Bright Brain Brilliance

Bright Brain Thinking

Global Privacy Policy

Bright Brain Thinking values our customers and respects your privacy. We are committed to protecting your information. Please read this Global Privacy Policy (Privacy Policy) to learn more about the ways in which we use and protect your personal information.

Controller

The Bright Brain Thinking entity who is the controller and will therefore be responsible for your personal information is the entity that originally collects information from or about you. Where applicable, you will be provided with a separate privacy notice when your data is first collected by that Bright Brain Thinking entity, for example, when you enter into a contract with the entity.
You can find out more about Bright Brain Thinking at http://www.brightbrainthinking.com, or by contacting us using the information in the “issues, concerns or requests” section below.

If you are a resident of the State of Colorado in the United States, please click here for additional Colorado-specific privacy disclosures.

This Privacy Policy reflects our compliance with General Data Protection Regulation (GDPR) in the European Union for our UK based operations. Key aspects are:

• Readability and Transparency: We’ve worked hard to provide clarity, in simple language, around the personal information we collect from our customers and potential customers, why we collect this information and how we use it.
• Control over your data: We’ve outlined how you can correct the information we have if it’s incorrect and your choices regarding this information.

Except as otherwise provided in this Privacy Policy, we do not sell or rent your personal information to third parties for marketing purposes without your explicit consent.

Bright Brain Thinking’s Privacy Policy describes the personal information we collect about you, why we collect it, how we use it and when we share it within Bright Brain Thinking. Our Privacy Policy also describes the choices you can make about how we collect and use your information. You may opt out of our information sharing by contacting us in accordance with this Privacy Policy. To do so, you may contact us as follows:

Issues, Concerns, or Requests

Call us at  720-648-3032 or email [email protected]; or write to us at:

Bright Brain Thinking
Attn: Privacy Matters Team
2769 Iris Ave. Suite 110
Boulder, CO 80304
United States of America

For data subjects based in the European Union and the UK, you can refer to the same contact information if you have any questions or concerns or wish to exercise your privacy rights.

Modifications to this Privacy Policy

If our data-related practices change in the future, we will post an updated Privacy Policy on our website. You can tell if the Privacy Policy has changed by checking the revision date that appears at the beginning of this policy. Where required by applicable law, we will seek your consent to any material changes made to this Privacy Policy. You may exercise your rights and choices about how we collect and use your information at any time. Please refer to the contact information above if you wish to exercise your rights.

How does Bright Brain Thinking collect and use my information?

We may collect personal information about you if you:

• purchase one of our services or you are a student using one of our services (Customers and Service Users);
• use our website or online services (Website Users); and
• if you commence direct communications with us.

Customers and Service Users

If you purchase products or services from us, either via our website or offline, you may be asked to provide the following personal information about you: title, first and last name, telephone number, email address, mailing address and payment information. If you are a representative of a school or business, you will be asked to provide information about your school or business, including your credentials as a representative of the school or business, the school or business name, address, email address, telephone number and payment information.

As part of the nature of our business, we use the information provided by you to extend the services we offer, to administer and manage our services (including administering our program curriculum and managing our resources), to verify and carry out financial transactions, to improve and customize our experience, send you marketing communications (with your consent – see “Direct marketing” section below for more details) and to fulfill our financial, legal and contractual obligations. This often entails collecting sensitive information about students who you have guardianship over or students with whom you have an agreement to extend educational services. We use this information solely for the purposes of assessing needs and providing services. Information can include first and last name, email address, date of birth, current and past medical treatment, current and past cognitive therapies, names of medical or educational professionals involved in current or past treatment/therapies, data we generate relating to instructional services, and billing records for those services.

Where information about a school or business is provided to us, we will also use such information to conduct customer due diligence, to investigate, report and seek to prevent fraud and anti-money laundering, by conducting know-your-customer checks, AML screening and other identity or background checks, in order to comply with our legal obligations.

Website Users

You may use our website or services without (actively) providing any personal information about you. In this case, our website collects the following data that results from your usage of the website: referral page, date and time of access, type of web browser, IP-address, geographic location as determined by your IP address, operating system and interface, language and version of browser software, session information (such as download errors and page response times).
If you choose to register with one of our online services, you may be asked to provide the following personal information about you: first and last name, email address, username and password.
We will process such personal information in order to provide you in particular with the services you require, verify the legitimacy of your account, to avoid fraudulent accounts being opened, provide you with customer support and promotional materials as selected by you, inform you about system issues, comply with legal and contractual obligations, and defend, establish and exercise legal claims.

Mandatory Information

If you do not provide personal information indicated as mandatory (for example, by an asterisk on an application form), we may not be able to provide our services or otherwise engage or correspond with you.

Other purposes for which we use your personal information

With your consent where required by applicable law, we may contact you, subject to the choices you have made, via email, mail, or telephone, to conduct market research and learn more about how we can improve our program offerings. To serve you better, we may combine information you give us and information about your program interests and purchases with information from third parties, including demographic information and information that is publicly available. We use that combined information to enhance and personalize your online experience with us, and to communicate with you in accordance with this Privacy Policy.

Lawful bases for the processing of personal information

We will only collect, use and share your personal information where we are satisfied that we have a lawful basis to do this. We carry out the processing of personal information on the following lawful bases:

• the processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract with you. For example, where you purchase our services, we will collect your payment information to process your payment and we collect your telephone number and email address to provide you with service updates and answer any of your queries;
• the processing is necessary for compliance with a legal obligation to which we are subject to. For example, in order to provide our services to schools or business customers who have an agreement to extend educational services to students, we are obliged to carry out certain know-your-customer checks to prevent money laundering and fraudulent activities. This will involve the collection and verification of personal information of business or school representatives;
• you have provided your consent to use your personal information, for example if you have agreed to receive marketing communications, we will send you such marketing on the basis of your agreement;
• the processing is necessary for the purposes of the legitimate interests pursued by us, except where such interests are overridden by your interests or fundamental rights and freedoms. For example, we may use information about your program interests and purchases from Bright Brain Thinking to help us improve our site design and your online experiences. We may occasionally observe or interact with some of our instruction hours by video. These video recordings are used to monitor, assess and improve ongoing instructional quality. We will also have a legitimate interest to process the personal information of customers and prospective customers in order to facilitate the development of a contractual relationship;
• the processing is necessary to protect the vital interests of the data subject. This will only occur where necessary, for example, we may need to transfer the personal information of a student or service user to health service agents, in order to provide essential care.
• Where the Personal Data Protection Act (PDPA) applies, the Company will ensure that it complies with its obligations under the PDPA including to ensure that the recipient of your personal data is bound by legally enforceable obligations (in accordance with the applicable regulations of the PDPA) to provide to the transferred personal data a standard of protection that is at least comparable to the protection under the PDPA.

In most cases, the provision of your personal information is not required by a statutory or contractual obligation. However, the provision of personal information will be necessary in order to enter into a contract with Bright Brain Thinking or to receive our services. In situations where the provision of your personal information is necessary, not providing your personal information may likely result in you not receiving the services requested.
Unless otherwise specified, not providing your personal information will not result in legal consequences to you.
If you would like to find out more about the lawful basis for which we process personal information, please refer to  our GDPR contact information or refer to our contact information above.

If you are a resident of the State of Colorado in the United States, please click here for additional Colorado-specific privacy disclosures.

Does Bright Brain Thinking share my information with third parties?

Bright Brain Thinking does not share your information with any third party for marketing purposes.

We contract with service providers to assist with our operations and services (e.g. auditors, professional advisors), to maintain and manage our client information in order to fulfill contractual obligations and to communicate with our current, past, and prospective customers. We carefully choose software service providers that we use to store and process your information including, but not limited to, Amazon (AWS), Google (G Suite), Salesforce.com, and Microsoft (MSSQL). We do not authorize any of these service providers to make any other use of your information. We do, upon request, share information about our assessment and/or instructional results with other professionals with whom you collaborate with and have an existing, trusted relationship. This is done only if you sign a Release of Records indicating the specific information you would like us to share and with whom you would like it shared.

We ensure that the above mentioned external service providers are contractually bound (or through other means) to implement and apply security safeguards to ensure the privacy of any personal information we share with them, and to prevent unauthorized or accidental access, processing, erasure, loss or use of the data transferred to them. These third parties have agreed to confidentiality restrictions and to use any personal information we share or which they collect on our behalf solely for the purpose of providing the contracted service to us.

Bright Brain Thinking reserves the right to disclose information about you as required by law, in response to legal process and law enforcement requests, and as necessary to protect the property, interests, and rights of Bright Brain Thinking, its affiliates, and others. In the case of a corporate merger and acquisition, your personal information will be transferred to third parties being involved in the merger and acquisition in accordance with applicable law.

Direct Marketing

We want to communicate with you only if you want to hear from us. From time to time, we may send promotional emails to you that we think may be of interest to you, including newsletters, special offers or promotions, in relation to our products or services, but we may only do so with your consent. If you no longer wish to receive promotional information from us, or if you do not want us to use your information to enhance your online experience, you may OPT OUT of receiving our promotional communications by simply following the Unsubscribe or Preference Center link at the bottom of our emails and updating your cookie settings or by contacting us (see above). We will maintain your information in our “do not contact” list to ensure that we can honor your request. Please note that it may take up to 30 days to process your opt out request, during which time you may continue to receive communications from Bright Brain Thinking.

How do I access my information? How do I change or delete my information?

You have the right to request access to or ask us to update or correct your personal information by calling or writing to us, using the contact information above. Subject to certain exemptions, you may ask us to provide you a copy of the information we have collected about you.

How does Bright Brain Thinking protect children’s privacy online?

Bright Brain Thinking is concerned about the safety of children when they use the Internet and our site. Children (persons under the age of 18) are not eligible to use our site unsupervised, and we ask that children do not submit any personal information to us. If you are under the age of 18, you may only use our site in conjunction and under the supervision of your parents or guardians. We will never knowingly request personal information directly from anyone under the age of 18.

How does Bright Brain Thinking protect and use personal information?

We are committed to protecting the security and integrity of personal information, and we use procedures and technology designed for this purpose. For example:

• We limit employee access to personal information to those who have a business reason to know this information.
• We maintain policies and procedures covering the physical security of workplaces and records.
• We use technological means (such as backup files, virus detection software, firewalls, and other computer software and hardware) to protect against unauthorized access or alterations to personal information.

Is my information secure?

We believe your data must be protected against loss and unauthorized access. We use procedural and technical safeguards including encryption, firewalls, and secure communication protocols to protect your personal information against loss, theft, accidental, and unauthorized access, erasure, use, processing, and disclosure. While we employ many different security techniques to protect such data from unauthorized access by users, inside and outside the company, perfect security does not exist on the Internet.

As the security of information depends in part on the security of the device you use to communicate with us and the security you use to protect user usernames and passwords, please take appropriate measures to protect this information.

How long is my information stored for?

Personal information will be retained as long as it is required for the purposes for which it was collected e.g. as necessary to provide the services requested. Once our contractual relationship with you comes to an end or in case of the service recipient, following the termination of the contractual relationship for which your personal information was processed, we will delete the personal information unless statutory retention requirements apply e.g. for taxation purposes or in order to fulfill regulatory requirements. We retain your contact details and interests in our services for a longer period of time if we are allowed to send you promotional communications. We also retain your personal information if needed to establish, exercise or defend a claim.

What about links to other websites and services?

Bright Brain Thinking’s website may contain links to other sites. Bright Brain Thinking does not control the privacy policies or practices of these websites. You should review those policies before providing any personal information. Bright Brain Thinking is not responsible for the content or practices of any linked websites, and we provide these links solely for the convenience and information of Website Users.

Cookies and similar technologies

Cookies are small text files that are often placed on your computer’s file system to store data that can be recalled by a server in the domain that stored the cookie. We use cookies and similar technologies on our sites in order to improve your online experience. Through our use of cookies, we also track and maintain the identity of the website you visited immediately prior to visiting our website. We do not otherwise track any information about your use of other websites.

In addition to the cookies we set when you visit our website, third parties can also set cookies when you visit L-B sites. These third parties include, but are not limited to companies we hire to provide services on our behalf, such as site analytics.

You have a variety of tools to control the data collected by cookies and similar technologies. For example, you can use the controls in your internet browser to limit how the websites you visit are able to use cookies and to withdraw your consent by clearing or blocking cookies.

Reporting Requirements

In the unfortunate event we become aware of any unauthorized access or use of personal information stored by us as a result of actions taken by Bright Brain Thinking or any outside party, we will report this to the appropriate authorities, as required by law. We have an incident response plan that is always followed and might result in the direct notification to any individual whose personal information is involved in the incident. The exact steps taken to report and notify of any such event are always guided by paid, third party, legal services. If you become aware of any unauthorized use or access of your personal information as a result of Bright Brain Thinking data practices, please notify us immediately using any of the methods of communication near the top of this policy.

Rights applicable to European Union, UK, and Colorado Data Subjects

European Union, UK, and Colorado data subjects have further rights in addition to those mentioned above:

• Right of access: you have the right to obtain from us confirmation as to whether or not personal information concerning you, or (for parents / guardians) the Service User, is being processed, and where that is the case, to request access to the personal information. The accessed information includes – among others – the purposes of the processing, the categories of personal information concerned, and the recipients or categories of recipients to whom the personal information have been or will be disclosed. You have the right to obtain a copy of the personal information undergoing processing. For further copies requested by you, we may charge a reasonable fee based on administrative costs.
• Right to rectify and complete personal information: you can request the rectification of inaccurate data and the completion of incomplete data. We will inform relevant third parties to whom we have transferred your data about the rectification and completion if we are legally obliged to do so.
• Right to erasure (right to be forgotten): You have the right to obtain from us the erasure of personal information concerning you in limited circumstances where:
  • it is no longer needed for the purposes for which it was collected; or
  • you have withdrawn your consent (where the data processing was based on consent); or
  • following a successful right to object; or
  • it has been processed unlawfully; or
  • the data has to be erased in order to comply with a legal obligation to which Bright Brain Thinking is subject. We are not required to comply with your request to erase personal information if the processing of your personal information is necessary for:
    • compliance with a legal obligation; or
    • the establishment, exercise or defence of legal claims.
• Right to restriction of processing: You have the right to request restrictions to the processing of your personal information. In this case, the respective data will be marked and can only be processed by us for certain purposes. This right can only be exercised where:
  • the accuracy of your personal information is contested, to allow us to verify its accuracy; or
  • the processing is unlawful, but you do not want the personal information erased; or
  • it is no longer needed for the purposes for which it was collected, but you still need it to establish, exercise or defend legal claims; or you have exercised the right to object, and verification of overriding grounds is pending. We can continue to use your personal information following a request for restriction, where:
    • we have your consent; or
    • to establish, exercise or defend legal claims; or
    • to protect the rights of another natural or legal person.
• Right to data portability: You have the right to receive the personal information concerning you, or (in relation to parents/guardians) the Service User, which you have provided to us, in a structured, commonly used and machine-readable format and you have the right to transmit those data to another entity without hindrance from us, but in each case only where:
  • the processing is based on your consent or on the performance of a contract with you; and
  • the processing is carried out by automated means.
• Right to object: you have a right to object at any time to the processing of your personal information which has our legitimate interests as its lawful basis. If you raise an objection, we have an opportunity to demonstrate that we have compelling legitimate interests which override your rights and freedoms. The right to object does not exist, in particular, if the processing of your personal information is necessary to take steps prior to entering into a contract or to perform a contract already concluded.
• Right to object to how we use your personal information for direct marketing purposes: you can request that we change the manner in which we contact you for marketing purposes. You can request that we not transfer your personal information to unaffiliated third parties for the purposes of direct marketing or any other purposes.
• Right to withdraw consent: if you have given us your consent for the processing of your personal information, or (as a parent/guardian) the information of a Service User, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
• Right to obtain a copy of personal information safeguards for transfer of data outside your jurisdiction: if you are a resident or citizen of the EU or UK (as applicable), you can ask to obtain a copy of, or reference to, the safeguards under which your personal information is transferred outside the EU or the UK (as applicable). We may redact data transfer agreements to protect commercial terms.
• Right to lodge a complaint with your local data protection authority: if you have concerns about how we process your personal information, you have a right, at any time, to lodge a complaint with your local data protection supervisory authority (i.e. your place of habitual residence, place or work or place of alleged infringement).

We ask that you please attempt to resolve any issue with us first, although you have a right to contact your supervisory authority at any time.