\n \n
\n Who we are
\n \n At Penrose Education, our aim is to help you create, manage and share your portfolio. As you collect evidence you\n need to know that this data is safe and being processed securely. Your privacy and security are our number one\n priority. See our Privacy Policy below to learn more about how we collect, use and share your data. If you have\n any questions about this Privacy Policy, please contact paul@penrose.education\n
\n Our Privacy Policy
\n Last updated: (April 2024)\n \n Penrose Education Ltd (\"us\", \"we\", or \"our\") operates https://mosaic.penrose.education (the \"Site\"). This page\n informs you of our policies regarding the collection, use and disclosure of Personal Information we receive from\n users of the Site.\n
\n DEFINITIONS AND INTERPRETATIONS
\n In this Privacy Policy, the following definitions are used:\n
\n\n \n
\n
Data
\n
\n Collectively all information that you submit to Penrose Education Ltd via mosaic.penrose.education. This\n definition incorporates, where applicable, the definitions provided in the Data Protection Laws;\n
\n
\n
\n
Data Protection Laws
\n
\n Any applicable law relating to the processing of personal Data, including but not limited to the Directive\n 96/46/EC (Data Protection Directive) or the GDPR, and ay national implementing laws, regulations and secondary\n legislation, for as long as the GDPR is effective in the UK;\n
\n
\n
\n
GDPR
\n
The General Data Protection Regulation (EU) 2016/679;
\n
\n
\n
Penrose Education Ltd (“us”, “we” or “our”)
\n
\n Penrose Education Ltd, a company incorporated in England and Wales with registered number 12220704 whose\n registered office is at 2 Perrygate Avenue, Manchester, M20 1JR.\n
\n
\n
\n
User (“you” or “your”)
\n
\n Any third party that accesses the Website and is not either (i) employed by Penrose Education Ltd and acting\n in the course of their employment or (ii) engaged as a consultant or otherwise providing services to Penrose\n Education Ltd and accessing the Website in connection with the provision of such services; and\n
\n
\n
\n
Website
\n
\n The website, mosaic.penrose.education, and any sub-domains of this site unless expressly excluded by their own\n terms and conditions.\n
\n
\n
\n
Mobile App
\n
\n The Mobile app Mosaic Tile available in the Apple App Store and Google Play Store.\n
\n
\n
\n In this Privacy Policy, unless the context requires a different interpretation:
\n \n - The singular includes the plural and vice versa;
\n - \n References to sub-clauses, clauses, schedules or appendices are to sub-clauses, clauses, schedules or appendices\n of this Privacy Policy;\n
\n - A reference to a person includes firms, companies, government entities, trusts and partnerships;
\n - “Including” is understood to mean “including without limitation”;
\n - Reference to any statutory provision includes any modification or amendment of it;
\n - The headings and sub-headings do not form part of this Privacy Policy
\n
\n SCOPE OF THIS PRIVACY POLICY
\n \n - \n This Privacy Policy applies only to the actions of Penrose Education Ltd and Users with respect to the Website.\n It does not extend to any websites that can be accessed from this Website including, but not limited to, any\n links we may provide to social media websites.\n
\n - \n For purposes of the applicable Data Protection Laws, Penrose Education Ltd is the “data controller”. This means\n that Penrose Education Ltd determines for which, and the manner in which, your Data is processed.\n
\n - \n This policy only relates to instances where we are the Data Controller and we directly collect the\n information from individuals.\n
\n - \n We do not process any personal data that we receive indirectly from third-parties, other than where we are\n acting on the instructions of our Clients. These may be your employer, an independent training provider, a\n college, university or any other organisation who may have engaged with us for the purposes of using our\n products to provide you with a service. In these circumstances our Clients are the Data Controller and we\n are the Data Processor. If you have any questions about how our Clients process your personal information,\n then you must contact that organisation directly.\n
\n
\n \n
\n
\n DATA COLLECTED
\n \n - \n We may collect the following Data, which includes personal Data, from you:\n All customers\n
\n - Name, as given by you or your training provider
\n - Email address, as given by you or your training provider
\n
\n Appropriate Body customers only\n \n - Date of Birth, as given by you, your school or Appropriate Body
\n - TRN, as given by you, your school or Appropriate Bodyr
\n - \n ITT Training Provider, as given by by you, your school your Appropriate Body, or taken from the TRA portal\n
\n - QTS status, as taken from the TRA portal
\n - QTS awarded date, as taken from the TRA portal
\n - ECF Induction status, as taken from the TRA portal
\n
\n \n
\n In each case, in accordance with this Privacy Policy
\n HOW WE COLLECT DATA
\n \n - \n We collect Data in the following ways:\n
\n - Data is given to us by you; and
\n - Data is collected automatically.
\n
\n \n
\n DATA THAT IS GIVEN TO US BY YOU
\n \n - \n Penrose Education Ltd will collect your Data in a number of ways, for example:\n
\n - When you contact us through the Website, by telephone, post, email or through any other means;
\n - \n During account setup, a name and email address will be needed to set up your account. This is given via the\n website either by you, your training provider or a Penrose Education employee with the express permission of\n you or your training provider\n
\n
\n \n
\n In each case, in accordance with this privacy policy.
\n DATA THAT IS COLLECTED AUTOMATICALLY
\n \n - \n To the extent that you access the Website, we will collect your Data automatically, for example:\n
\n - \n We automatically collect some information about your visit to the Website. This information helps us to make\n improvements to Website content and navigation, and includes your IP address (anonymised), the date, time\n and frequency with which you access the Website and the way you use and interact with its content.\n
\n - \n In the case of Appropriate Body customers only, we automatically check TRN and DoB against the TRA to\n collect certain data as outlined above.\n
\n
\n \n
\n
\n HOW WE STORE DATA
\n \n - \n We store data in the following ways:\n
\n - \n Your data used for the running of the application is stored on Heroku provisioned databases. Heroku is a UK\n GDPR compliant Platform as a Service (PaaS) provider of database and computing resources. They are GDPR\n compliant and use AWS servers based in Ireland for their Europe region, which we utilise\n
\n - Logging data is stored within the EU with Sumologic, a GDPR-compliant provider of logging services.
\n
\n \n
\n
\n OUR USE OF DATA
\n \n - \n Any or all of the above Data may be required by us from time to time in order to provide you with the best\n possible service and experience when using our Website. Specifically, Data may be used by us for the following\n reasons:\n
\n - Internal record keeping;
\n - Improvement of our products/services;
\n - \n Contact for market research purposes which may be done using email, telephone, fax or mail. Such information\n may be used to customise or update the Website.\n
\n
\n \n
\n In each case, in accordance with this privacy policy.
\n \n - \n We may use your Data for the above purposes if we deem it necessary to do so for our legitimate interests. If\n you are not satisfied with this, you have the right to object in certain circumstances (see the section headed\n “Your rights” below).\n
\n
\n
\n WHO WE SHARE DATA WITH
\n \n - \n We may share your Data with the following groups of people for the following reasons:\n
\n - Your training provider - in accordance with the agreement set out with them as the data controller
\n - \n For Appropriate Body customers only - with the DfE for the purpose of DfE returns, in accordance with the\n agreement set out with your training provider as the data controller\n
\n
\n \n
\n In each case, in accordance with this Privacy Policy.
\n KEEPING DATA SECURE
\n \n - \n We will use technical and organisational measures to safeguard your Data, for example:\n
\n - Access to your account is controlled by a password and an email address that is unique to you.
\n - We store your Data on secure servers.
\n
\n \n - \n Technical and organisational measures include measures to deal with any suspected data breach. If you suspect\n any misuse or loss or unauthorised access to your Data, please let us know immediately by contacting us via this\n email address: paul@penrose.education\n
\n - \n If you want detailed information from Get Safe Online on how to protect your information and your computes and\n devices against fraud, identity theft, viruses and many other online problems, please visit\n www.getsafeonline.org. Get Safe Online is supported by HM Government and leading businesses.\n
\n
\n
\n DATA RETENTION
\n \n - \n Unless a longer retention period is required or permitted by law, we will only hold your Data on our systems for\n the period necessary to fulfil the purposes outlined in this Privacy Policy or until you request that the Data\n be deleted.\n
\n - \n On termination of contract, we will:\n
\n - \n delete your data within 1 year of the termination date unless otherwise agreed with you as the data\n controller.\n
\n - transfer data to you in a portable format at your request within a reasonable time frame.
\n
\n \n - \n Even if we delete your Data, it may persist or backup or archival media for legal, tax or regulatory purposes.\n
\n - \n As outlined in the Sub-processors section below, we utilise a few additional services to run the Mosaic\n application. See the table below for retention policies\n
\n
\n
\n YOUR RIGHTS
\n \n - \n You have the following rights in relation to your Data:\n
\n - \n Right to access – the right to request (i) copies of the information we hold about you at any time, or (ii)\n that we modify, update or delete such information. If we provide you with access to the information we hold\n about you, we will not charge you for this, unless your request is “manifestly unfounded or excessive.”\n Where we are legally permitted to do so, we may refuse your request. If we refuse your request, we will tell\n you the reasons why.\n
\n - Right to correct – the right to have your Data rectified if it is inaccurate or incomplete.
\n - Right to erase – the right to request that we delete or remove your Data from our systems.
\n - \n Right to restrict our use of your Data – the right to “block” us from using your Data or limit the way in\n which we can use it.\n
\n - Rights to data portability – the right to request that we move, copy or transfer your Data.
\n - \n Right to object – the right to object to our use of your Data including where we use it for our legitimate\n interests.\n
\n
\n \n - \n To make enquiries, exercise any of your rights set out above, or withdraw your consent to the processing of your\n Data (where consent is our legal basis for processing your Data), please contact us via this email address:\n paul@penrose.education.\n
\n - \n You have the right to complain to the privacy regulator in the country in which you reside, where you work, or\n anywhere where you believe we might have broken data protection rules.\n
\n - \n In the UK, the privacy regulator is the Information Commissioner's Office (the \"ICO\"). The ICO can be\n contacted at:\n
\n - \n Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF\n
\n - Telephone: 0303 123 1113 (local rate) or 01625 545 745
\n - Email: https://ico.org.uk/global/cont...
\n
\n \n
\n \n - \n It is important that the Data we hold about you is accurate and current. Please keep us informed if your Data\n changes during the period for which we hold it.\n
\n
\n
\n LINKS TO OTHER WEBSITES
\n \n - \n This Website may, from time to time, provide links to other websites. We have no control over such websites and\n are not responsible for the content of these websites. This Privacy Policy does not extend to your use of such\n websites. You are advised to read the Privacy Policy or Statement of other websites prior to using them.\n
\n
\n
\n External Storage Integrations
\n \n - \n Mosaic offers the ability to integrate with external storage providers: Google Drive and Microsoft OneDrive.\n These Integrations allow Trainees to access and update Files/Folders stored in external storage via Mosaic, and\n automate sharing of these files with other Users.\n
\n
\n Google Drive
\n If your Training Provider has chosen to use the Google Drive integration, the following will apply:
\n \n - \n Mosaic uses the Google Drive API to access and update files/folders stored in Google Drive. When a Trainee\n connects their Google Drive account to Mosaic, Mosaic requests the following permissions from Google Drive:\n
\n \n - View your Google account name and email address
\n - See, edit, create and delete all of your Google Drive files (Trainees only)
\n
\n
\n
\n How Mosaic accesses and uses your Google User data (Trainees)
\n The following applies to how Mosaic uses your data if you are a Trainee User.
\n \n - \n Mosaic stores your Google Drive email address and API tokens so that subsequent requests made to the Google\n Drive API can be authenticated.\n
\n - \n Mosaic will only use these credentials to update files/folders in your Google Drive based on the authenticated\n User's input on Mosaic. For example, if you create a file in the Mosaic Files area, Mosaic will send a request\n to create a File in your Google Drive area. The same applies for viewing your files within Mosaic and making any\n other file/folder updates via the Mosaic Files area .\n
\n - \n When you link your Google account to Mosaic, Mosaic will create a folder within your OneDrive called \"Mosaic\".\n Mosaic will only make updates to your Google Drive within this folder.\n
\n
\n
\n Sharing
\n \n - \n In order to access your Files properly, Mosaic will need to share the files with other Instructor users in your\n institution. When an Instructor who has been granted permission to view your Mosaic account accesses your Files\n area for the first time, Mosaic uses the Google API to share the \"Mosaic\" folder created in your Google Drive\n with the Instructor's linked Google Account.\n
\n - \n Mosaic never shares your Google User data with third parties, nor does it use this data for any other purposes\n than proper working of the Mosaic Files area.\n
\n
\n
\n How Mosaic accesses and uses your Google User data (Instructors)
\n The following applies to how Mosaic uses your data if you are an Instructor User.
\n \n - Mosaic stores your Google Drive email address and nothing else.
\n - \n As an Instructor user, your Google User data is only used in a very limited way. The purpose of storing your\n email address is so that Mosaic can share Trainee \"Mosaic\" folders held on their Google Drives with your Google\n account automatically, when you first view a Trainee's Files area on Mosaic.\n
\n
\n
\n Microsoft OneDrive
\n If your Training Provider has chosen to use the Microsoft OneDrive integration, the following will apply:
\n \n - \n Mosaic uses the Microsoft OneDrive API to access and update files/folders stored in Microsoft OneDrive. When a\n Trainee connects their Microsoft OneDrive account to Mosaic, Mosaic requests the following permissions from\n Microsoft OneDrive:\n
\n \n - View your Microsoft account name and email address
\n - Read and write your files in OneDrive
\n - View and manage your OneDrive files
\n
\n
\n
\n How Mosaic accesses and uses your Microsoft User data (Trainees)
\n The following applies to how Mosaic uses your data if you are a Trainee User.
\n \n - \n Mosaic stores your Microsoft OneDrive email address and API tokens so that subsequent requests made to the\n Microsoft OneDrive API can be authenticated.\n
\n - \n Mosaic will only use these credentials to update files/folders in your Microsoft OneDrive based on the\n authenticated User's input on Mosaic. For example, if you create a file in the Mosaic Files area, Mosaic will\n send a request to create a File in your Microsoft OneDrive area. The same applies for viewing your files within\n Mosaic and making any other file/folder updates via the Mosaic Files area.\n
\n - \n When you link your Microsoft account to Mosaic, Mosaic will create a folder within your OneDrive called\n \"Mosaic\". Mosaic will only make updates to your Microsoft OneDrive within this folder.\n
\n
\n
\n Sharing
\n \n - \n In order to access your Files properly, Mosaic will need to share the files with other Instructor users in your\n institution. When an Instructor who has been granted permission to view your Mosaic account accesses your Files\n area for the first time, Mosaic uses the Microsoft API to share the \"Mosaic\" folder created in your Microsoft\n OneDrive with the Instructor's linked Microsoft Account.\n
\n - \n Mosaic never shares your Microsoft User data with third parties, nor does it use this data for any other\n purposes than proper working of the Mosaic Files area.\n
\n
\n
\n How Mosaic accesses and uses your Microsoft User data (Instructors)
\n The following applies to how Mosaic uses your data if you are an Instructor User.
\n \n - Mosaic stores your Microsoft OneDrive email address and nothing else.
\n - \n As an Instructor user, your Microsoft User data is only used in a very limited way. The purpose of storing your\n email address is so that Mosaic can share Trainee \"Mosaic\" folders held on their Microsoft OneDrives with your\n Microsoft account automatically, when you first view a Trainee's Files area on Mosaic.\n
\n
\n\n
\n CHANGES
\n \n - \n Penrose Education Ltd may, from time to time, expand or reduce our business and this may involve the sale and/or\n transfer of control of all or part of Penrose Education Ltd. Data provided by Users will, where it is relevant\n to any part of our business, be transferred along with that part and the new owner or newly controlling party\n will, under the terms of this Privacy Policy, be permitted to use the Data for the purposes for which it was\n originally supplied to us.\n
\n - We may also disclose Data to a prospective purchaser of our business or any part of it.
\n - In the above instances, we will take steps with the aim of ensuring your privacy is protected.
\n
\n
\n COOKIES
\n \n - \n This Website may place and access certain Cookies on your computer. Penrose Education Ltd uses Cookies to\n improve your experience of using the Website. Penrose Education Ltd has carefully chosen these Cookies and has\n taken steps to ensure that your privacy is protected and respected at all times.\n
\n - All Cookies used by this Website are used in accordance with current UK and EU Cookie Law.
\n - \n Before accessing the part of the website that uses cookies, you will be presented with this privacy policy and\n asked to consent to the use of these cookies. By giving your consent to the placing of Cookies, you are enabling\n Penrose Education Ltd to provide a better experience and service to you. You may, if you wish, deny consent to\n the placing of Cookies; however certain features of the Website may not function fully or as intended.\n
\n - This Website may place the following Cookies:
\n\n
\n \n
\n
Type of Cookie
\n
Purpose
\n
\n
\n
Analytical/performance cookie
\n
\n Allow us to recognise and count the number of visitors and to see how visitors move around our website when\n they are using it. This helps us to improve the way our website works, for example, by ensuring that users\n are finding what they are looking for easily.\n
\n
\n
\n
Functionality cookie
\n
\n This cookie is user to recognise you when you return to our website. This enables us to personalise content\n for you, greet you by name and remember your preferences (for example, your choice of language or region).\n
\n
\n
\n\n - You can find a list of Cookies that we use in the Cookies Schedule.
\n - \n You can choose to enable or disable Cookies in your internet browser. By default, most internet browsers accept\n Cookies but this can be changed. For further details, please consult the help menu in your internet browser.\n
\n - \n You can choose to delete Cookies at any time; however you may lose any information that enables you to access\n the Website more quickly and efficiently including, but not limited to, personalisation settings.\n
\n - \n It is recommended that you ensure that your internet browser is up-to-date and that you consult the help and\n guidance provided by the developer of your internet browser if you are unsure about adjusting your privacy\n settings.\n
\n - \n For more information generally on cookies, including how to disable them, please refer to aboutcookies.org. You\n will also find details on how to delete cookies from your computer.\n
\n
\n
\n GENERAL
\n \n - \n You may not transfer any of your rights under this privacy policy to any other person. We may transfer our\n rights under this privacy policy where we reasonably believe your rights will not be affected.\n
\n - \n If any court or competent authority finds that any provision of this Privacy Policy (or part of any provision)\n is invalid, illegal or unenforceable, that provision or part-provision will, to the extent required, be deemed\n to be deleted, and the validity and enforceability of the other provisions of this Privacy Policy will not be\n affected.\n
\n - \n Unless otherwise agreed, no delay, act or omission by a party in exercising any right or remedy will be deemed a\n waiver of that, or any other, right or remedy.\n
\n - \n This Agreement will be governed by and interpreted according to the law of England and Wales. All disputes\n arising under the Agreement will be subject to the exclusive jurisdiction of the English and Welsh courts.\n
\n
\n
\n CHANGES TO THIS PRIVACY POLICY
\n \n - \n Penrose Education Ltd reserves the right to change this Privacy Policy as we may deem necessary from time to\n time or as may be required by law. Any changes will be immediately posted on the Website and you are deemed to\n have accepted the terms of the Privacy Policy on your first use of the Website following the alterations.\n
\n
\n If you have any questions about this Privacy Policy, please contact paul@penrose.education
\n
\n COOKIES
\n \n Below is a list of the cookies that we use. We have tried to ensure this is complete and up to date, but if you\n think that we have missed a cookie or there is any discrepancy, please let us know.\n
\n \n Analytical/performance\n
\n We use the following analytical/performance cookies:
\n \n
\n
Description of Cookie
\n
Purpose
\n
\n
\n
Analytical/performance cookie
\n
\n Allow us to recognise and count the number of visitors and to see how visitors move around our website when\n they are using it. This helps us to improve the way our website works, for example, by ensuring that users are\n finding what they are looking for easily.\n
\n
\n
We use the following functionality cookies:
\n \n
\n
Description of Cookie
\n
Purpose
\n
\n
\n
Functionality cookie
\n
\n This cookie is user to recognise you when you return to our website. This enables us to personalise content\n for you, greet you by name and remember your preferences (for example, your choice of language or region).\n
\n
\n
\n Sub-processors
\n \n Mosaic uses certain sub-processors purely for the purposes of running, maintaining and monitoring the Mosaic\n application. Below is a list of sub-processors we use\n
\n \n
\n
Sub-processor
\n
Purpose
\n
Location of processing/storage
\n
Retention policy
\n
\n
\n
Heroku Services
\n
\n Provision cloud-based servers and databases for the running of the Mosaic application\n
\n
Ireland (Heroku Europe Region)
\n
Managed by Penrose Education in line with the terms set out above
\n
\n
\n
Sumologic
\n
\n Application logging to support debugging of live issues and monitoring of performance\n
\n
EU
\n
30 days
\n
\n
\n
Postmark
\n
\n Email service for the Mosaic application - handling support emails, and other automated emails from the\n platform as configured by you.\n
\n
US*
\n
45 days
\n
\n
\n
Gitlab
\n
\n Code storage for the Mosaic repository. Holds some emails for the purposes of data migration tasks\n
\n
US*
\n
Determined by Penrose Education in accordance with retention policy
\n
\n
\n
Github
\n
\n Code storage and infrastructure management for the Mosaic repository. Holds some emails for the purposes of\n data migration tasks\n
\n
US*
\n
Determined by Penrose Education in accordance with retention policy
\n
\n
\n
Sentry
\n
\n Application Logging to support debugging of live issues and monitoring of performance\n
\n
US*
\n
30 days
\n
\n
\n
AWS
\n
\n Storage of files uploaded by users to Mosaic and caching of course content for faster downloads.\n
\n
\n
User files - EU (Ireland)
\n
Course content caching - Global, dependent on user location**
\n
\n
Determined by Penrose Education in accordance with retention policy
\n
\n
\n *The GDPR do not require data to be stored within the EU so long as data is transferred in an appropriate manner.\n Postmark, Github and Gitlab are fully GDPR compliant, and the data is not used for anything other than the\n purposes outlined in this privacy policy. For information on how each of these companies uses data, including\n their use of standard contractual clauses for use of data outside of the EU, please see the links below:\n
\n \n **To improve download speeds when accessing files on Mosaic across the globe, we use a service that caches files\n on servers closer to the user temporarily. This service is provided by AWS and is GDPR compliant.\n
\n \n \n