Introduction

We are Fuzzy EdTech Inc, a company incorporated under the laws of the Province of British Columbia with incorporation number BC1420030 and with its registered office address at #200 - 2227 St. Johns St. Port Moody BC V3H 2A6, Canada (“we”, “us”, “our”).

You can contact us by emailing us at contactus@poemgranate.so.

We respect your privacy and we are committed to protecting personal data you provide to us. This privacy policy informs you about how we look after personal data you provide to us when you use our Software as a Service (Saas) platform, namely “Pomegranate” (available through our website: (www.poemgranate.so) (the “Service”) regardless of where you visit it from, and it tells you about your privacy rights and how the law protects you.

This privacy policy is provided in a layered format so you can click through to the specific areas set out below. Please also use the Glossary to understand the meaning of some of the terms used in this privacy policy.

• Important Information and Who We Are
• The data we process on your behalf
• How we use your personal data
• Disclosures of personal data you provide to us
• International transfers
• Data security
• Data retention
• Glossary

1. Important Information and Who We Are

Purpose of this privacy policy

This privacy policy aims to give you information on how we process your personal data through your use of our Service. By using our Service, you acknowledge that you are accepting and consenting to the practices described in this policy.

It is important that you read this privacy policy along with any other policy we may provide on specific occasions when we are processing personal data on your behalf.

Data Processor

Fuzzy EdTech Inc, is the data processor responsible for processing the personal data provided by you on your behalf as part of our Service offering. We are compliant with the Personal Information Protection Act (British Columbia) ('PIPA BC').

When using our Service and in the case of any pupil personal data you may choose to enter, you (the school) are the data controller of this information, and we are processing pupil personal data that you input into our Service on your behalf only in relation to the service offering. You determine what data is collected, what purpose(s) it is used for and who is allowed to process it. You acknowledge and agree that prior to utilising our Service and inputting any pupil personal data into our Service to be processed by us you have received the requisite permissions from pupil parent or guardians to share pupil personal data with us.

Data Controller

In some circumstances we may act as a data controller in relation to personal data provided by you through our Service. We will only act as a data controller where we use the personal data provided by you to improve our product and service offering (including technical and usage data as discussed below), and where we can we will anonymise this data (so it becomes anonymous aggregated data and not personal data as discussed below) prior to using it.

When we collect Aggregated Data such as statistical, learning achievement or demographic data we may use it for any purpose. Aggregated Data may be derived from personal data you provide but is not considered personal data in law as this data does not directly or indirectly reveal an individual’s identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. We will also process and retain anonymous data to help us improve our product and service offerings. However, if we combine or connect Aggregated Data with any personal data so that it can directly or indirectly identify an individual, we treat the combined data as personal data.

As you interact with our website, we may automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. We may also receive Technical Data about you if you visit other websites employing our cookies. Please see our cookie policy for further details.

Contact details

We have appointed a data privacy manager who is responsible for overseeing questions in relation to this privacy policy. If you have any questions about this privacy policy, including any requests to exercise your legal rights, please contact the data privacy manager using the details set out below.

Our full details are:

Full name of legal entity: Fuzzy EdTech Inc, a company incorporated under the laws of the Province of British Columbia with incorporation number BC1420030 and with its registered office address at #200 - 2227 St. Johns St. Port Moody BC V3H 2A6, Canada.

General email address: info@pomegranate.so

We hope that we can resolve any query or concern you raise about our use of your information. However, you have the right to make a complaint at any time to the supervisory authority in British Columbia, which is the Office of the Information and Privacy who may be contacted at info@oipc.bc.ca.

Changes to the privacy policy and your duty to inform us of changes

This version was last updated on March 2025. We will provide you with reasonable prior notice of substantial changes in how we use your information, including by email at the email address you provide.

If you would like this policy in another format (for example: audio, large print, braille) please contact us.

It is important that the personal data we process on your behalf is accurate and current. Please keep us informed if personal data you have provided to us changes.

Third-party links

Our Service may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave Insights, we encourage you to read the privacy policy of every website you visit.

2. The data we process on your behalf

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

In the case of pupil personal data, as may be provided by you (the school) in the course of using the Service:

• Identity data which includes first name, last name, pupil ID, gender, date of birth, name and address of school, year group and class.
• Optional learning needs data which includes English as an Additional Language status (yes/no), Special Educational Needs status (yes/no), Pupil Premium status (yes/no) and Free School Meals status (yes/no).
• Educational Data: We may collect information related to educational content, lesson plans, and resources you create or upload to the platform that could include pupil personal data.

Please note that Special Educational Needs is classified as special category data as it relates to health. You acknowledge and agree that as the data processor in relation to pupil personal data we are relying on you (the school) having obtained consent from each pupil’s parent or guardian to process pupil personal data including special category data where necessary.

Pupils cannot use or access our Service themselves and therefore no technical or marketing and communications data or contact data will be collected or processed about pupils.

If you fail to provide personal data

Where we need to process personal data under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, setting up your account to provide you with the Service). In this case, we may not be able to provide you with the Service but we will notify you if this is the case at the time.

How is your personal data processed?

Direct interactions: You may provide us with pupil personal data when you use the Service.

3. How we use your personal data

We will only process information provided by you on your instructions (unless otherwise required by law). We will not use pupils’ personal information for commercial purposes nor send marketing or advertising material to pupils. We will only process personal data provided by you in the following circumstances:

• To perform the contract we are about to enter into or have entered into with you; and
• Where we need to comply with a legal or regulatory obligation.

We will process anonymised pupil and assessment data to improve our services and products. When we process, analyse and use anonymised data, it can’t be linked back to any individual pupils, and is not considered personal data in law.

Cookies

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly. Click for more information about the cookies we use.

4. Disclosures of personal data you provide to us

You acknowledge and agree that we may have to share personal data you provide to us with the parties set out below for the purposes set out in the table in paragraph 3 above to act as sub-processors on our behalf.

• Third Parties as set out in the Glossary.

Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then (subject to your instruction) the new owners may use personal data you provide to us in the same way as set out in this privacy policy.

We require all third parties to respect the security of personal data you provide to us and to treat it in accordance with the law. We do not allow our third-party service providers or sub-processors to use personal data you provide to us for their own purposes and only permit them to process personal data you provide to us for specified purposes and in accordance with our instructions. We will ensure that we put in place a contract with any sub-processor that we use that includes terms that offer an equivalent level of protection for the personal data as those in the contract between you and us.

5. International transfers

• Google, our analytics provider, is based in USA;
• Our advertising networks such as [INSERT] are based [INSERT]; and
• Our providers of technical, payment and delivery services are based [INSERT].

Whenever, with your permission, we use sub-processors or third parties and transfer personal data provided by you out of Canada, we will ensure a similar degree of protection is afforded to it.

6. Data Security

We have put in place appropriate security measures to prevent personal data you provide to us from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to personal data you provide to us to those employees, agents, contractors, sub-processors and other third parties who have a business need to know. They will only process personal data on our instructions (in accordance with your instructions) and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach so immediately of any data breach. We will assist you in complying with your obligations as data controller regarding personal data breaches.

7. Data Retention

Retaining personal data

We will only retain the personal data you provide to us for as long as you instruct us to retain it for (subject to our normal practice as detailed below, unless otherwise agreed between us in writing).

You acknowledge and agree that it is our practice to delete all identifiable pupil data no longer than 6 months after your subscription to our Service comes to an end.

We will delete or return all personal data to you and we will delete existing personal data we have processed on your behalf unless the law requires its storage.

We will take appropriate measures to help you, as the controller, to respond to requests from individuals i.e. pupils or parents/guardians to exercise their rights in relation to their personal data you provide to us, including its erasure.

You can also delete pupil data on our Service directly in which case the pupil data shall be permanently deleted from our Service and all associated security back ups within a maximum of 30 days.

Non-identifiable data, which is no longer linked to an individual, such as test scores, may be stored in our Service indefinitely without further notice to you.

You may at any time delete or export, or ask us to delete or export, any data that you no longer require us to process.

We will submit to audits and inspections requested by you on fourteen (14) days’ notice during normal working hours as detailed in the data processing agreement between us and you. We will also provide you with whatever information you require to ensure that we as processor and you as controller are meeting our obligations.

8. Glossary

LAWFUL BASIS

1. Legitimate Interest: means the interest of our business in conducting and managing our business to enable us to give you the best service and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process personal data you provide to us for our legitimate interests. We do not use personal data you provide to us for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.
2. Performance of Contract: means processing your data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract.
3. Comply with a legal or regulatory obligation: means processing personal data you provide to us where it is necessary for compliance with a legal or regulatory obligation that we are subject to.
4. Public task: means the processing is necessary to perform a task in the public interest or for official functions, and the task or function has a clear basis in law.
5. Protecting the vital interests of the data subject or another natural person: means that processing is necessary to protect someone’s life.
6. Consent: means we have your express consent to process personal data you provide to us for the stated purposes.

THIRD PARTIES

Service providers - acting as sub-processors based in the UK, New Zealand, US and Canada who provide IT and system administration services, including [AWS, Google, Stripe, Xero, Unleashed, Freshdesk, Freshchat, Slack, Atlassian].

Professional advisers - acting as processors or joint controllers including lawyers, bankers, auditors and insurers based in the UK and Canada who provide consultancy, banking, legal, insurance and accounting services.

Canadian Revenue Agency - regulators and other authorities who require reporting of processing activities in certain circumstances.