Privacy Policy - Annex 1 - Personal information we collect

This is the Annex 1 of our Privacy Policy.

Category of personal information	How we use it	Legal Basis for the processing	Period of detention
Contact details, such as your name and your email address.	We may use this information to create a profile for you to allow you to log-in, access and use certain features of the Service.	The processing is necessary for the performance of a contract and to take steps prior to entering into a contract.	Up to 90 days after the removal of your account.
	We may use this information to communicate with you including sending service-related communications (such as statements, invoices and solicited marketing communications).	The processing is necessary for our legitimate interests, namely administering the Service, for marketing purposes and communicating with users.
	We may use this information to send you unsolicited marketing communications in accordance with your preferences.	We will process your personal information for this purpose to the extent that you have given us consent to do so.
	We may use this information to deal with enquiries and complaints made by or about you relating to the Service.	The processing is necessary for our legitimate interests, namely administering the Service, dealing with complaints or enquiries and otherwise communicating with users.
Profile information, such as your display name and profile picture.	We may use this information to create a profile for you on the Service.	The processing is necessary for the performance of a contract and to take steps prior to entering into a contract.	Up to 90 days after the removal of your account.
	For Flat for Education Admins and Teachers accounts only: We may use this information to communicate with you, including sending service-related communications (such as statements, invoices and solicited marketing communications).	The processing is necessary for our legitimate interests, namely administering the Service, for marketing purposes and communicating with users.
	We may use this information to identify you and deal with enquiries and complaints made by or about you relating to the Service.	The processing is necessary for our legitimate interests, namely administering the Service, dealing with complaints or enquiries and otherwise communicating with users.
Service login details. Where you create an account with us (rather than logging in using a social network) we will hold your user name and password details so that we can keep your account secure.	We may use this information to allow you to log-in, access and use certain features of the Service.	The processing is necessary for the performance of a contract and to take steps prior to entering into a contract.	Up to 90 days after the removal of your account, or once you request to use another login method and the password to be removed.
Comments and opinions that you provide to us when you contact us directly, e.g. by email, phone or when you complete an online form or participate in an online forum or chat.	We may use this information to address your questions, issues and concerns.	The processing is necessary for our legitimate interests, namely administering the Service and dealing with enquiries and complaints relating to the Services.	Up to 90 days after the removal of your account or organization. Anonymized comments or opinions can be conserved longer.
	We may use this information to improve our Public Services.	The processing is necessary for our legitimate interests, namely to inform the development of new features of the Service and the improvement of the Service generally.
	We may use this information to determine products and services that may be of interest to you.	The processing is necessary for our legitimate interests, namely to inform our direct marketing.
Payment and transaction information, such as the products and services you purchased from us, date and time of your transaction, and your payment information, such as your credit card or bank account details.	We may use this information to facilitate transactions.	The processing is necessary for the performance of a contract and to take steps prior to entering into a contract.	Until you change the payment mean, cancel your subscription or remove the payment mean from the platform.
	We may use this information to provide customer support.	The processing is necessary for the performance of a contract and to take steps prior to entering into a contract.
	We may use this information for accounting and taxes purpose.	The processing is necessary for compliance with a legal obligation to which we are subject.	Without limit of time.
	We may use this information to detect and prevent fraud.	The processing is necessary for our legitimate interests, namely the prevention and detection of fraud.	Without limit of time.
Content that you create when you use the Service, or upload to the Service, i.e. music scores.	We may use this information to provide you the features and functionalities of the Service. Your content can be viewed by other users in your school or other educational organisation that you are linked to.	The processing is necessary for the performance of a contract and to take steps prior to entering into a contract.	If your account is active, some deleted content can be stored up to 1 year after you remove it. If you requested to remove your account, up to 90 days after the removal of your account
Information provided by third-party accounts you connect to our Service. You can sign up to our Service through G Suite for Education (Google), Microsoft Office 365, Clever, Edmodo, Canvas, Schoology or your own Learning Management System (LMS). The data we receive is dependent on your privacy settings with the third-party service.	We may use the information provided to help create an account for you on our Service.	The processing is necessary for the performance of a contract and to take steps prior to entering into a contract.	Up to 90 days after the removal of your account
Preferences that you set for notifications, marketing communications, how our website is displayed and how you use the Service.	We may use this information to provide notifications, send communications and display our Service in accordance with your choices.	The processing is necessary for our legitimate interest, namely ensuring the user receives the correct marketing and other communications.	Up to 90 days after the removal of your account
	We may use this information to ensure that we comply with our legal obligation to send only those marketing communications to which you have consented.	The processing is necessary for compliance with a legal obligation to which we are subject	Up to 90 days after the removal of your account
Information about your location. We may collect an approximate location based on your device's IP address. Other than this information, or any information about your location that you choose to provide to us, we do not collect information about your precise location.	We may use an approximate location to ensure content on our site is relevant to the area, city, state or country you are using your device in.	The processing is necessary for our legitimate interest, namely tailoring our Service to our users.	Up to 90 days after the removal of your account.
Information provided by other users: such as comments or opinions contained in private messages or posted publicly on forums.	We may use this information to respond to queries, issues or concerns raised by other users.	The processing is necessary for our legitimate interests, namely administering the Service and dealing with enquiries and complaints relating to the Services.	Up to 90 days after the removal of your account.
	Where another user has invited you to our Service, we may use the information they provide to assist them in doing this.	We will only use your personal information in this way to the extent you have given us your consent to do so.	Up to 90 days after the removal of your account.
Information about fraudulent or criminal activity relating to your account.	We may use this information for the purposes of detecting and preventing crime.	The processing is necessary for our legitimate interests, namely detecting and preventing crime.	Without limit of time
All personal information set out above.	We will use all the personal information we collect to operate, maintain and provide to you the features and functionality of the Service, to communicate with you, to monitor and improve the Service and our business, and to help us develop new products and services.	The processing is necessary for our legitimate interest, namely to administer and improve the Service.	Up to 90 days after the removal of your account, or longer if the data has been anonymized.