Last Updated: December 20, 2023

What’s changed in this version? 

  • Instructure has updated this notice to include information related to our participation in the U.S. Department of Commerce’s Data Privacy Framework in Section 15.
  • Updated section numbers and minor typographical changes.

Instructure, Inc. (“Instructure,” “we,” “our,” or “us”) has prepared this Marketing Privacy Policy (“Privacy Policy”) to describe our practices regarding the information collected from visitors to our website, https://www.instructure.com, community.canvaslms.com and any other sites that link to this Privacy Policy (collectively, “Site”). 

This Privacy Policy applies only to marketing activities conducted using information (including personal data) collected through the Site. To learn about how we process information when you interact with our products or services, please visit our Product Privacy Notice Center.

1. DATA COLLECTION. Below, we summarize the data collected from you when you use the Site.  For a complete list of the data elements we collect from all visitors regardless of location of residence, please review our California Privacy Notice.

2. DATA YOU PROVIDE TO US. When using our Site, you may voluntarily provide personal data about yourself, such as first and last name, e-mail addresses, phone number, professional title, company name, educational institution or organization name, and any other information you choose to provide. For example, we collect this information when you provide it to our Site, contact an Instructure employee, or otherwise provide personal data to Instructure, such as via email. When you participate in one of our surveys, we may collect additional personal data, such as your interest in specific Instructure services. 

3. DATA COLLECTED VIA TECHNOLOGY. To make our Site more useful to you, we automatically collect information relating to your interactions with us and our Site, including browser type, operating system, Internet Protocol (IP) address, domain name, geolocation, and/or a date/time stamp for your visit. We also use cookies and other similar technologies as well as URLs to gather information regarding the date and time of your visit and the solutions and information for which you searched and which you viewed.

4. COOKIES are small pieces of information that a website sends to your computer’s hard drive while you are viewing a website. 

Our Site uses the following types of cookies:

STRICTLY NECESSARY COOKIES: These cookies are essential to enable you to move around the Site and use its features. Without these cookies, services like enabling appropriate content based on your type of device cannot be provided.

PERFORMANCE COOKIES: These cookies collect information about how visitors use the Site, so that we can analyze traffic and understand how our visitors use the Site. We may use third party service providers for this purpose who may set their own cookies on the Site. All information these cookies collect is aggregated and is used to improve how the Site works.

FUNCTIONALITY COOKIES: These cookies allow our Site to remember choices you make (such as the region you are in and preferred language) and provide more personalized features. They may also be used to provide services you have asked for such as watching a video. 

SOCIAL MEDIA COOKIES: These cookies are used when you share information using a social media sharing button or engage with our content on or through a social media site such as Facebook, Twitter, Instagram, or LinkedIn. The social network will record that you have done this. This information may be linked to targeting/advertising activities conducted by third parties on Instructure’s behalf.

TARGETING AND ADVERTISING COOKIES: These cookies are used to deliver advertisements more relevant to you and your interests. These cookies are also used to limit the number of times you see an advertisement as well as help measure the effectiveness of advertising campaigns.  To learn more about the use of this information and the choice available to you, please see the “Use of Your Data” in Section 6 of this privacy policy.

5. ANALYTICS. We use third-party analytics services to collect and analyze data about how users use the Site. These services use cookies, scripts, and other technologies to collect and store information such as how users interact with our Site, how often users visit the Site, what pages they visit, and what other sites they used prior to coming to the Site.

Instructure uses Google Analytics and other third-party services to improve the performance of the Site and for analytics and marketing purposes.  For more information about how Google Analytics collects and uses data when you use our Site, visit https://www.google.com/policies/privacy/partners/, and to opt out of Google Analytics, visit https://tools.google.com/dlpage/gaoptout/.

If you want to limit the use of cookies, your browser may offer tools to do so. By disabling cookies, you may be prevented from accessing some features of our Site or certain content or functionality may not be available.

6. USE OF YOUR DATA. Instructure uses your personal data for any lawful purpose, including, but not limited to, the following purposes: to respond to your requests; to operate, maintain, and improve our Site, including for analytics purposes; to personalize and improve your experience; to send you administrative e-mails; to respond to your comments or inquiries; to send you surveys, promotional communications about our products and services or the products and services of third parties (“Partners”); to comply with the law and to protect, investigate, and deter against fraudulent, unauthorized, or illegal activity; to make telephone calls to you, from time to time, as a part of secondary fraud protection or to solicit your feedback with your permission; or with your consent or as otherwise disclosed at the time information is collected. 

We do not use automatic decision-making or engage in profiling.

7. DISCLOSURE OF YOUR DATA. We will share your personal data with third parties as described in this Privacy Policy, including the following:

AFFILIATES. We may share personal data we collect with any subsidiaries, joint ventures, or other companies under common control (“Affiliates”) we may have in the future. We may share some or all of your personal data with these Affiliates, in which case we will require our Affiliates to honor this Privacy Policy. 

THIRD PARTY SERVICE PROVIDERS. We may share your personal data with third party service providers who process information on our behalf. For example, we may share data with service providers who host our websites or provide email services on our behalf.

PARTNERS. We may also share your personal data with our Partners. Our Partners may use your personal data for their own direct marketing purposes.

TRANSFER OF ASSETS. We may also share personal data about you in connection with or during negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company. In the event that personal data is shared in this manner, notice will be posted on our Site.

TESTIMONIALS. We display testimonials and endorsements on our Site. With your consent we may post your testimonial along with your name. If you wish to update or delete your testimonial, you can contact us at privacy@instructure.com.

8. OTHER DISCLOSURES. Instructure may disclose information about you if it believes such disclosure is necessary to (a) comply with laws or to respond to lawful requests and legal process; (b) protect or defend the rights, safety, or property of Instructure, users of the services, or any person including to enforce our agreements, policies, and terms of use; or (c) in an emergency to protect the personal safety of any person. We may share information with your consent or as otherwise disclosed at the time of data collection or sharing.

We may also share de-identified and/or aggregated data without limitation.

9. NOTICE TO INTERNATIONAL VISITORS. This section applies to visitors that access the Site from the European Economic Area (“EEA”), Switzerland, or the United Kingdom (“UK”).

LEGAL BASIS FOR PROCESSING. We may only process personal data about you where the laws of your jurisdiction permit it. This is called a “legal basis.” We may rely on the following legal bases to process personal data about you:

RIGHTS. You have the right to request access to the personal data we hold about you. You have the right to request that we rectify or erase your personal data. You also have the right to request that we restrict or block the processing of your personal data. Under certain circumstances, you have the right to receive personal data about you that we store and transmit to another without hindrance from us, including requesting that we provide your personal data directly to another, i.e., a right to data portability; and where we previously obtained your consent, to withdraw consent to processing your personal data.

To exercise these rights, contact us using the “Contact Information” in Section 16 below and to exercise your right to be forgotten complete the form found at https://www.instructure.com/right-be-forgotten. 

Please be aware that Instructure may be unable to afford these rights to you under certain circumstances, such as if we are legally prevented from doing so. Additionally, you have the right to lodge a complaint against us. To do so, contact the supervisory authority in your country of residence.

RETENTION. We will process and store your personal data only for the period necessary to achieve the purpose of the storage, or as permitted by law. The criteria used to determine the period of storage of personal data is the respective statutory retention period or for certain marking data for our services or other products. After expiration of that period, the corresponding data is routinely deleted, as long as it is no longer necessary for the fulfillment of a contract or the initiation of a contract.

TRANSFERS OF PERSONAL DATA. Please be aware that the personal data we collect may be transferred to and maintained on servers or databases located outside your state, province, country, or other jurisdiction, where the privacy laws may not be as protective as those in your location, including the United States. 

When transferring personal data to countries outside the EEA or the UK, we are required to ensure your personal data is adequately protected in the country where it is transferred. We transfer personal data to these countries only when it is subject to safeguards that assure the protection of personal data, such as entering contracts with transferee companies called the “standard contractual clauses” and the “UK addendum,” which require companies outside the EEA or UK to protect your personal data to the same extent as if it had remained in the EEA or UK.

11. CALIFORNIA PRIVACY NOTICE. California residents have certain rights under the California Consumer Privacy Act (“CCPA”) in relation to your personal data. Please visit our California Privacy Notice for more information on how to exercise these rights.

12. SOCIAL NETWORKING PLATFORMS. We may allow you to connect and share information with certain social networking platforms (“Social Networking Platforms”) (e.g., a Facebook application). By choosing to use these Social Networking Platforms, you allow Instructure to share information with the Social Networking Platform. For example, you might use an application to publish Instructure related notices on your Facebook wall. If you do not want us to continue to provide your information to the Social Networking Platform, you may change your privacy settings in the Social Networking Platform.

We do not control the privacy practices of the Social Networking Platforms and sign-in services you choose to use, and this Privacy Policy does not cover their practices, you should visit the privacy policies of any Social Networking Platform or sign-in service you choose to use to understand their practices.

13. YOUR CHOICES REGARDING PERSONAL DATA. We offer you choices regarding the collection, use, and sharing of your personal data. When you receive newsletters or promotional communications from us, you may “opt-out” by following the unsubscribe instructions provided in e-mails you receive from us or by contacting us directly at the contact information below.

Most web browsers are set to accept cookies by default. If you prefer, you can typically remove and reject cookies from our Site with your browser settings. If you remove or reject our cookies, it will affect how our Site and services work for you.

We may partner with ad networks and other ad serving providers (“Advertising Providers”) that serve ads on behalf of us and others on non-affiliated platforms. Some of those ads may be personalized, meaning that they are intended to be relevant to you based on information Advertising Providers collect about your use of the Site and other sites over time, including information about relationships among different browsers and devices. This type of advertising is known as interest-based advertising.

14. CHANGES TO YOUR PERSONAL DATA. You may change some of your personal data in your account by choosing your communication settings in the Instructure Preference Center which is located at https://www.instructure.com/preference-center. You may also request changes or deletions by e-mailing us at the e-mail address set forth below. We will respond to your request, when permitted by law, within 30 days. We may be unable to delete personal data that resides in our archives.

15. DATA PRIVACY FRAMEWORK POLICY.

Instructure complies with the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”) as set forth by the U.S. Department of Commerce. Instructure has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (“EU-U.S. DPF Principles”) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. Instructure has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (“Swiss-U.S. DPF Principles”) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (“DPF”) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

Instructure commits to subject to the DPF Principles all personal data received from the EU, UK, and Switzerland in reliance on the relevant DPF.

Instructure is accountable for the processing of personal data it receives under the EU-U.S. DPF Principles and the Swiss-U.S. DPF Principles (collectively, “DPF Principles”) and subsequently transfers to a third party. Instructure complies with the DPF Principles for all onward transfers of personal data from the EU, UK, and Switzerland, including the onward transfer liability provisions. The Federal Trade Commission has jurisdiction over Instructure’s compliance with the EU-U.S. DPF, UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.

Instructure may be required to disclose personal data in response to law requests by public authorities, including to meet national security and law enforcement requirements.

Residents of the EU, UK, and Switzerland have the right to access the personal data that Instructure maintains, and in some cases, have choices to limit the use and disclosure of personal data. These rights are described more fully in Section 9 “Notice to International Visitors, Rights” of this Privacy Policy. To exercise these rights, contact us at privacy@instructure.com.

In compliance with the EU-U.S. DPF, UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Instructure commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU, UK, and Swiss, individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF should first contact Instructure as described in the “Contact Information” in Section 16 below.

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Instructure commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF to TRUSTe, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, 

please visit https://feedback-form.truste.com/watchdog/request for more information or to file a complaint. The services of TRUSTe are provided at no cost to you. Under certain conditions, more fully described on the DPF website, you may be entitled to invoke binding arbitration when other dispute resolution procedures have been exhausted.

16. CONTACT INFORMATION. Instructure welcomes your comments or questions regarding this Privacy Policy. Please e-mail us at privacy@instructure.com or contact us at the following address or phone number:

Instructure, Inc.
6330 S 3000 E, STE 700
Salt Lake City, UT 84121
United States of America
Phone: +1 (800) 203.6755

Instructure Global Ltd
New Penderel House, 4th Floor
283-288 High Holborn
London WC1V 7HP
Phone: 0800 358 4330

If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, you may also contact our U.S.-based third party dispute resolution provider (free of charge) at https://feedback-form.truste.com/watchdog/request. 

17. CHANGES TO THIS PRIVACY POLICY. Instructure may change this Privacy Policy from time to time. If we make any changes to this Policy, we will change the “Last Updated” date above. We encourage you to visit this page from time to time for the latest on our privacy practices.

0