Privacy Policy

This is our Privacy Policy. You should read it because it contains important information about how we collect and use your information when you use our App and Site. The most important things to know are:

1. When you sign up to our App and use the App as a registered user, we will collect some data about you.
2. The reason we collect data about you is to give you the best possible experience with our App, including to let you use interactive and personalised features (like building your profile, uploading videos, sending videos, “following” other users and letting other users “follow” you).
3. We want everyone to have a good experience in our App, and so we ask that you also respect others’ privacy too. For example, if you take a video that shows another person in it, you need to make sure that the other person knows about it and is happy for you to upload their video to the App.
4. You can change and delete your information, including your videos, at any time in the App. You can also delete your whole account at any time, and if you do that we will delete all of the information we have about you, including any videos you’ve uploaded. If you receive emails from us, you can unsubscribe at any time.
5. If you feel confused, unhappy or worried about how any of your information is being used, you can contact us any time by emailing hello@viaacademy.com with the subject line “Privacy Policy”, by using the in-app Contact Us function, or by phone or WhatsApp at +44 7311345970.

Introduction

This Privacy Policy documents how we collect personal data, principally through our VIA Academy mobile application (the “App”) and website (including www.viaacademy.com and its subdomains, collectively, the “Site”) (together, the “Services”) and processed by KaiZhan Limited (Co Reg No 12610906) (“KaiZhan”, “we”, “our”, “us”, and their derivatives).

Our Services are only offered in English. So, by using our Services in English, you are confirming that you understand English well enough to understand this Privacy Policy. If you have any questions about this Privacy Policy, please contact us by emailing us at hello@viaacademy.com with the subject line “Privacy Policy”, by using the in-app Contact Us function, or by phone or WhatsApp at +44 7311345970.

A. IMPORTANT NOTICE FOR PARENTS OR GUARDIANS OF CHILDREN UNDER 13 YEARS

Our Services are designed for and marketed to both adults and children aged 8 and above. Protecting the children who use our App is our priority. In relation to any proposed use of our Services by a child under the age of 13 years, we require the express consent of parents or guardians (referred to throughout as “parent”) of any child who wishes to use our Services to observe, participate in, and/or monitor and guide your child’s use of our Services.

Please therefore read this policy carefully as parents will be legally contracting on behalf of, and responsible for, your designated child.

Certain features of our Services, if activated, will involve the collection and processing of the personal data of children. We require that the parent of a child under 13 years old provides permission and agrees to this Privacy Policy before that child can use our Services. We also reserve the right to verify that the person providing such consent does, in fact, hold parental responsibility for the child. If you believe that a child under age 13 has provided personal data on our App without parental consent, please contact us immediately and we will take action to identify the information provided and, if required, remove such information from our records.

i. Special App registration procedures for children under age 13

When any user (including a child) chooses to create a Registered Account to use our App, we will ask them to provide their date of birth. If a child self-identifies as being under 13 years old, the child will be required to complete a parental notice, verification and consent process before they can create a Registered Account. To initiate the parental notice, verification and consent process, we will ask the child to provide the email address of their nominated parent. We will also collect an FCM token (ie. a unique identifier) from the child’s device in order to respond to the child’s request for parental consent.

The parent will be directed to our “parent portal” operated by “Kids Web Services”/SuperAwesome, where they will be asked to verify their identity as an adult and to consent to the following permissions for basic App features on behalf of their child. As detailed below, the parent may agree to the collection and use of their child’s information, but still not allow disclosure of their child’s information to third parties, except to the extent such disclosure is part of the Services.

The following permissions are required to activate the child’s Registered Account:

• Permission for the child to create a Registered Account and user Profile; and
• Permission for the child to upload videos and written content.

In addition to permissions for the basic App features, the child’s parent will also be asked to manage the child’s permissions for the following extra, optional App features:

• Permission for the child to “be followed” by Academy coaches (which would also allow the child to make his/her videos visible to Academy coaches if the child chooses the “Academies” visibility setting when uploading a video); and
• Permission for the child to receive relevant push notifications.

Parents will also be required to agree to this Privacy Policy and our Terms and Conditions on behalf of the child.

Until we receive parental permission for the basic permissions stated above, the child can only use the App in Guest mode. While the App is being used in Guest mode, we will not collect any personal information from the child, and the child will continue to be blocked from accessing any features that allow them to provide personal information to us or to other users of the App.

If the parent does not provide permission for the basic permissions stated above within 7 days, we will delete the parent’s contact information and any data provided by the child.

If the parent does provide the basic permissions stated above within 7 days, we will ask the child to provide us the information required to create a Registered Account for the child and to create a user Profile in the same way as an individual over the age of 13 years. We will not seek consent from the child following their 13^th birthday, so any consent given at this stage will be deemed to be consent from the child for so long as they continue to hold a Registered Account.

ii. Parent notifications and control over in-App permissions via parent portal

We will notify the parent of the child’s in-App activity using the email address provided to us by the child at the point of registration. Such notifications will include when the child:

• Uploads their first video to the App; and
• When the child turns 13 years old, to alert the parents to changes to the child’s account.

The parent can manage the child’s access to both the basic and extra App features at any time (including revoking access) via the “Kids Web Services” parent portal managed by SuperAwesome.

If the parent chooses to revoke access to any basic App features, we will delete the child’s Registered Account. If the parent chooses to revoke access to any extra App features, we will disable any such feature for the child and we will change any relevant privacy settings for content previously uploaded by the child.

iii. Description of parent rights

At any time, a parent may review their child’s personal information, require us to correct or delete the personal information of their child, request that we delete their child’s Registered Account, or refuse any further collection or use of their child’s personal information, by emailing us at hello@viaacademy.com with the subject line “Privacy Policy”, by using the in-app Contact Us function, or by phone or WhatsApp at +44 7311345970.

B. WHAT PERSONAL DATA DO WE COLLECT?

Where we ask you for information, we will provide clear notice to you explaining what information we are requesting and why we are asking you to provide it to us. We do not require users of the Services, including children under 13 years old, to disclose more Personal Data or other information than reasonably required to use our Services.

If you are a child under 13 years old, we will seek consent from a verified parent before we collect data from you via the App, with the exception of some limited data that we require in order to facilitate the parental consent and verification process. Until we obtain such consent from a verified parent we will not use this data for any other purpose and will not collect any further data from you via the App.

All App users will be prompted to create a “Registered Account” if they attempt to access further features in the App while using the App in Guest Mode. For children under 13 years old, parental permission as outlined above will be required. If a user wishes to sign up for a Registered Account, we will invite them to create a user Profile as well. For a Registered Account with a user Profile, we will collect the following personal data:

In addition to the information that we collect during the registration process, as part of the child’s use of the App’s interactive, community and personalised features, all children with Registered Accounts may choose to upload content to the App which contains further personal data relating to the child. This content may include:

• Profile photo containing your image (this will also require you to grant us access to your phone gallery) (for users over 13 only);
• Video files containing your image and voice (this will also require you to grant us access to your phone gallery); and/or
• Written user-generated-content, for example video descriptions, which may or may not contain your personal data

PLEASE NOTE THAT YOU MUST HAVE PERMISSION TO USE THE PERSONAL DATA OF ANYONE ELSE FEATURED IN ANY CONTENT YOU PROVIDE TO US (INCLUDING IN ANY VIDEO AND/OR PHOTO).

USERS ARE NOT PERMITTED TO USE THE PERSONAL DATA OF ANY CHILDREN UNDER 13 YEARS OLD WHO ARE NOT REGISTERED USERS IN ANY CONTENT YOU PROVIDE TO US (INCLUDING IN ANY VIDEO AND/OR PHOTO).

If you register for the App via “Social Login Providers” (currently Apple, Facebook or Google), those platforms may share your public profile information (including your profile image, email address, Apple ID and first/last name) with us. When you register for the App via such platforms, you may be notified by those platforms of the data we will have access to. If you register for the App via a Social Login Provider, we will not disclose any of your personal data to the Social Login Provider.

On our Site, we will also use Google Analytics (GA4) to collect some aggregated, anonymised user data related to your website behaviour (eg. what pages you looked at, for how long, etc.) using automated technologies i.e., cookies or similar technologies. We run GA4 only in an anonymised version for statistical reporting purposes and have disabled all other data-sharing features. This information is important to us for improving the user experience and determining the effectiveness of our website.  Our Cookies Policy provides further details of such collection and use.

Occasionally we may obtain information from you that constitutes sensitive personal data under some data protection laws (i.e., if you voluntarily provide information about your health, ethnicity or race). By providing us with your sensitive personal information, you consent to us processing that information for the purposes set out in this Privacy Policy or any collection notice provided to you.

C. HOW WE USE YOUR INFORMATION (PURPOSE AND LAWFUL BASIS)

This section explains the purposes for which we use the personal data we collect from you. For individuals in the EU, UK, and other regions with privacy laws that require us to specify our legal basis for processing, this section also lists the legal bases we rely on when processing your personal data.

D. WHO DO WE DISCLOSE YOUR DATA TO?

Other App Users

When a child becomes a Registered Account user, the child’s username, player position, nationality flag, and, if the child is over 13 years old, profile picture (if any), will be visible to other App users. For users aged 18+, their Followers/Following lists will also be visible to other app users initially (however this can be adjusted in profile settings.)

Followers and Following

For users aged 13 years and over:

• Users aged 13 years and over can be followed by both Academies and other App users. When a user aged over 13 registers for the App, they will automatically be “followed” by Academies.
• Users aged 13 years and over can choose who can see their Followers/Following lists by enabling or disabling the “Hide my Followers/Following lists” toggle in their Profile Settings. If a user enables this setting, only their Followers can see who they follow and who follows them. For users aged between 13-17 years old, this setting is enabled by default. For users aged 18+, this setting is disabled by default.
• Users aged 13 years and over can choose whether to enable “Follower requests”. If a user enables “Follower requests”, Academies and other App users need to ask their permission to follow them. For users aged between 13-17 years old, “Follower requests” is enabled by default. For users aged 18+, “Follower requests” is disabled by default.

For children aged under 13 years old:

• Children aged under 13 years old can only be followed by Academies (and not by other App users). “Following” by Academies will also require permission from the child’s parent/guardian via the Parent Portal.
• For children aged under 13 years old, the “Hide my Followers/Following” setting is enabled by default, and this setting cannot be changed. This means that only the child’s Academy Followers (if the parent has given permission for Academy Followers, and if the child has any) will be able to see who the child follows and who follows them.
• For children aged under 13 years old, “Follower requests” are enabled by default, and this setting cannot be changed.

Personal data that may be visible to other App Users depending on user activity

In addition, as part of the child’s use of the App’s interactive, community and personalised features, the child may also make certain other personal data accessible to others both within and outside the App as outlined in the table below. The precise personal data that is disclosed, to whom it is disclosed, and where it is disclosed, will depend on the child’s activity within the App, the age of the child, and (if the child is under 13 years old), the specific permissions set by the parent.

For children under 13 years old:

For children aged over 13 years old and adults:

Users of all ages, including children aged under 13 years old, children aged over 13 years old, and adults, may also choose to download their own videos (featuring the user’s image) to their device.

In the course of using your personal data for the purposes identified in Section C, your personal data may also be disclosed to the following entities:

Service providers

• We use a parental consent/verification service provider called Kids Web Services (“KWS”) to verify parents’ identity and obtain permissions for children under 13. KWS is a product of SuperAwesome Trading Limited and is designed specifically to support kid-friendly registrations and digital experiences, as well as parental management tools, across the web and mobile ecosystem in compliance with the Childrens’ Online Privacy Protection Act (“COPPA”), the EU’s General Data Protection Regulation (“GDPR”), and other applicable law. KWS is certified as COPPA-compliant by the kidSAFE Seal Program, an FTC-Approved COPPA Safe Harbor Program. SuperAwesome is also ESRB Privacy Certified, meaning its services have been reviewed by ESRB Privacy Certified to meet established online information collection, use and disclosure practices. You may contact SuperAwesome directly at privacy@superawesome.com for any questions related to their use of personal data. SuperAwesome’s privacy policy can be found at https://www.superawesome.com/kids-web-services-privacy-policy/.
• We utilise customer support services from a service provider called Sigma Software. Customers may share personal data with Sigma Software directly when contacting us directly for any reason, or we may share personal data with Sigma Software in the process of providing customer support or addressing customer concerns.
• We utilise infrastructure-as-a-service from service provider Amazon Web Services (AWS), including: our servers, our database, our static file storage (for videos and images), our sign-in, authorisation and authentication services, and content moderation services. AWS acts as our processor and only processes information strictly on our behalf and on our instructions. AWS does not use any of our data for their own purposes. We have our own virtual private cloud, so our resources are isolated from everyone else’s. All such data is encrypted in transit and at rest and requires relevant encryption keys in order to access it. This processing is carried out in the EU.
• We use services from Google including Google Analytics and Google Firebase to track and measure user interactions on the App and Site for data and trend analysis, and to collect data if the App crashes. This includes data about the user’s device or browser and their on-Site/in-App activities. Google processes this information on our behalf and uses it to prepare reports for us. These reports don't identify the users - they are aggregated information about all our users. Google does not use any of this information for their own purposes - they act as our processor and only operate on our instructions.
• We use services from Mailchimp to send email communications to our registered users and parents of users aged under 13, including communications about important app updates and marketing communications.  In the course of providing these services Mailchimp may process personal data including first and last name, email address and profile information.

We contractually obligate our service providers to collect, process, and disclose personal data solely for the purposes of providing services to us as permitted under our agreements with them. We do not permit our service providers to collect, process, or disclose personal data received from us or collected on our behalf for their own purposes.

We may from time to time engage other service providers to whom we may transfer personal data, subject always to ensuring that they are engaged to do so on terms that meet the requirements of applicable law as processors. These service providers will perform functions on our behalf, e.g., providing technical support for the systems where your personal data is held. They may need access to your personal data to perform their functions but will not use your personal data for any other purpose. We contractually obligate such service providers to at all times adhere to applicable data protection laws, and we will only ever disclose your personal data in accordance with the protections mandated by law.

For questions about how our service providers collect and process personal data in conjunction with providing services to us, please email us at hello@viaacademy.com with the subject line “Privacy Policy”, use the in-app Contact Us function, or contact us by phone or WhatsApp at +44 7311345970.

Third Parties

We will not share, sell or licence your personal data to any other third parties without your express prior consent. We may from time to time share anonymised, aggregated data sets with third parties for research and development purposes, but such data will not be capable of identifying any individual.

We may also disclose personal data to comply with our legal or regulatory obligations, in response to a non-mandatory request for information made by a governmental or state body, or as part of an investigation of unlawful activity. We may also disclose personal data to third parties in conjunction with merger, sale, joint venture or collaboration, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings), and in such circumstances we will seek assurances that such personal data will be processed in accordance with this policy.

E. INTERNATIONAL DATA TRANSFERS

In the case of App users or Site visitors based outside the UK, or where service providers and third parties to whom we disclose personal data (including storage) require access to your personal data outside of the UK, your personal data may be transferred to countries located outside the UK, including to countries that may not provide a similar or adequate level of protection to that provided by your country of residence, in which case we will only do so subject to the necessary protections mandated by UK data protection laws. This may include the standard data protection clauses currently adopted by the UK supervisory authority, the Information Commissioner’s Office (ICO), or such others as may be applicable to the UK from time to time. The specific measures we use to secure international data transfers will be made available on request. Google Analytics data collected through our cookies will be stored in the USA and all appropriate measures will be taken to manage that data transfer and processing in compliance with applicable data protection laws.

F. COOKIES

We follow a standard procedure of using log files. These files log visitors when they visit websites. Hosting companies do this as part of hosting services' analytics. The information collected by log files include anonymised internet protocol (IP) addresses, browser type, Internet Service Provider (ISP), date and time stamp, referring/exit pages, and possibly the number of clicks. The purpose of the information is for analysing trends, administering the site, and analysing users' use of the Site.

Please see our Cookies Policy as to how we also use cookies to gather certain information via cookies and similar technologies.

G. LINKS - ADVERTISING PARTNERS PRIVACY POLICIES

The Services may, from time to time, contain links to external websites or apps operated by third parties. We do not disclose personal data collected through the Services to these third parties. We are also not responsible for these third-party websites or apps, or the content of such third-party websites or apps. Once you have left the App, we cannot be responsible for the protection and privacy of any personal data which is provided. Please consult the privacy information provided by such third parties. We are not liable for any acts or omissions of such third parties, including in relation to data protection laws.

H. SECURITY AND RETENTION OF YOUR PERSONAL DATA

The security of personal data is important to us. We take all reasonable steps, including technical, administrative and physical safeguards, designed to protect the personal data we collect from loss, misuse and unauthorised access, disclosure, alteration and destruction. We will ask any agents and service providers to whom we may transfer your personal data to take comparable steps to protect that security. However, no method of security or method of transmission over the Internet is entirely secure.

We, and our service providers, may retain personal data for as long as a Registered Account is active, or as needed for the specific business purpose for which it was collected. In some cases, we may be required to retain personal data to comply with laws or regulations or other legal obligations, resolve disputes and enforce our agreements.

I. YOUR RIGHTS

This section provides details regarding data subject rights available under the GDPR and UK GDPR to residents of the EU and UK. This section may not apply to residents of other countries, depending on whether those countries have data protection laws that afford the same or similar rights to individuals as the GDPR and UK GDPR.

This section does not apply to residents of the U.S. Some U.S. residents have certain data subject rights, depending on their state of residence. For more information, please see our Supplemental Privacy Policy for U.S. Consumers.

Under certain circumstances, residents of the EU and UK have the right to:

• Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it;
• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected;
• Request erasure of your personal data. Subject to certain exceptions, this enables you to ask us to delete or remove personal data. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request;
• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) but you feel it impacts on your fundamental rights and freedoms;
• Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data: (a) if you want us to establish the data’s accuracy; (b) where you believe our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it;
• Request the transfer of your personal data to you or to a third party; and
• Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent.

If you wish to exercise any of these rights, please email us at hello@viaacademy.com with the subject line “Privacy Policy”, use the in-app Contact Us function, or contact us by phone or WhatsApp at +44 7311345970.

You also have the right to lodge a complaint in relation to any processing which we undertake in relation to your personal data with the UK supervisory authority, the Information Commissioner's Office (ICO) at https://ico.org.uk/.

J. HOW TO CONTACT US

If you have additional questions or require more information about this Privacy Policy, do not hesitate to email us at hello@viaacademy.com with the subject line “Privacy Policy”, or contact us by post at our registered office at KaiZhan Limited, 506 Kingsbury Road, London, United Kingdom, NW9 9HE, or by phone or WhatsApp at +44 7311345970.

We may need to update this Policy at any time and without notice and where we do this we will ensure that such changes are appropriately published and notified through the App and Site.

Last updated: 27 February 2023