Privacy Policy

Last Updated: September 17, 2025

Introduction

ETOS US Inc. (“ETOS,” “we,” “our,” or “us”) provides digital learning solutions, including the artefakt product (“artefakt” or “our Services”), to schools, districts, and other educational institutions (“Institutions”). We are committed to protecting the privacy of students, educators, staff, and families who use our Services. This Privacy Policy explains what data we collect, how we use it, and what rights you have.

This Policy is designed to comply with:

The Children’s Online Privacy Protection Act (COPPA),
The Family Educational Rights and Privacy Act (FERPA), and
The General Data Protection Regulation (GDPR) and related laws.

By using our Services, Institutions agree to this Privacy Policy and related agreements (e.g., End User License Agreement, Data Processing Agreement including addendums thereto).

Scope

This Privacy Policy applies to:

Institutions that license and manage artefakt,
Authorized staff, teachers, and administrators,
Students who access artefakt through their Institution, and
Parents/guardians where parental engagement features are enabled.

This Policy does not apply to:

Visitors of our public marketing website

Services offered by third parties we do not control, or
Job applicants and employment records.

Information We Collect

Institution & Staff Information

We collect the following information from Institutions and their staff to operate and support artefakt:

Institution Profiles: name, address, contact details, billing information, and technical configuration.
Staff Accounts: names, emails, phone numbers, job roles, classes managed, and permissions.
Support Records: contact details, tickets, and communications with our support team.
Usage Data: logs of activities, communications, and session records to improve service reliability.

Student Information

We only collect student information with verified consent from the Institution, acting under FERPA and COPPA requirements. Depending on features enabled, this may include:

Account Information: name, username, email, or anonymized identifiers (when enabled).
Learning Activity: responses, notes, assessments, tutoring sessions, chat logs, video/audio participation, and collaborative work.
Device & Technical Data: IP address, device type, browser version, login times, and diagnostic information.
Location Data: only for Institution-owned devices if location tracking is required for safety or device management.
Integration Data: information shared through authorized third-party systems (e.g., LMS or SIS).
Assessment Data (artefakt Assessment): demographic data such as age/grade level, test results, and evaluator notes.

Parent/Guardian Information

If enabled by the Institution, we may process parent or guardian contact details (name, email, phone number) to send updates, progress reports, or communications.

Automatically Collected Information

When using artefakt, we automatically collect technical information to ensure stability, security, and performance:

IP address, device type, browser, operating system
Login times, usage duration, crash logs
Cookies or local storage for authentication, preferences, and analytics

We do not use cookies for advertising or behavioral tracking.

How We Use Information

We use collected information to:

Provide, support, and maintain artefakt services
Authenticate users and manage accounts
Deliver learning activities and assessment tools
Support teachers and administrators with insights and reports
Communicate with Institutions
Improve service functionality, usability, and security
Conduct research and analytics in aggregated or de-identified form only
Comply with legal requirements and enforce our agreements

We never:

Sell or rent personal student information
Use student data for targeted advertising
Build profiles of students for commercial purposes

We share information only in limited circumstances:

With Institutions: authorized staff control access to student data.
With Service Providers: third parties that support hosting, communications, or analytics—bound by strict confidentiality and security contracts.
With Affiliates: within the ETOS group, for operational support under the same protections.
For Legal Reasons: when required by law, court order, or government request.
For Business Transactions: if ETOS is acquired or merged, data may transfer under equal or stronger protections.
In De-identified Form: for research, reporting, or service improvement.

We do not disclose identifiable student information to advertisers or unrelated third parties.

Data Retention & Deletion

Student Data: retained only as long as required by the Institution or applicable law. Deleted or de-identified promptly upon written request or contract termination.
Staff & Parent Data: retained only as long as necessary for service delivery, support, or legal compliance.
Backups & Logs: retained for a limited period for security and recovery, then securely deleted.

Rights of Students, Parents, and Institutions

Under FERPA (U.S.)

Parents and eligible students may review, correct, or request deletion of education records.
Institutions remain the primary authority (“data controllers”) over student records.

Under COPPA (U.S)

For children under 13, Institutions (on behalf of parents) provide verifiable consent before data is collected.
Parents may review, restrict, or delete their child’s information.

Under GDPR (EU/EEA/UK)

Individuals (or their parents/guardians if minors) have the right to access, correct, delete, or transfer personal data.
ETOS acts as a data processor; Institutions act as data controllers.
Requests must be made through the Institution; ETOS supports Institutions in fulfilling them.

Data Portability under GDPR

Students, parents, and staff have the right to receive their personal data in a structured, commonly used, and machine-readable format, and to have that data transmitted directly to another service provider where technically feasible.

To exercise data portability rights:

Students and Parents: Submit requests through your Institution's designated contact or administrator. The Institution will coordinate with ETOS to fulfill the request.

Staff: Contact your Institution's administrator or submit requests directly to legal@etos.org.

ETOS will provide portable data in standard formats such as CSV, JSON, or PDF, depending on the type of Information requested. We will respond to valid portability requests within 30 days.

Please note: Data portability rights apply only to personal data that you have provided to us and that we process based on your consent or for the performance of a contract. This right does not apply to data that has been anonymized or aggregated, or to inferences and derived data created by our systems. For data that involves multiple individuals (such as collaborative assignments or group communications), we will coordinate with your Institution to ensure appropriate protections for all parties involved.

Data Security and International Data Transfers

We protect data using administrative, technical, and physical safeguards, including

Encryption in transit and at rest
Secure data centers and network monitoring
Access controls, authentication, and role-based permissions
Employee training and confidentiality obligations
Regular audits, testing, and compliance reviews

International Data Transfers for Users outside the U.S.

Data will be processed in Sweden and/or other EU countries

If a data breach occurs, we will notify affected Institutions and, where required, regulators and individuals.

Cookies & Similar Technologies

We use cookies and local storage to:

Authenticate users and maintain sessions
Store preferences and accessibility settings
Improve product performance and measure aggregate usage

You can disable cookies in your browser, but some features may not function correctly.

Policy Updates

We may update this Privacy Policy from time to time. Significant changes will be communicated to Institutions, and new consent will be obtained if legally required.

Contact Us

If you have questions about this Policy or how your data is handled, please contact:

ETOS US Inc.
Attn: Chief Legal Officer
1401 Lavaca St., #721
Austin, TX, 78733
Email: legal@etos.org
Phone: 512-365-0145

Data Processing Agreement (DPA) Addendum

Last Updated: September 17, 2025

This Data Processing Agreement Addendum (“Addendum”) is entered into by and between:

ETOS US Inc. (“ETOS,” “Processor”), and The educational institution, school district, or other licensed customer of artefakt (“Institution,” “Controller”).

This Addendum forms part of the agreement under which ETOS provides “artefakt” and related services (the “Agreement”).

This Addendum works in conjunction with the artefakt Product Privacy Policy.

The Privacy Policy is intended to provide transparency to students, parents/guardians, educators, and staff regarding the collection and use of personal data.
This Addendum governs ETOS’s processing of personal data strictly on behalf of the Institution and establishes the legally binding obligations of both ETOS (as Processor) and the Institution (as Controller).
If there is any conflict between the Privacy Policy and this Addendum, this Addendum shall prevail with respect to ETOS’s role and responsibilities as a Processor under Applicable Data Protection Laws

1. Definitions
For this Addendum:

“Controller”: The Institution that determines the purposes and means of processing personal data.
“Processor”: ETOS, which processes personal data on behalf of the Institution.
“Personal Data”: Any information relating to an identified or identifiable student, staff member, or parent/guardian.
“Processing”: Any operation performed on personal data, such as collection, storage, use, transfer, or deletion.
“Applicable Data Protection Laws”: GDPR, FERPA, COPPA, and any other applicable data privacy regulations.

2. Scope & Roles

The Institution is the Controller of all student, staff, and parent personal data processed in artefakt.
ETOS acts solely as a Processor and processes data only on documented instructions from the Institution.
ETOS will not process personal data for its own purposes, including marketing or advertising.

3. Purpose of Processing
ETOS processes personal data only as necessary to:

Deliver, maintain, and improve artefakt services,
Provide technical support and security,
Comply with legal obligations,
Assist the Institution with educational reporting and analytics.

4. Categories of Data Subjects
Processing may include the following groups:

Students (including minors under COPPA/FERPA),
Teachers, administrators, and staff,
Parents/guardians (if engagement features are enabled).

5. Categories of Personal Data
Depending on services enabled, processing may include:

Account data (names, emails, usernames, IDs),
Educational records (assignments, grades, assessments, feedback),
Communication data (messages, chat, voice/video recordings),
Technical data (device type, IP address, login times),
Parent/guardian contact details (if provided by the Institution).

Sensitive categories (such as health or biometric data) are not required by ETOS and should only be processed if authorized by the Institution.

6. Processor Obligations (ETOS)
ETOS agrees to:

Process data only on documented instructions from the Institution.
Ensure staff with access to data are bound by confidentiality obligations.
Implement technical and organizational security measures (encryption, access controls, audits).
Assist the Institution in responding to data subject rights requests.
Notify the Institution without undue delay in the event of a personal data breach.
Provide documentation and audits necessary to demonstrate compliance.
Delete or return all personal data to the Institution upon contract termination, unless legally required to retain it.

7. Subprocessors

ETOS may engage carefully selected subprocessors (e.g., hosting providers, analytics services) to support artefakt.
ETOS will maintain a public list of subprocessors and provide advance notice of changes.
Subprocessors are bound by written agreements ensuring equivalent protections.
The Institution may object to a new subprocessor if it poses material risks to data protection.

8. International Data Transfers

Personal data will not be transferred outside the EEA, UK, or Switzerland

9. Data Subject Rights
ETOS will assist the Institution in responding to valid requests from students, parents, or staff under:

FERPA (access, correction, deletion),
COPPA (parental review, consent withdrawal, deletion), and
GDPR (access, rectification, erasure, portability, restriction, objection).

ETOS will not respond directly to data subject requests unless instructed by the Institution.

10. Security Measures
ETOS maintains security practices including, but not limited to:

Encryption in transit and at rest,
Role-based access control,
Multi-factor authentication for administrators,
Intrusion detection and monitoring,
Secure software development and vulnerability testing,
Staff training and confidentiality agreements.

11. Breach Notification
In the event of a confirmed personal data breach, ETOS will:

Notify the Institution without undue delay,
Provide details of the breach, affected data, and corrective actions,
Assist the Institution in meeting its legal notification obligations.

12. Term & Termination
This Addendum remains in effect as long as ETOS processes personal data on behalf of the Institution. Upon termination of the Agreement:

ETOS will delete or return all personally identifyable data, unless retention is legally required.
Certifications of deletion will be provided upon request.

13. Governing Law
This Addendum will be governed by the law applicable to the Agreement, unless otherwise required by data protection laws.

14. Contact Information

ETOS US Inc.
Attn: Chief Legal Officer
1401 Lavaca St., #721
Austin, TX, 78733
Email: legal@etos.org
Phone: 512-365-0145

Annex A – List of Authorized Subprocessors

This Annex forms part of the Data Processing Agreement (DPA) Addendum between ETOS US Inc. (“Processor”) and the Institution (“Controller”).

ETOS engages the subprocessors listed below to support delivery of the artefakt platform and related services. Each subprocessor only processes personal data to the extent necessary to provide its specific function and is bound by contractual obligations ensuring compliance with FERPA, COPPA, and GDPR.

1. Infrastructure & Hosting Providers

Subprocessor	Location	Purpose	Safeguards
Microsoft Azure		Hosting, disaster recovery, analytics	SCCs, Data Privacy Framework

2. Communications & Collaboration

Subprocessor	Location	Purpose	Safeguards

3. Learning Analytics & Support Tools

4. Optional Integrations (Institution-enabled)

These subprocessors are only engaged if enabled by the Institution:

Subprocessor	Location	Purpose	Safeguards
Instructure, Inc. (Canvas LMS)	USA, Global	Learning Management System integration	SCCs, Data Privacy Framework
Google	USA	Single Sign-On (SSO) & rostering integration	SCCs
Microsoft	USA	Rostering & integration with school SIS	SCCs

5. General Commitments by ETOS

ETOS ensures all subprocessors are contractually bound to:
- Process data only on ETOS’s documented instructions,
- Maintain equivalent security and privacy standards,
- Support compliance with FERPA, COPPA, and GDPR.
ETOS will provide advance notice (at least 30 days) of any changes to this subprocessor list.
The Institution may object to a new subprocessor if it poses a material risk.