SMART Board GX Plus (the “GX Plus”) Privacy Policy

About GX Plus

The SMART Board® GX Plus interactive flat panel display is EDLA-licensed by Google, enabling full integration with Google Play Services and Google for Education and powered by GMS Android™ (a trademark of Google LLC). By using the GX Plus, you have one-touch access to a full suite of SMART education and third-party applications. These applications include a powerful whiteboard, a built-in web browser, wireless screen sharing, and more.

Introduction

The following information explains our privacy policy (the “Policy”) and practices of SMART Technologies ULC (together with its subsidiaries, collectively "SMART", “we” or “us”) regarding the collection, use and disclosure of your personal information. This Policy makes clear what information we collect from you, how we use and disclose it, and how you can help manage it. SMART is devoted to making sure your privacy rights are respected, and personal data is collected and used in accordance with the current and applicable privacy and data protection laws.

SMART supports numerous privacy laws including the European Union’s General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA). We currently offer American and European data storage for user created content and are satisfied our out-of-region user data processors provide appropriate safeguards for the data they handle. The GX Plus is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. Therefore, the Children's Online Privacy Protection Act (COPPA) does not apply to the GX Plus. If you become aware that a child under the age of 13 has provided any personal data to us while using the GX Plus please email us at privacy@smarttech.com and we will investigate the matter and, if appropriate, delete the personal data.

By using the GX Plus, you agree to this Policy and consent to SMART's collection, use and disclose your personal information as necessary for the identified purposes or as otherwise identified herein.

Android^™

The GX Plus uses the Android 14 operating system, an open-source software by Google LLC. While the GX Plus currently has its updates usually provided by SMART, there are times (GMS certified for example) when Android connects to Google servers directly. If you’re using an Android device with Google apps, your device periodically contacts Google servers to provide information about your device and connection to Google services. This information includes things like your device type and carrier name, crash reports, which apps you've installed, and, depending on your device settings, other information about how you’re using your Android device. By using Android, you agree to Google’s terms and privacy policy.

Updates

Our ability to make timely changes is fundamental to delivering superior software to you. Sometimes, material updates will require us to change our Terms, and we will notify you of these changes. If our updates do not erode or diminish your rights or obligations under these Terms we may update them without notice.

The GX Plus receives over-the-air (OTA) updates to ensure continued performance, security, and access to the latest features. When connected to the internet and configured appropriately, the GX Plus automatically checks for available firmware updates and notifies users when updates are ready to install.

To facilitate these updates, the device may transmit basic metadata such as device model, firmware version, country and MAC address.

This data is used solely to determine update eligibility and delivery. No personally identifiable information (PII) is collected, transmitted, or stored as part of the OTA update process.

Opting out or removing personal information and data retention

We do not sell your data, and we do not share personal data with third parties without your consent. A list of the third parties we share data to provide our services to you are detailed below.

SMART will only keep personal data for as long as required to provide the service, or to comply with statutory requirements. When the personal data collected is no longer required by us, we and our service providers will perform the necessary procedures for destroying, deleting, erasing, or converting it into an anonymous form as permitted or required under applicable laws.

You may request deletion of your SMART account at any time by e-mailing privacy@smarttech.com or contacting our support department. SMART will respond to customer requests to delete personal data within 30 days. Inactive unpaid accounts are deleted after two (2) years. All data stored locally on the GX Plus can be deleted by you at any time by resetting it to factory settings.

If you would like to request that your personal information be provided to you for your review, be removed from our services, or be updated, please contact privacy@smarttech.com.

Your rights

Subject to applicable law, including exceptions, you have the following rights with regard to the personal data that we collect about you:

• right to ask what personal data we have about you and how we use;
• right to request a copy of the personal data that we hold about you;
• right to request that we correct or amend your personal data;
• right to request deletion of your personal data; and
• right to ask us to stop or limit how we process your personal data.

To protect your privacy and security, we may need to verify your identity before acting on certain requests, to the extent permitted by law. If someone is making the request on your behalf (like an authorized agent) and they don’t provide proof of authority (such as a power of attorney), we may ask for additional evidence, like written authorization, or contact you directly to confirm the request.

If you would like to exercise your rights regarding your personal data, you can do so by:

• emailing your request to us at: privacy@smarttech.com
• contacting us by postal mail at:

+1.403.245.0333

Notification of Breach

If SMART becomes aware of a personal data breach, it shall without undue delay, and where feasible, no later than 72 hours after having become aware of it, notify the affected customer and the supervisory authority (if it was for data where SMART was the Data Controller) in accordance with Article 33 of the GDPR, unless the data breach is unlikely to result in a risk to the rights and freedoms of natural persons. SMART’s communication of a breach shall be in clear and plain language and contain a minimum of:

1. Contact details of the Data Protection Officer or other contact person,
2. A description of the nature of the breach,
3. Likely consequences of the breach,
4. Advice on steps data subjects can take to protect themselves, and
5. The measures SMART has taken or proposes to take to address the breach

Data security

SMART's business processes are designed and applied to appropriately safeguard your personal information, having regard to the sensitivity and use of that information. Nevertheless, such security measures may not prevent all loss, misuse or alteration of personal information provided to SMART, and SMART is not responsible for any damages or liabilities relating to any such security failures. By using our services, you understand that there is a risk that data and communications, including e-mail and other electronic communications, may be accessed by unauthorized third parties when communicated over the Internet. The foregoing does not affect any liability which cannot be excluded or limited under applicable law.

If you have any questions or concerns regarding the security measures applied to collection, use or disclosure of your personal information please contact us.

If you are using a service that involves third party elements, please review the policies of such third-party service providers as they relate to security and data protection.

Encryption

We use several state-of-the-art security measures, including 256-bit TLS encryption. We do not store your passwords as these are managed by our single-sign-on (SSO) providers and they encrypt all your credentials and separate them from your personally identifiable information.

Third-party apps and services

GX Plus devices are EDLA-licensed, which enables access to the Google Play Store and other third-party applications. These apps may include features powered by artificial intelligence (AI).

These features are not native to the GX Plus device, but may be available through apps installed via Google Play or other integrated services. Data collected or processed by these apps is governed by the respective provider’s privacy policy (e.g., Google, Microsoft).

Users and administrators are encouraged to review the privacy policies of any third-party apps before use, especially those involving cloud-based AI processing or personal data input.

Cookies

The GX Plus and some of its features use cookies to enhance your experience and provide the functionality of the device. Cookies are small files stored on your device that help the GX Plus remember your preferences and settings. Most web browsers and smart devices offer options to manage and control cookies through their settings. However, blocking all cookies may affect the performance and usability of the GX Plus. You may choose to accept cookies, and you can delete them later or when you exit your session, ensuring a customized experience each time you use the board.

Changes to the policy

We reserve the right to update this Privacy Policy from time to time to reflect changes to our products and services, operations, or to meet new legal and regulatory requirements. Any material amendments will be communicated to customers 30 days in advance and become binding once posted online.

Data Types

It is important to remember that customers and users are two distinct groups:

Customers are typically an organization (e.g., district, school, company) and not a personally identifiable individual. The identifiable information we require is from the customer for transactional purposes. The customer shall not provide SMART with personally identifiable information unless permissible by law and the customers’ policies.

Users (e.g., teachers, students) are generally not the ones who purchased or set up the GX Plus (e.g., IT administrators) and only access our software, such as Lumio, because the customers’ IT administrator has granted them access. As such, SMART’s exposure to personally identifiable information only comes from how the customer operates when providing e-mail addresses and names of users to SMART and from user created Content. If you have a concern as a user about your PII you must demand the customer (your organization) provide only non-identifiable information to SMART and you as a user must only create Content with no PII in it.

We collect two types of data depending on your interaction with us:

“Non-Personal Data” means aggregated non-identifiable information, which may be made available or gathered via your access to and interactions with our services. We are not aware of the identity or other identifiers of the individual from which the Non-Personal Data is collected. The Non-Personal Data being collected may include aggregated usage information, as well as technical information transmitted by your device, such as the type of browser or device, type of operation system, device settings and technical software data, etc.

“Personal Data” or “Personal Information” means individually identifiable information, namely information that identifies a natural person (not a corporation) or may, with reasonable effort, be used to identify a natural person.

We do not knowingly collect or process any Personal Data constituting or revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, data concerning a person's health (“Special Categories of Personal Data”).

Vereiste gegevens die SMART verwerkt voor klanten

Contact

Heb je vragen of opmerkingen over dit Privacybeleid of de verwerking van je persoonsgegevens? Neem dan contact op met ons privacyteam op een van de volgende manieren: