Back to legal center

Privacy Policy

Version: 4.0

Effective: 23 June 2023

At Boardingware, we respect the privacy rights of our users and recognize the importance of protecting the personal information we collect about you. This Privacy Policy is designed to help you understand how Boardingware collects, uses and discloses information, and what choices you have with respect to the information. 

When we refer to ‘’Orah’’, “Boardingware”, “us” or “we”, we mean the Boardingware entity that acts as the controller or processor of your information. Boardingware remains the legal entity operating under the Orah brand.

This Privacy Policy applies to Boardingware’s online student management tools and platform, including the associated Boardingware mobile applications (collectively, the “Services”), boardingware.com, blog.boardingware.com, offers.boardingware.com and any other successor URLS, related domains and subdomains (collectively, the “Websites”) and other interactions (eg. customer service inquiries, direct marketing etc) you may have with Boardingware. If you do not agree with the terms, do not access or use the Services, Websites or any other aspect of Boardingware’s business. 

If you are a visitor to a Boardingware Website or a customer of a Boardingware Service, then unless stated otherwise, you are granting consent under this Privacy Policy to apply to the use of such Website or Service. By the use of our website or service, you are granting your consent to this Privacy Policy.

If you are a visitor to or user of a third-party website or service that utilizes any Boardingware Services, then any information you submit to such Third-Party Property is collected under the privacy policy of the owner of such Third-Party Property, and you should contact such owner with any related requests or inquiries you may have.

Information we collect

Boardingware may collect and receive Customer Data and other information in a variety of ways:

Personal information you provide to us:

  • We may collect Personal Data from you when you create a Boardingware account. This may include your first and last name, date of birth, job title, email, phone, address, IP address, profile photo, geo-location, sex and password. 
  • We may collect Personal Data from you, such as your first and last name, job title, email, phone, company and country when you register or submit a form with our services/offerings. Eg. We will collect your email address when you subscribe to our newsletter via a form on our website.
  • If you provide us feedback or contact us via email or other electronic message, we will collect your name, email address as well as any other content included in the email in order to send you a reply.
  • If you provide us with personal information in person, via phone or email, we may collect the information provided that explicit consent was obtained during the conversation.
  • We may also use publicly available sources to collect personal data for the purpose of a legitimate interest. This information may include first and last name, email, phone, company name and country.
  • We may collect sensitive personal information about students if a school decides to disclose such information to us.  This may include gender, religion, and ethnicity.

Information we collect about you:

  • We automatically collect information on how you interact with the Offerings, such as date and time, information about your browser, operating system computer or device, pages viewed and items clicked. We use cookies and similar technologies to collect some of this information. 
  • We may collect information when you interact with our advertisements and other content on third-party sites or platforms, such as social networking sites. This may include information such as “Likes”, profile information gathered from social networking sites or the fact that you viewed or interacted with our content. 

Other information: 

Customers or users may upload additional types of personal information about you or Personal Information which belongs to another person for Boardingware to process. For example, when student information is uploaded directly to Boardingware’s cloud service by their School. These organisations or individuals are responsible for ensuring they are disclosing such information in accordance with their applicable data and privacy laws.

How we use information

When Boardingware is the controller of Personal Information, we may use your information in the following ways:

  • To provide, update, maintain and protect our Services, Websites and business.  We may use your personal information to verify your identity and grant you access to the Boardingware services.
  • To communicate with you by responding to your requests, comments and questions. If you contact us, we may use your personal Information to respond and provide technical and implementation support.
  • To better understand how end users are using the service, to improve and optimize our Services. We may analyze trends, monitor usage of user activity as well as traffic patterns to help us better understand our performance so we can optimize and improve our Services.
  • To send emails and other communications related to changes to the service or important announcements. We may send you service, technical and other administrative emails, messages and other types of communications. We may also contact you to inform you about changes in our Services, our Services offerings and important Services-related notices, such as security and fraud notices. These communications are considered part of the Services and you may not opt out of them. 
  • To carry out training and marketing related to the service. We sometimes send emails about new product features, promotional communications or other news about Boardingware. These are marketing messages so you can control whether you receive them or not.
  • To deliver tailored advertising. We may use your personal information to serve and manage ads on our services or on third party sites and to tailor ads based on your interests and browsing history. Please see “Your Rights” for additional information on how to manage the ads you see.
  • Profiling.  We may analyse your Personal Information to create a profile of your interests and preferences so that we only send information that is relevant to you. We may make use of additional information about you when it is available from external sources to help us to do this effectively. We may also use your personal information to detect and reduce fraud or credit risk.
  • To comply with applicable laws, legal processes or regulations
  • As described to you at the time of collection or as otherwise described in this Privacy Policy. 

If information is aggregated or de-identified so it is no longer reasonably associated with an identified or identifiable natural person, Boardingware may use it for any business purpose. To the extent information is associated with an identified or identifiable natural person and is protected as personal data under applicable data protection law, it is referred to in this Privacy Policy as “Personal Data” or “Personal Information”.

How we share and disclose information

Boardingware may share and disclose Information as reasonably necessary for the purposes stated in this policy to the following entities:

  • Boardingware employees. Boardingware may disclose Personal Information to its employees if necessary. 
  • Customer Access. Boardingware may disclose Personal Information to system administrators or any other authorized user that has permission to access, modify, audit or restrict access to personal information. 
  • Approved suppliers and third party services. Boardingware may share information with its approved third party companies or individuals as service providers to process Personal Information to support our business. These third parties may, for example, provide security, administration and storage services. 
  • Aggregated or De-identified Data. We may disclose or use aggregated or de-identified information for any purpose. For example, we may share aggregated user activity information, such as the average number of rolls completed in a school term, with Boardingware employees and partners for research purposes.
  • To Comply with Laws. If we receive a request for information, we may disclose information if we reasonably believe disclosure is in accordance with or required by any applicable law, regulation or legal process.
  • With Consent. Boardingware may share information with third parties or disclose information to Boardingware employees when we have consent to do so. Upon granting consent, users are providing consents to the third-party’s terms of services. 

Disclosure of information by Boardingware Customers. Users of the Boardingware service may disclose Personal Information which belongs to another person.  For example, when creating their personal list of contacts. By doing so, they will be taking the role of the controller and will be responsible for ensuring consent has been obtained.

Data Retention

Boardingware may retain personal information only for the time necessary for the achievement of its intended purpose.

Data Controller and Processor Responsibilities

Boardingware will assume responsibility of the Controller when the purpose and means for processing Personal Information has been determined.

Boardingware will assume responsibility of the Processor when end-users upload personal information to the Boardingware service. It is then the responsibility of the customer or individual to ensure that such personal information is disclosed in accordance with applicable data protection and privacy laws.

Your Rights

Individuals located in certain countries, including the European Economic Area, have certain statutory rights in relation to their personal data. Subject to any exemptions provided by law, you may have the following rights:

  • Right to be informed.  To the extent that Boardingware is a controller of your information, you have the right to be informed of the categories of data that will be collected prior to its collection or at the point of collection and to be informed of any changes to this collection.
  • Right to access your information. You may ask to receive confirmation as to whether your personal data is being processed by us, as well as various other information relating to our use of your personal data.
  • Right to request a copy of your information.  You may request a copy of the personal information held by Boardingware.
  • Right to obtain confirmation of information use.  Right to obtain information relating to whether or not your personal data is being processed by Boardingware or third parties, where,for what purpose and from whom the data was collected
  • Right to rectify information. You may update or correct your information at anytime. This can be done with the settings and tools provided in your Boardingware account or by making a request via email.
  • Right to be deleted. You may request erasure of your Personal Data which we are processing at anytime. You may also have the right to lodge a complaint with the Information Commissioner's Office.
  • Right to consent.  You have the right to give your consent for Boardingware to control your data if you are a European citizen or resident.  Additionally, EU citizens have the right to rescind their consent.
  • Right to data portability. You may request a copy of your data held by Boardingware in a machine readable format, free of charge.
  • Right to object. Boardingware may control your Personal Data for direct marketing purposes and you have the right to object or withdraw consent to Boardingware’s use of your Personal Data for this purpose at any time.
  • Right to be notified of a breach. In the case of a breach that is likely to result in a risk to your rights and freedoms, Boardingware will notify you of the breach within 72 hours.
  • Right to complain.  You have the right to raise a complaint with us or a right to lodge a complaint to a supervisory authority relating to the use of your personal information.
  • Right to claim compensation.  You have the right to claim for damages caused by a breach of applicable data protection laws, within the guidelines and limits of such laws.
  • Right to say no to the sale of your data.  Right to object to the sale of your personal data and not to be discriminated against if you choose to exercise this right

The extent that Boardingware processes and control your Personal Information is subject to the General Data Protection Regulation, Boardingware relies on Legitimate Interest unless otherwise stated in this Privacy Policy, to process and control your data. 

Exercising your rights.

You can exercise your rights at any time by contacting us at privacy@boardingware.com

Security Assurance

Boardingware is currently certified for ISO 27001 (information security management system) and ISO 27018 (for protecting personal data in the cloud) and has also alignmed with ISO 27017 (cloud security) . 

More information on Boardingware’s security practices can be found in the following whitepapers.

Under 16

Personal information for children under the age of 16 may be uploaded into Boardingware Service’s under the control of the Customer. The customer is responsible for ensuring that disclosing such information is done in accordance to applicable law, legal processes and regulations.  For example, obtaining consent from their parents or legal guardians if applicable under the GDPR.    Boardingware does not control student PII submitted by the controller and will only act as a processor.  Boardingware discloses student PII to the following third party sub-processors.  A data processing agreement exists between Boardingware and these sub-processors.

  • Amazon Web Services (aws.amazon.com) - Cloud infrastructure
  • Elastic Cloud (www.elastic.co) - Infrastructure and application monitoring and analytics
  • Mandrill (www.mandrill.com) - Email sending
  • Segment (segment.com) - User Analytics
  • Intercom (www.intercom.com) - User Communications
  • Planhat (www.planhat.com) - Account Management
  • Nom Nom (www.nomnominsights.com) - Feedback Analysis
  • Salesforce (www.salesforce.com) - Account Management
  • Marketo (www.marketo.com) - Marketing
  • Mixpanel (www.mixpanel.com) - Analytics
  • Twilio (www.twilio.com) - SMS sending
  • Bugsnag (www.bugsnag.com) - Bug monitoring
  • OpenAI (www.openai.com) - Use of Large Language Models 

If a child contacts our support team via email, Boardingware may release that child’s information to third parties solely for the purpose of providing support.

The above third parties are required for Boardingware to provide the service.  If as a parent, you do not want Boardingware to disclose your child’s information to these third parties, please refer to the section below to request to remove your child from our service.

If you learn that anyone younger than 16 has unlawfully provided us with personal data, please contact us and we will take necessary steps to delete such information.

Parent Notice

Parental consent may be required under applicable data protection laws to allow Boardingware to process child information.  This consent should be collected by the child’s school who is acting as the data controller by disclosing the child’s personal information to Boardingware.  As a parent, please ensure that you have given your child’s school permission to disclose your child’s personal data to third parties such as Boardingware.

If you do not want Boardingware to process your child’s information, please email us at privacy@boardingware.com and we’ll endeavour to remove your child’s information from our services.  Please note, this will require us to verify your identity and confirm with your child’s school before any action is taken.

International Data Transfers

Boardingware may transfer your Personal Information to countries other than the one in which you live. To secure your Personal Information, Boardingware deploys encryption safeguards to protect data in-transit and at rest.  More information on data storage can be found within our Cloud Security Whitepaper.

Changes to this privacy policy

Boardingware may amend this Policy from time to time, and any amended Policy is effective upon posting to the public website (www.boardingware.com).  Boardingware will make reasonable effort to communicate any significant changes to you via email or notification via the service.  Your continued use of the service will be deemed acceptance of any amended Policy.

Contacting Boardingware

Please also feel free to contact Boardingware if you have any questions about this Privacy Policy or Boardingware’s practices, or if you are seeking to exercise any of your statutory rights. You may contact us at privacy@boardingware.com or at our mailing address below:

Boardingware International Limited

Office 3.1, 

91 St Georges Bay Road,

Parnell, Auckland

1052

New Zealand

Data Protection Officer:

Name:  Pete Weaver

Email: dpo@boardingware.com