Asia-Pacific
(APAC) Region
Product Privacy
Notice Addendum

1. Definitions.

In this Addendum, the following terms shall have the following meanings:

“Applicable Data Protection Laws” means any laws which regulate personal information in your jurisdiction.

“Asia-Pacific” means the nations included in the regions as defined by the United Nations.

“Personal information” and “sensitive information” (or like terms) are as defined in your jurisdiction and are used in our Privacy Notice and this Addendum.

2. Consent.

To the extent that you are required to comply with any Applicable Data Protection Laws, you consent to us collecting, using and disclosing your personal information in accordance with this Privacy Notice. 

3. Consequences of Non-Disclosure.

If you do not agree to the terms of the Privacy Notice or this Addendum, you can choose not to use our products and services, or you can decide not to disclose your personal information to us.  If you do not provide us with your personal information, we may be unable to grant you access to our services or you may not be able to use our services properly.

4. Cross-Border Data Transfer.

The Instructure head office is located in the United States. We also operate offices and engage service providers in other countries.  We may transfer your personal information from your country to the United States, and other countries where we engage service providers. 

5. Exercising Your Rights.

If your jurisdiction’s Applicable Data Protection Laws give you rights to access or correct your personal information, then you may request that we provide you with access to, or correct any inaccuracies in any of your personal information we hold about you. You may exercise these rights or withdraw your consent by following the procedures set out in section VI of our Privacy Notice. Alternatively, you may contact our privacy team at privacy@instructure.com or using the contact information set out in Section IX of our Privacy Notice. 

We may request specific information from you to help us confirm your identity and process your request. Applicable Data Protection Law may require or permit us to decline your request.  If we decline your request, we will tell you why, subject to legal restrictions.  

Typically, you will not have to pay a fee to exercise any of the rights listed above. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive.

Please note that where your Academic Institution provides us with your personal data, we may be considered a data intermediary which processes that data on behalf of your Academic Institution in your particular jurisdiction. This means that your Academic Institution remains responsible for providing you with access to that data, for the correction of any inaccuracies, and for assisting you where you wish to withdraw consent to the processing of your personal data. Where this is the case, you may need to contact your Academic Institution to exercise your rights in relation to your personal data. 

6. Children.

Applicable Data Protection Laws (or a regulator in your jurisdiction) may specify the age at which children in your jurisdiction have the capacity to provide consent to the collection of their personal information. Except for authorised users of Canvas LMS or Mastery Connect, if you learn that a child under the applicable age of consent in your jurisdiction has provided us with personal information, please alert us at privacy@instructure.com.

7. Complaints.

If you would like to submit a complaint about our use of your personal information not being in accordance with Applicable Data Protection Laws, you may contact us using the details specified in Section 9 of our Privacy Notice.

8. Interpretation.

In case of any conflict between the Privacy Notice and the terms of this Addendum, this Addendum shall prevail. Unless otherwise defined in this Addendum, all capitalised terms or other defined terms shall have the same meanings assigned to them in the Privacy Notice.