OVERVIEW
Bigbluebutton Host (Bymond Private Limited). (“We”) provide hosting for BigBlueButton to education and commercial organizations for using BigBlueButton. Our goal is to enable remote users to have a high quality online learning / meeting / conferencing experience.
We take the privacy of your personal information very seriously.
Together with our Privacy Policy (available at https://bigbluebutton.host/privacy-and-policy ), this document will help you better understand the personal information we collect, why we collect it, how we use it, and how we protect it. In full compliance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), which comes into effect May 25, 2018, this document also explains the various rights of the data subject, including the right of access and the right to erasure (aka “the right to be forgotten”). In full compliance with the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g; 34 CFR Part 99 (“FERPA”), this document also confirms our compliance with, and support of, FERPA.
HOSTING FOR BIGBLUEBUTTON
BigBlueButton is a web conferencing system designed for online learning. It enables students and instructors to collaborate in real-time. This collaboration includes sharing one or more of audio, video, slides, chat, screen, emojis, and responding to polls. The collaboration may also be recorded.
We provide managed hosting of this entire system which can be used from the LMS or Front-ends through API or Plugins .
GRANT OF CONSENT
The majority of users access BigBlueButton through a learning management system (LMS) such as Schoology, Canvas, Sakai, Moodle, Atutor, etc. We collectively refer to these systems as a “Front End”.
The LMS is hosted by an organization (such as a educational institution or commercial company) you may be enrolled in the organization as student or work there as a employee. Consistent with GDPR, we refer to these organizations (aka our customers) as the “Data Controller”. You may access BigBlueButton via a tool or plugin embedded in the Front End; in this regard, we are a “Data Processor”
Each Front End has its own Terms of Use which you either accepted directly (when you initially logged into the LMS) or were asked to accept by us, on behalf of the LMS. In accordance with these terms of use and consistent with our Privacy Policy, you gave the LMS and us permission to collect, use and share your personal information.
OUR COLLECTION AND USE OF YOUR PERSONAL INFORMATION
We capture personal information when you login to BigBlueButton ( Usually rebranded as Data Controller’s brand or identity ) and when you share information during a live session (such as an online class). Furthermore, if the session is recorded, then personal information may also appear in the subsequent recording (such as your chat messages).
WHAT HAPPENS WHEN YOU LOGIN?
When you login to BigBlueButton through a Front End, we receive (at minimum) two pieces of information: your full name and an ID (this is a unique identifier internal to the Front End).
We also receive additional information during the join process, which may include:
- A URL back to the Front End (this enables BigBlueButton to return you back to the Front End after you log out);
- The associated course ID/name (this is usually embedded in the Logout URL); and
- Your IP address, browser, and OS in our web server logs.
We use this additional data to provide you support (such as troubleshooting a support ticket to see if your browser is out-of-date) and for creating usage reports that we make available to the Data Controller.
WHAT DATA DO WE RECEIVE WHEN YOU PARTICIPATE IN A MEETING?
During a live meeting, you may exchange audio, video, slides, desktop, chat, and emoji icons, responses to polls, closed captioning, and whiteboard annotations, and other content during a session. We collectively refer to this content as “Meeting Data”.
The BigBlueButton client sends/receives Meeting Data to the server via encrypted channels (RTMPS, HTTPS, and DTLS).
WHERE DO WE STORE MEETING DATA?
Not all Meeting Data is stored. Storage of the Meeting Data depends on whether (a) the meeting was recorded, and whether (b) the moderator (usually the instructor) marked any segments of the meeting for later processing into a recording for playback.
Generally speaking, there are usually three cases for the storage of Meeting Data:
Case 1 : For an unrecorded meeting, we do not store any Meeting Data on the BigBlueButton server after the meeting finishes.
Case 2 : For a recorded meeting without Start/Stop record marks, we store the Meeting Data on the BigBlueButton server for 14 days, after which it is automatically deleted.
Case 3: For a recorded meeting with Start/Stop record marks, we still store the Meeting Data on the BigBlueButton server for 14 days (after which it is automatically deleted); however, the BigBlueButton server also compresses the Meeting Data (“Compressed Meeting Data”) and uploads it to our hosting infrastructure where it is processed into a recording that you can later view by clicking a URL (a “Recording Link”) in the Front End.
The actual recording may include more than one format, such as a video file or an HTML5 page that summarizes user statistics for the session (“Meeting Statistics”).
The Meeting Statistics gives the instructor the ability to gauge and measure of participation in the class. This data includes:
- User Name
- isModerator (true/false)
- Number of times chatted
- Number of times talked
- Number of times shared emoji
- Number of times raised hand
- Response to polls
- Total time talking
- Total time in session
- Join date/time
- Leave date/time
In Cases 2 and 3, depending on the location of the customer(Data Controller), we store the Meeting Data in Cloud Resources in one of the regions: Asia(India , Singapore) , US , Europe (Germany), Australia , Canada . For example, the storage of Meeting Data for a customer based in the European Union is the Data center in Germany . For greater clarity, customers in the EU always have their Meeting Data hosted on servers located in the EU.
FOR HOW LONG DO WE STORE MEETING DATA?
For some customers, we automatically delete their Meeting Data (and any associated recordings) within 7 or 14 days. For others, we delete their Meeting Data only upon request by the instructor (using a “delete recording” button in the Front End).
Mostly Meeting Data is deleted & managed by the Data Controller themselves from the Front-End LMs or Dashboards . Or we may process the batch request from them to delete multiple recordings or data at once If a Data Controller ceases to be a customer, we delete all recordings and data associated with the customer within 90 days of the end of their contract with us.
HOW DO WE RESTRICT ACCESS TO MEETING DATA?
For access to live meeting sessions, users can only login via the Front End or by invitation from a moderator (a guest link).
For access to a Recording Link, users can login via the Front End to access the link.
Generally speaking, Recording Links are static and can be shared with others but previously shared recordings can be marked Inaccesible to restrict the further access . Or Recording can be downloaded as MP4 and shared to specific persons .
While we can’t prevent a user from recording their screen while watching a recording, with Restricted Recording Links, we’ve made it more difficult for users to casually share a recording that might include your personal information.
WHAT INFORMATION DO WE RETAIN FOR SUPPORT PURPOSES AND FOR HOW LONG?
As described above, we capture user metrics and logs during a session to better enable us to provide customer support. BigBlueButton servers record metrics for each meeting and for each user in a meeting (“Support Data”).
We use this Support Data to resolve support issues such as:
- Diagnosing login issues in a meeting
- Diagnosing audio quality issues for users in a meeting
- Locating and recovering an accidentally deleted recording (if it was accidentally deleted within 14 days of the origin of the meeting).
This Support Data includes:
- Full Name
- Browser
- Operating system
- Start time
- Length of time in session
- Three octets of the user’s IP address (e.g. 192.168.0.)
- % of audio packets dropped
- # of times reconnected
- Connectivity logs generated by the BigBlueButton client (these logs specify when network connections are created/dropped to by the BigBlueButton client to the BigBlueButton server).
- Any feedback provided by the user on their experience using BigBlueButton when the session ends
We store all Support Data on servers in Germany
If a Data Controller ceases to be a customer, we delete all Support Data associated with the customer within 90 days of the end of their contract with us.
HOW DO WE SECURE OUR INFRASTRUCTURE?
We adhere to a number of industry best practices for securing our infrastructure, which include:
- We restrict access to all servers containing personal information to only a few employees in the company.
- We disable password access to all servers (access is only through revocable keys).
- All servers are regularly updated with the latest security patches.
- All employees are trained on our privacy policy.
- We annually contract for penetration testing performed by a 3rd party on our infrastructure and also we encourage our Business clients to perform testing from their end as well .
WHO IS THE DATA PROTECTION OFFICER (DPO) FOR BIGBLUEBUTTON HOST?
The DPO is Pritam Nanda , CEO of Bymond Private Limited ( Bigbluebutton Host ) . You can contact him at [email protected] .
HOW CAN YOU REQUEST ACCESS TO YOUR PERSONAL INFORMATION?
We recommend you first contact the Data Controller (the organization providing the Front End for accessing BigBlueButton). You may request a full report on the personal information we hold for you by sending an e-mail to [email protected] . In the subject line, please indicate “Request for Personal Information”. In your email, please specify:
- Your full Name
- Whether you are an individual or a representative of a Data Controller
- If you are an individual, the name of your Data Controller (the organization providing you access to BigBlueButton)
Please note that will will need to share your request with the Data Controller to verify and action it. We will endeavor to fulfill all access requests within 30 days of receipt.
HOW CAN YOU REQUEST DELETION OF YOUR PERSONAL INFORMATION?
We recommend you first contact the Data Controller (the organization providing the Front End for accessing BigBlueButton). You may request deletion of personal information by sending an e-mail to [email protected]. Use the subject “Request for Deletion” In the subject line, please indicate “Request for Deletion”. In your email, please specify:
- Your full Name
- Whether you are an individual or a representative of a Data Controller
- If you are an individual, the name of your Data Controller (the organization providing you access to BigBlueButton)
Please note that will will need to share your request with the Data Controller to verify and action it. We will endeavor to fulfill all access requests within 30 days of receipt.
Usually most of your Personal Data are saved into the LMS or Front-end when you Sign Up & Create an account under your Organization’s control (we call Data Controller) , we only hold the Meeting Data which is also controlled by the Organization or Data Controller . So either it is Personal Data or Meeting Data is collected , saved , controlled by the “Data Controller” in order to provide you the service . We only process the data in between on behalf of the “ Data Controller “ .
HOW CAN YOU CONTACT US?
If you have any questions about this document or our support for GDPR or about our Privacy Policy, please contact us directly at [email protected].
SUBPROCESSORS FOR GDPR
Digital Ocean , Amazon Web Services
Last Updated : 1st April 2022