1- Scope of Policy.  This Data Privacy and Protection Policy (“Privacy Policy”) describes how Experiential collects, manages, utilizes and protects personally identifiable information (“PII”) through Experiential’s website, applications and devices (“Services”).  By interacting with Experiential’s XRP-related programs, applications, websites or devices, or submitting data to Experiential, you consent to the handling of your PII as described herein.

While Experiential (also “we”) expects that providers of XRP-related programs have data privacy and protection policies that are fully-compliant with the relevant laws and regulations in their jurisdiction, this Privacy Policy does not directly apply to the activities of such program providers.  Because the XRP Platform is a true open source STEM educational platform, Experiential does not directly oversee or monitor these organizations, and may or may not even be aware of their existence or their activities.  It is up to the participants, guardians and educators (collectively herein, as applicable, “you”) to determine whether a program provider has an appropriate data privacy and protection policy, and whether the practices of such organizations follow those policies.  Experiential cannot and does not assume any responsibility for the data privacy policies and practices of any provider of XRP-related programs or services, including those that may be listed or  have website links on Experiential’s website or in its other materials. 

2- Compliance with Laws.  Experiential complies with all applicable laws relating to protection of any student information received in connection with its activities related to the XRP Platform, including the Family Educational Rights and Privacy Act (FERPA), the Protection of Pupil Rights Amendment (PPRA), and applicable state student privacy laws.  If and to the extent Experiential’s activities involve students outside the U.S., Experiential shall also comply with the data privacy regulations of the relevant jurisdiction, such as GDPR requirements for activities within the European Union.  

3- Protection of Student Information. If and to the extent Experiential receives or accesses PII in connection with the XRP Platform or which is disclosed to it in the course of other activities, Experiential shall: (a) use PII only for purposes directly related to the XRP Program; (b) implement reasonable administrative, technical, and physical safeguards to protect PII from unauthorized access, use, or disclosure; (c) not disclose or publish PII in any manner that would permit individual students to be identified; (d) not use, rent or sell PII for marketing, advertising, profiling, or any commercial purpose; (e) limit access to PII to personnel and third parties with a legitimate educational need related to the XRP Program; and (f) not further disclose PII to third parties without prior written consent, except as stated herein or as required by law.  Experiential stores PII we receive on servers located within the United States, where we are based.

4- Types of Data Collected and Their Use. Experiential may collect PII such as: name, age, grade, user ID and password, email address, along with location and IP address of devices used for XRP-related programs.  We may use this data for the following purposes: to evaluate and improve our programs; to permit access to features and saved workspaces on our applications and websites, to provide access to curricula and educational materials; to monitor appropriate use of software applications and websites we make available; to review and analyze usage and participation in XRP-related programs; to communicate with you or provide support.  We may share certain PII with program providers in connection with these purposes, provided that those program providers have implemented privacy policies consistent with this Privacy Policy.  In general, program providers themselves may collect additional or different information for additional or different purposes.  Please see those organizations’ privacy policies for more information.

5- Age Restrictions.  In compliance the Child Online Privacy Protection Act (COPPA) and other regulations, Experiential does not permit the creation of any accounts on our systems by youths under the age of 13, and does not intentionally collect their data.  Experiential may allow youths 13 and older to create accounts and submit data. If you become aware of accounts or data submitted by youths under 13, please contact Experiential at privacy@experiential.bot for its deletion.  

6- Data Security and Deletion.  Experiential maintains appropriate data security measures including encryption, access controls, and secure destruction protocols. You may request that your personal data at Experiential be deleted, by emailing privacy@experiential.bot. You will need to complete a request form and provide information to confirm your identity at the time of your request.  We reserve the right to confirm your identity before taking any action to delete your data.  Experiential will assess each request to be forgotten on a case-by-case basis to determine the extent to which data can be deleted.  Experiential will comply with all requests to be forgotten except where Experiential has a legal obligation to retain your data. With respect to PII held by program providers, any requests for PII deletion must be addressed directly to the program provider and not to Experiential.

7- Compelled Disclosures.  If required by legal process to disclose PII, Experiential shall comply with the relevant government entity, and will seek any appropriate protections of  such PII from the requesting body.

8- Changes to This Policy.  Experiential reserves the right to change this Privacy Policy at any time. Such changes, modifications, additions, or deletions shall be effective immediately upon notice thereof, which may be given by means including, but not limited to, posting the revised Privacy Policy on our website. You acknowledge and agree that it is your responsibility to review the website and this Privacy Policy periodically, and to be aware of any modifications.

9- Contact.  If you have any questions or concerns regarding this Privacy Policy, you may contact Experiential at privacy@experiential.bot.