuracy would fall under a right to rectification.

Right to Restrict Processing

This right limits the way that Panorama uses information of the individual and is an alternative to requesting the erasure; it applies primarily to situations where an individual wants to restrict the processing for a particular reason.  Examples include:

1. Wanting to limit use of certain personal information but still wanting that information kept on file and also not wanting the Personal Data to be erased; 
2. While exercising a right to rectification and/or this right to restrict processing, the individual may want the use of the contested information for any purpose other than dealing with the request to rectify and/or restrict processing; or 
3. Panorama no longer needs the information for the purposes of processing, but the individual needs Panorama to keep it for a legal claim in which the individual is involved.

Right to Object to Processing

This right is related to halting the processing of an individual’s Personal Data and, depending on applicable law, “processing” includes obtaining, recording and storing the information.

Right to Portability

The right to data portability allows individuals to obtain and reuse their Personal Data for their own purposes across different services. It allows an individual to move, copy or transfer Personal Data easily from one technology environment to another in a safe and secure way, without affecting its usability.

Rights with Regards to Automated Decision Making and Profiling

The right refers to not being subject to a decision when:

1. it is based on automated processing; and
2. it produces either an adverse legal effect or significantly affects the individual.

For the purposes of this section, processing is “automated” where it is carried out without human intervention and includes profiling. Where “profiling” means any form of automated processing of Personal Data consisting of the use of Personal Data to evaluate certain personal aspects relating to a natural person (in particular to analyze or predict aspects concerning that individual’s performance at work, economic situation, health, and personal preferences).

NOTE: This data subject rights request will need to be verified by Panorama’s applicable Client (as the “data controller” held responsible by applicable law(s)).  Such verification by the Client as the data controllers required  before Panorama ceases any automated decision making and profiling of a data subject.

ADDITIONAL INFORMATION FOR CALIFORNIA RESIDENTS

If you are a California resident, California law requires us to provide you with the following additional information about the purpose for which we use each category of “personal information” (as defined in the California Consumer Privacy Act (“CCPA”) that we collect, and the categories of third parties to whom we either disclose such personal information for a business purpose, or to whom we “sell” personal information or “share” personal information for cross-context behavioral advertising. Under the CCPA, “sale” and “sharing” are broadly defined such that they may include allowing third parties to receive certain information, such as cookies, IP address, and/or browsing activity, to deliver targeted advertising or provide analytics on the Services or other websites and apps. When the terms “sale” and “sharing” are used in this Privacy Statement with quotes, we are referring to the CCPA definitions of these terms.

 

For more information about each category, purpose of use, and the third parties to which we disclose, “sell,” or “share” information, please see the sections “How We Collect Information,” “How We Use Information,” and “How We Share Information” above.

Your Choices Regarding “Sales” and “Sharing.”

To opt out of our “sales” of your personal information or our “sharing” of your personal information for purposes of cross-context behavioral advertising, please contact privacy@panoramaed.com.

Other CCPA Rights.  

The CCPA also allows you to limit the use or disclosure of your “sensitive personal information” (as defined in the CCPA) if your sensitive personal information is used for certain purposes.  Please note that we do not use or disclose sensitive personal information as defined by the CCPA.

Retention of Your Personal Information.

Please see the “HOW LONG DOES PANORAMA RETAIN PERSONAL DATA” section above for information about how long we retain your information.

Notice Concerning Do Not Track.

Do Not Track (“DNT”) is a privacy preference that users can set in certain web browsers. We do not currently recognize or respond to browser-initiated Do Not Track signals.

California “Shine the Light” Disclosure.

The California “Shine the Light” law gives residents of California the right under certain circumstances to opt out of the disclosure of certain categories of personal information (as defined in the Shine the Light law) with third parties for their direct marketing purposes.  We do not currently disclose your personal information to third parties for their own direct marketing purposes.

CHANGES TO OUR PRIVACY STATEMENT

Panorama  may modify or update this Privacy Statement from time to time, so you should review this page periodically. If we make a material change to this Privacy Statement  with respect to how we collect and use personal information, we will provide at least 30 days’ prior written notice to Clients by email to the email address specified in the applicable contract. Clients are responsible for ensuring that we have an up-to-date, active, and deliverable email address to provide such notice and for periodically visiting this Privacy Statement to check for any changes.

WHISTLEBLOWER POLICY

Panorama is committed to the highest standards of openness and accountability.  As such, we recognize our professional responsibility to speak up and report unethical behavior. If a Panorama employee (current or former), contractor, volunteer, or user/customer believes Panorama, or a member of staff, has taken action that is of concern, all reasonable steps should be taken to communicate concerns through appropriate channels. These concerns could include:

• Financial impropriety or fraud
• Failure to comply with a legal obligation
• Dangers to health & safety or the environment
• Criminal activity
• Improper conduct or unethical behavior
• Attempts to conceal any of these

All individuals who disclose such concerns will be protected provided the disclosure is made:

• in good faith
• in the reasonable belief of the individual making the disclosure that it tends to show impropriety and if they make the disclosure to an appropriate person (see below). It is important to note that no protection from internal disciplinary procedures is offered to those who choose not to report through the identified channels.

Panorama will treat all such disclosures in a confidential and sensitive manner. We will work to keep the identity of the individual making the allegation confidential so long as it does not hinder or frustrate any investigation. However, the investigation process may reveal the source of the information and the individual making the disclosure may need to provide a statement as part of the evidence required. An individual can disclose through the following designated channel: Confidential email submission – peopleteam@panoramaed.com.

---

¹ In general, the right to privacy constitutes information that is not publicly known, whereas the right to be forgotten involves removing information that was publicly known at a certain time and not allowing third parties to access the information.  Consideration of the right to be forgotten has been considered in US case law, specifically in Melvin v. Reid, 112 Cal.App. 285, 297 P. 91 (1931); Sidis v F-R Publishing Corporation 311 U.S. 711 61 S. Ct. 393 85 L. Ed. 462 1940 U.S. and Sidis v F-R Publishing Corporation 311 U.S. 711 61 S. Ct. 393 85 L. Ed. 462 1940 U.S..