Privacy Statement
Introduction
When you use our services, we're collecting your personal data to support those services. Data privacy is important to us at Socratic. This Privacy Policy details our use of personal data and your privacy rights and choices available to you. Socratic is a Data Controller that is responsible for determining the purpose and means of personal data processing. Socratic is a Sub Processor, that collects, processes and uses data in accordance with the purpose and means of personal data processing agreed with the Data Controller. The Data Controller includes our enterprise customers.
How we use personal data
Your data is collected to help us:
- Provide support and troubleshooting when using our services.
- Meet our legal and compliance obligations.
- Automated processing activities.
Personal data we may collect
Socratic may collect one or more of the following types of data as a requirement for using our services:
- Name
- Contact information
- Photos
- Employee number or ID
- IP address
- Cookie ID
- Login and password
- Usage data
In addition to the data above which may be requested or required when using our services, additional unsolicited data may be processed that is not reviewed by Socratic as part of the services provided. We will apply the same security and privacy protections as the solicited data above, which may not recognise any additional privacy risks of this data.
When we share your personal data
Your personal data may be shared with third parties under one or more of the following scenarios:
- To the Data Controller in line with the agreed terms of service.
- With related entities or partners that abide by the terms of this policy.
- When your explicit consent is given.
- When you have been given notice of our intent, plans, or requirements to share it and you have not provided an objection to disclosure, within 30 days.
- With established affiliates and partners subject to non-disclosure agreements and with a legitimate purpose in line with this privacy policy.
- To government agencies, regulators or law enforcement agencies with a lawful purpose.
Your rights
Your privacy rights are outlined below. For further details of these rights or to make a request from us related to these rights, please see the Privacy Requests and Contacts section below and contact us accordingly.
The right to be informed. You have the right to be informed about the collection and use of your personal data, when the data is obtained by us.
The right to access and amend your data. You can request a copy of your personal data through a data subject request. You can ask us to explain the means of collection, what data is being processed by us, and anyone that we share it with.
The right to rectify your data. If your data is inaccurate or incomplete, you can ask us to rectify that.
The right to data erasure. You have the right to request that your personal data be erased from our records within 30 days, subject to any legal or contractual obligations that may require us to retain certain data. If we are unable to comply with your request, we will notify you of the reasons and any potential implications for our services.
The right to transfer your data. You can have your data transferred from one system to another safely and securely.
The right to restrict your data processing. You can request we restrict or suppress your personal data to limit its use.
The right to opt-in for sensitive data processing: For any highly sensitive personal data we may collect, we require your explicit consent to opt-in to us processing that data.
The right to opt-in by a parent or guardian: We do not collect data from minors. You are required to be over the age of 16 in order to use our services.
The right not to be subject to fully automated decisions: Where decisions about you are made solely by automated processes, including profiling that produces legal or similarly significant effects, you have the right to request human intervention, express your point of view, and receive an explanation of the decision-making process.
These rights are subject to the clauses of the relevant privacy regulations, legal requirements, public interest, and where the above rights may conflict with your use of our services. For any privacy concerns or to request further details of your rights, please see the Privacy Requests and Contacts section below.
Sub-processors and locations
| Sub-processor | Role | Location(s) |
|---|---|---|
| Google Cloud Platform (GCP) | Infrastructure and hosting services | Primary data centers in the United States and Europe (e.g., Ireland, Belgium). |
| Google Workspace | Email, collaboration, and productivity tools | Data is processed in multiple regions including the United States and the European Union. |
| GitHub | Source code repository and version control | United States-based data centers. |
| Rippling | Human resources and employee management systems | Processed primarily in the United States. |
| Drata | Security and compliance monitoring | United States. |
| WorkOS | Authentication and access management services | United States. |
Privacy requests and contacts
For further information about our Privacy Policy or practices, or to raise any privacy requests or complaints in relation to your data, please contact us using the following methods:
- Email: privacy@socratic.co