Fuse SaaS Platform Privacy Policy

1. Introduction
   1. Fuse provides a Software-as-a-Service (SaaS) platform (the “Platform” ) to our business customers ( “Customers" ). Our Customers select from among their staff and these are their customer end-users of our Platform ( “Customer End-Users” ) who then have individual platform accounts with mandatory authentication created on the Platform through which they access the Platform on behalf of their business or organisation. Fuse does not select which individuals will have accounts for accessing the platform on behalf of a Customer.
   2. This Fuse SaaS Privacy Policy (the “Policy”) applies to the extent that you are Customer End-User of the Platform and the apps and services associated with it.
   3. Generally, Fuse processes personal data of Customer End-Users only in accordance with documented instructions from our Customer, and under a legally-binding contract governing that processing. In such personal data processing operations, the Customer is the data controller for the purposes of applicable data protection law. We are their data processor.
   4. If you as a Customer End-User have questions about how we process your personal data in these circumstances, in the first instance you should contact your employer’s data protection officer or data privacy manager, or refer to their privacy policy for employees.
   5. At Fuse, we want to give you the best possible experience to ensure that you enjoy our Platform. To do this, and so we can deliver an exceptional and personalised service specifically for you via the Platform, we need to collect and use information from our:
      1. Customers, who run and manage their own Fuse instance; and
      2. Customer End-Users of the Platform, who work for Fuse Customers that are signed up to use the Platform by their business or organisation; and
   6. As set out above, for most of the processing activities carried out under this Policy on behalf of our Customers, FUSE UNIVERSAL LIMITED (“Fuse”, “we”, “us”, “our”) is the data processor. For other processing activities carried out as part of the wider delivery of our services through the Platform, for example when we use the processing of personal data for analytics purposes to improve our service or business, FUSE UNIVERSAL LIMITED acts as a data controller. For all types of personal data that is collected and processed in accordance with this Privacy Policy, including the reason why it is collected, we will make it clear to you whether we are acting as a controller or processor.
   7. If you as a Customer End-User have questions about how we process your personal data in a situation where we are identified as the data controller in the tables below, in these instances you should refer to this privacy policy, or contact us via the details set out at “How to contact us” below.
   8. The privacy and the security of your personal data is, and will always be, enormously important to us. So, we want to transparently explain how and why we gather, store, process, share and use your personal data - as well as outline the controls you have around when you share your personal data with us.
   9. That is our objective, and this Policy will explain exactly what we mean in further detail below.
2. About this policy
   1. This Policy sets out the essential details relating to your personal data relationship with Fuse via the Platform. The Policy applies to all services offered through our Platform.
   2. From time to time, we may develop new or offer additional services. If the introduction of these new or additional services results in any material change to the way we collect or process your personal data we will provide you with more information or additional terms or policies. Unless stated otherwise when we introduce these new or additional services, they will be subject to this Policy.
   3. The aim of this Policy is to:
      1. ensure that you understand what personal data we collect about you as part of your access to the Platform, the reasons why we collect and use it, how we process your data, and who we share it with; and
      2. explain the way we use the personal data that you share with us in order to give you a great experience when you are using the Platform.
   4. We hope this helps you to understand our privacy commitments to you when making use of the Platform.
3. Your rights and your preferences: Giving you choice and control
   1. In order to enable you to learn more about these rights, exercise these rights with ease, and record your preferences in relation to how Fuse uses your personal data, we provide the following resources through the Platform:
      1. Privacy Settings (accessed via your user profile page - My Profile) - allows you to view and edit choices about your details; and
      2. Notification Settings (accessed via your My Profile page) - allows you to choose opt in or out of receiving different types of Fuse email and push notifications.
   2. If you have any questions about your privacy, your rights, or how to exercise them where we are acting as a data processor, please contact the Data Protection Officer (“DPO”) of your organisation in the first instance.
   3. Where we are acting as the data controller, you can contact the Fuse Data Protection Officer via email. If you have further concerns around our processing of your personal data, we hope you will continue to work with us to resolve them. However, you can also contact and have the right to lodge a complaint with the Information Commissioner’s Office (ICO) or your local Data Protection Authority.
4. Personal data we collect from you
   1. We have set out in the table below the categories of personal data we collect and process about you through the Platform:
   2. The table below describes personal data collected when you are signed up to access the Platform and use the Platform, by which Fuse is the data processor:

Categories of third party sources

Description of category

User Data

This is the personal data that is provided by the organisation you work for as a Customer End-User. If you are using Fuse as a Customer End-User, your account will have been created for you by your organisation. Depending on how your organisation is using Fuse, this may include your username, name, email address, phone number, job role and business data. It may also include birth date, gender and location or address. Some of the personal data we will ask you to provide is required in order to create your account. You also have the option to provide us with additional personal data in order to make your account more organisation. The exact personal data we will collect and process depends on how your organisation implements the Platform, how you create an account, and whether your business uses third-party partners or resellers (such as Blendit) to sign up and use the Platform. If your organisation uses a third party partner to create an account, we will receive personal data via that third party partner but only when you have consented to that third party partner sharing your personal data with us. Please note that the available plans and sign-up options may differ by country.

1. We will only collect any additional user data on the instruction of the organisation that is the Fuse customer, and only specifically for the purposes of the organization, as your data controller.
2. The following tables describe personal data that is collected by us through the Platform as the data controller.
3. The table below describes personal data collected through your use of the Platform:

Categories of third party sources

Description of category

Usage Data

This is the personal data that is collected about you when you’re accessing and/or using Platform, including: Information about your type of Platform plan. Fuse tracks all Customer End-User interactions, training progress and completion data for all training activities on Fuse. Fuse may also track details of your use of third party applications linked with the Platform. Information about your interactions with the Platform. This includes all your user activity and site visits (such as content uploads and downloads, views of content, videos, courses, quizzes, links, questions, images and documents), search queries (including the date and time of any requests you make). Inferences drawn about your learning habits, preferences. This helps us recommend content to Customer End-Users based on usage of the Platform. User content you post and share with Fuse. This includes photos, courses, articles, questions, documents, videos and interactions users have with the Fuse Customer Service team. Please note we will only access images that you specifically choose to share with us and metadata related to those images, such as the type of file and the size of the image. Some Fuse functionality such as screen recordings that you upload and custom widget data may also be written to the user's local profile on their device.

1. Personal data collected from third party sources
   1. We collect personal data about you from various third parties. These third party sources vary over time and include the following:

Categories of third party sources	Description of category
Sales partners	If you register for or log into our services using third party resellers (e.g. Blendit), we may receive your information from such third party to help create your account with us.
Technical service partners	We work with technical service partners that provide us with certain data to enable us to provide the Platform, content, and features.

1. What we process your personal data for

Description of why Fuse processes your personal data (‘processing purpose’)	Legal Basis for the processing purpose	Categories of personal data used by Fuse for the processing purpose	Fuse as controller or processor
To provide and personalise the Platform.	Performance of a Contract Legitimate Interest Consent	User Data Usage Data	Processor
To understand, diagnose, troubleshoot, and fix issues with the Platform.	Performance of a Contract Legitimate Interest	User Data Usage Data	Controller
To evaluate and develop new features, technologies, and improvements to the Platform.	Legitimate Interest Consent	User Data Usage Data	Controller
To fulfil contractual obligations with third parties, for example licensing agreements and to take appropriate action with respect to reports of intellectual property infringement and inappropriate content.	Performance of a Contract Legitimate interest	User Data Usage Data Organisation Payment and Purchase Data	Controller
To detect fraud, including fraudulent payments and fraudulent use of the Platform.	Performance of a Contract Compliance with legal obligations Legitimate Interest	User Data Usage Data Organisation Payment and Purchase Data	Controller
To conduct research and analytics.	Performance of a Contract Legitimate Interest Consent	User Data Usage Data Surveys Data	Controller

1. When a Customer End-user accesses the Platform, we use a variety of technologies to process the personal data we collect about you for various reasons, including the delivery of the Platform to you. We have set out in the table below the reasons why we process your personal data, the associated legal bases we rely upon to legally permit us to process your personal data, and the categories of personal data (identified in Section 4 'Personal data we collect from you' used for these purposes:
2. If you require further information about the balancing test that Fuse has undertaken to justify its reliance on the legitimate interest legal basis under the GDPR, please see Section 10 'How to contact us' for further details on how to contact us.

1. Sharing your personal data
   1. We have set out the categories of recipients of the personal data collected or generated through your use of the Platform.

Publicly available information

1. The term publicly refers to other authorised users of the Platform only. The following personal data will always be available to other Customer End-Users of your Fuse instance: your name and/or username, profile picture, your recently viewed content, and your publicly shared files.

Personal data you may choose to share

1. The following personal data will only be shared with the categories of recipients outlined in the table below if:
   1. you choose to make use of a specific Platform feature where sharing of particular personal data is required for the proper use of the Platform feature; or
   2. you grant us your permission to share the personal data, e.g. by selecting the appropriate setting in the Platform or authorizing Fuse through a presented consent mechanism.

Categories of Recipients	Reason for sharing
Third party applications and devices you connect to your Fuse Account	If you connect your Fuse account to a third party application and/or device(s), such as, Single Sign On, social sign on, social media, audio, television, or automotive platforms and services, Fuse may share technical data with the operator of that third party application and/or device in order to connect your Fuse account, and/or facilitate playback of the Platform. With respect to certain third parties, which may request or require that we share your information with them, your permission will be requested before we provide your information to such third parties.
Support community	When you register for a Fuse Support Account on the Fuse Support Community, we will ask you to create a specific Fuse Support Community username. This will be publicly displayed to anyone who accesses the Fuse Support Community along with any questions or comments you post.

1. Learn more about how to manage notifications, your publicly available information, and what you share with others in Section 3 'Your rights and your preferences: Giving you choice and control' of this Policy.

Information we may share

Categories of Recipients	Reason for sharing
Service providers	We work with service providers that work on our behalf which may need access to certain personal data in order to provide their services to us. These companies include those we've hired to provide the technical infrastructure and functionality that we require as part of the Platform, and assist in protecting and securing our systems and services. Please see out Data Protection Agreement for the current list of service providers: https://www.fuseuniversal.com/company/legal
Fuse partners	Depending on how you sign up for the Platform (e.g. through a third party reseller or a mobile provider), we share your Fuse username or other User Data as necessary to enable your account. We may also share personal data with that third party about your use of the Platform, such as whether and to what extent you have actively used the Platform. We also may share your personal data in a pseudonymised format with our content partners to help them understand how the content they license to us is performing and to enable you to access content via the Platform.
Academic researchers	We will share your Usage Data for activities such as statistical analysis and academic study but only in a pseudonymised format.
Other Fuse group companies	We will share your personal data with other Fuse group companies to carry out our daily business operations and to enable us to maintain and provide the Platform to you.
Law enforcement and data protection authorities	We share your personal data when we in good faith believe it is necessary for us to do so in order to comply with a legal obligation under applicable law, or respond to valid legal process, such as a search warrant, a court order, or a subpoena. We also share your personal data where we in good faith believe that it is necessary for the purpose of our own, or a third party’s legitimate interest relating to national security, law enforcement, litigation, criminal investigation, protecting the safety of any person, or to prevent death or imminent bodily harm, provided that we deem that such interest is not overridden by your interests or fundamental rights and freedoms requiring the protection of your personal data.
Purchasers of our business	We will share your personal data in those cases where we sell or negotiate to sell our business to a buyer or prospective buyer. In this situation, Fuse will continue to ensure the confidentiality of your personal data and give you notice before your personal data is transferred to the buyer or becomes subject to a different privacy policy.

1. Transfers outside the UK and/or EEA
   1. The information you provide may be transferred to countries outside the United Kingdom (“UK”) or European Economic Area (“EEA”) that do not have similar protections in place regarding your data and restrictions on its use as set out in this policy. However, we will take steps to ensure adequate protections are in place to ensure the security of your information.
   2. Whenever we transfer your personal data out of the UK or EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:
      1. We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the UK's Information Commissioner's Office or the European Commission.
      2. Where we use certain service providers, we may use specific contracts approved for use in the UK or EEA (including the EU Standard Contractual Clauses (“SCCs”), the UK International Data Transfer Agreement (“IDTA”) and/or the UK Addendum to the SCCs as amended from time to time) which give personal data the same protection it has in the UK or EEA.
   3. Please contact your DPO if you want further information on the specific mechanism used by us when transferring your personal data out of the UK or EEA.
2. Our Data security
   1. Fuse are ISO72001 accredited. In accordance with our certification, data security is important to us and we have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.
   2. We have put in place procedures to deal with any suspected personal data breach and will notify your business or organisation and any applicable regulator of a breach where we are legally required to do so.
3. Data retention and deletion
   1. If you are accessing Fuse through your business or organisation please contact them with regards to your personal data retention in the first instance. If you request, we will delete or anonymise your personal data so that it no longer identifies you, unless we are legally allowed or required to maintain certain personal data, including situations such as the following:
      1. If there is an unresolved issue relating to your account, such as an outstanding credit on your account or an unresolved claim or dispute we will retain the necessary personal data until the issue is resolved;
      2. Where we need to retain the personal data for our legal, tax, audit, and accounting obligations, we will retain the necessary personal data for the period required by applicable law; and/or,
      3. Where necessary for our legitimate business interests such as fraud prevention or to maintain the security of our users.
4. Changes to this Policy
   1. We may occasionally make changes to this Policy.
   2. When we make material changes to this Policy, we'll provide you with prominent notice as appropriate under the circumstances, e.g., by displaying a prominent notice within the Platform or by sending you an email and/or a device notification. We may notify you in advance.
   3. Please, therefore, make sure you read any such notice carefully.
5. How to contact us
   1. Thank you for reading our Policy. If you have any questions about this Policy, please contact our Data Protection Officer via email on dpo@fuseuniversal.com, or by writing to us at the following address: FUSE UNIVERSAL LIMITED, 6th Floor, Charlotte Building, 17 Gresse Street, W1T 1QL United Kingdom.
   2. We hope you enjoy Fuse!