Privacy Statement

This Privacy Statement explains how InOutBoard.com, Inc. collects and uses information about people (“Personal Data”), who we share it with, how long we keep it, how we protect it, and the rights and choices you have over it.

In this Privacy Statement, “InOutBoard,” “we,” “us,” and “our” mean InOutBoard.com, Inc.

1. Who is responsible for your Personal Data

InOutBoard decides why and how the Personal Data described in this Privacy Statement is processed, which makes us its controller, unless this Privacy Statement says otherwise for a particular kind of data.

InOutBoard customers use our software to manage their own staff—for example, recording work status, schedules, and related workplace information about the people in their organization. This Privacy Statement describes how we handle Personal Data for our own business purposes, such as operating our websites, communicating with prospective and current customers, and providing support. Where a customer’s staff information is submitted to our products and services, our role in processing that information is described in Section 9.3, below.

2. What this Privacy Statement covers

This Privacy Statement covers Personal Data we collect when you:

• visit one of our websites that shows or links to this Privacy Statement;
• visit our pages on social media;
• visit our offices; or
• get in touch with us, or receive emails, phone calls, or text messages from us.

Our websites and services link to websites, apps, and services run by other companies, and our social media pages are hosted by the social networks themselves. Those companies’ own privacy statements govern what they do with your information, so please read them as well.

3. Personal Data you give us

We collect Personal Data that you give us directly, including:

• Contact details. When you ask about our services, request support, use our contact form, sign up for an account or a trial, or download content from our websites, we may ask for your name, job title, organization, address, phone number, email address, and a username and password.
• Billing details. When you pay for a subscription, we may ask for a billing name and address and your payment card details. Card payments are handled by our payment processor, and full card numbers are never stored on our systems.
• Feedback and survey answers. We sometimes email a short survey, for example after a free trial ends or to ask how InOutBoard is working for your organization. Answering is optional. If you answer, we keep your answers together with your name, email address, and organization, and the people at InOutBoard who handle support and product decisions may read them.

We also collect some information automatically when you use our websites, emails, and services. Section 4 explains what, and how.

If you give us or our service providers Personal Data about someone else, you confirm that you are allowed to share it, and it will be handled as this Privacy Statement describes. If you believe someone has given us your Personal Data without being allowed to, or you want to exercise any of your rights over your Personal Data, please contact us as described in Section 12.

4. Device and usage data

Like most websites and online services, ours collect some information automatically from the computer or phone you use, as you browse our websites, use our services, or open our emails. Some of it can identify you, on its own or combined with other information, so we treat it as Personal Data.

4.1 What we collect automatically

On our websites, this can include your IP address (or that of a proxy server), device and app identifiers, approximate location, browser type, internet service provider or mobile carrier, the pages and files you view, searches, your operating system and system settings, and the date and time of each visit. We use it to understand how our websites are used, to run and improve them, and to keep them secure and working properly.

In our cloud services, we collect the same kinds of information, along with the actions you take. We use it to keep the services secure, to make their features work, to improve their performance and the experience of using them, to check that they are used in line with the applicable terms, to plan new features and the capacity we will need, to identify opportunities to serve our customers better, and to protect the security of InOutBoard as a whole.

We use this data mainly to tell one signed-in user from another, not to find out who a particular person is. We identify an individual from it only where security requires it, or where it is needed to provide the services to a customer on whose behalf we act as a processor (see Section 9.3).

4.2 Cookies and similar technologies

Our websites and emails use cookies and related technologies, including tags and scripts, to record how they are used. A cookie placed in your browser may collect information, including Personal Data, about your activity online over time and across different websites. We use these technologies to measure how our websites are used, remember your preferences, improve and tailor your experience, and measure how well our advertising works.

Some cookies last only until you close your browser (session cookies). Others stay on your device after that, until they expire or you delete them (persistent cookies). We use both kinds.

4.3 Your choices about cookies, and Do Not Track

You can block or delete cookies, including those that collect non-essential device and usage data, in your browser’s settings. If you do, some features of our websites and services may not work fully.

Some browsers can send a “Do Not Track” (DNT) signal. There is still no agreed standard for how websites should respond to one, so we do not currently respond to DNT signals on our websites. We will keep watching for a standard to emerge.

5. Why we use Personal Data, and our legal bases

We use Personal Data for the purposes below. Where data protection law requires a legal basis, the one we rely on is given with each purpose.

• Running our websites and services. To provide our websites and services and meet our obligations under the applicable terms, as part of our contract with you. Where we have no contract with you, we rely on our legitimate interest in operating our websites and giving you the content you ask for, such as a download.
• Keeping our websites and services secure. Monitoring how our websites and services are used, producing aggregated data that does not identify anyone, checking that accounts and the activity in them are genuine, looking into suspicious behavior, and enforcing our terms and policies, as far as this is needed for our legitimate interest in keeping our services, systems, and applications safe and in protecting our own rights and other people’s.
• Making features work. Providing the functionality you need as you use our websites and services, as part of our contract with you, or, where we have no contract with you, in our legitimate interest in providing that functionality.
• Managing accounts. Setting up and managing your account if you have registered with us, as part of our contract with you under the applicable terms of service.
• Answering questions and support requests. Responding when you use our contact form, ask for support, or get in touch another way, such as by phone, as part of our contract with you and in our legitimate interest in answering you.
• Taking payments. Verifying payment details and collecting payment where this is needed to complete a transaction, as part of our contract with you.
• Improving our websites and services. Analyzing trends and how our websites and services are used, and reading the feedback and survey answers you send us, in our legitimate interest in developing our websites and services and offering more relevant content and services, or with your consent where we ask for it.
• Meeting legal obligations and protecting our rights. Working with public authorities, courts, and regulators where the law requires us to process or disclose Personal Data; and, in our legitimate interests, protecting against misuse of our websites, protecting property and safety, pursuing the remedies available to us and limiting our losses, complying with legal proceedings and court orders, and responding to lawful requests.

If the law or a contract with you requires us to collect certain Personal Data and you do not provide it when asked, we may not be able to carry out that contract.

6. Who we share Personal Data with

We may share Personal Data in these ways:

• With service providers we have contracts with, for the purposes and on the legal bases in Section 5. They provide services such as hosting and IT, payment processing, email delivery, bot protection, analytics, and customer support. The providers that handle customer data in our services are listed, with what each one sees, on our Security page.
• Within InOutBoard, where our staff need it to fulfill a request you made through our websites, or for support, marketing, technical operations, and account management.
• In a business transfer. If we merge or reorganize, sell a website or part of our business, or another company acquires all or part of our business, assets, or shares, some or all of your Personal Data may be transferred to that company. In line with applicable law, we will make reasonable efforts to tell you about a transfer to a company outside InOutBoard, since it will need to process your Personal Data for the purposes in Section 5.

7. Children

InOutBoard is a workplace service for adults. Our websites and services are not directed to children, and we do not knowingly collect Personal Data from anyone under 18. Our customers use InOutBoard to manage their own staff; the service is not intended to hold information about minors. Our education customers, for example, are district offices and education-related organizations using it for faculty and staff, not for students.

If you believe we have received Personal Data about anyone under 18, please contact us by using the information in the “Contacting us” section, below, and we will take steps to delete it from our systems.

8. How long we keep Personal Data

We keep Personal Data only for as long as we need it for the purpose we collected it for (see Section 5). To decide how long that is, we consider how much Personal Data there is, what kind it is and how sensitive it is; the risk of harm if it were used or disclosed without authorization; whether we could achieve the purpose another way; and any legal requirements, such as statutory limitation periods.

When a retention period ends, we delete the Personal Data. If some of it cannot be completely deleted from our systems for technical reasons, we take appropriate steps to prevent any further use of it.

9. Your rights over your Personal Data

9.1 Your rights

Depending on the data protection laws that apply to you, and in particular if you are in the European Economic Area (EEA), you may have the right to:

• access the Personal Data we hold about you;
• have inaccurate Personal Data corrected, and incomplete Personal Data completed, taking into account why it is processed;
• have your Personal Data erased, as far as data protection law allows;
• restrict how we process your Personal Data, as far as the law allows;
• receive your Personal Data so that it can be transferred to another controller, where that is possible;
• object to processing we carry out on the basis of our legitimate interests. Where we process your Personal Data for direct marketing, or share it with others for their own direct marketing, you can object at any time without giving a reason;
• not be subject to a decision based solely on automated processing, including profiling, that has legal effects for you. We do not make decisions of this kind on our websites or in our services; and
• withdraw your consent at any time, where we rely on your consent to collect, process, or share your Personal Data. Withdrawing it does not affect the lawfulness of processing that took place before.

9.2 How to exercise your rights

To exercise any of these rights, contact us as described in Section 12. We aim to respond to every legitimate request within one month, and we will contact you if we need more information to act on it. Occasionally a request takes longer than a month, because of its complexity or the number of requests we receive.

If you use InOutBoard through your employer or another organization that is our customer, its InOutBoard administrator is usually the quickest way to correct or update your information.

Registered users can update some of their own settings and profile information, and their organization’s settings where they have permission, by signing in and editing them.

To update your billing information, close your account, or ask us to return or delete your Personal Data and anything else linked to your account, contact us as described in Section 12.

9.3 Your rights over data our customers put into InOutBoard

We also process Personal Data that a customer, or someone acting for it, puts into our cloud services, such as information about the customer’s staff. Unless this Privacy Statement or a separate notice says otherwise, we process that Personal Data only as a processor, on behalf of the customer (and/or its affiliates), which is the controller responsible for it (see Section 1). Each customer’s own privacy and data security practices are outside our control and are not our responsibility, and they may differ from those described in this Privacy Statement.

If a customer has put your Personal Data into InOutBoard and you want to exercise any rights you have under data protection law, please contact that customer directly. Because we can access a customer’s data only on that customer’s instructions, if you contact us instead, please tell us which customer provided your data. We will pass your request on to that customer and help it respond within a reasonable time.

9.4 Marketing messages

If we send you marketing messages, you can stop them at any time: use the “unsubscribe” link at the bottom of any InOutBoard marketing email, reply “STOP” to any InOutBoard marketing text message, or contact us.

Opting out of marketing does not stop the messages we need to send about your existing relationship with us, such as messages about your subscription, service announcements, or security information.

10. How we protect Personal Data

We use organizational, technical, and physical safeguards to protect the Personal Data we process against accidental or unlawful destruction, loss, or alteration, and against unauthorized disclosure or access. Our Security page describes them in more detail.

We follow generally accepted standards, but no method of storing or transmitting data is completely secure. You are responsible for keeping your password secret, controlling who can use your devices, and signing out when you finish. If you have questions about the security of our websites, contact us as described in Section 12.

11. Changes to this Privacy Statement

This Privacy Statement will change from time to time as our practices, technology, legal requirements, and other factors change, and we will change the effective date at the top when it does. If a change is material, we may tell you before it takes effect, for example with a prominent notice on our website or an email to the address you gave us.

Please check this Privacy Statement from time to time to stay informed about how we collect, use, and share Personal Data.

12. Contacting us

To exercise your rights over your Personal Data, or with any question about this Privacy Statement or how we handle Personal Data, email us at support@inoutboard.com.