The GL Education Group Data Privacy Notice 

At GL Education Group Limited ("we", "us") we value the privacy of all our customers. We recognise that when you choose to provide us with information about yourself, you trust us to act in a responsible manner. We believe this information should only be used to help us provide you with a better service. We will only collect and use Personal Data in ways that are described in this Privacy Notice (“Notice”), and always in compliance with ourobligations and your rights under the law.

This Notice sets out how we treat your Personal Data in the provision of our services, however that Personal Data in collected. We display separate privacy notices on each of the websites we operate and for each platform you may use (e.g., Testwise privacy notice and GL-Ready privacy notice). We ask that you also read those other privacy notices when you make use of our services provided through those websites and platforms. 

Our website may provide links to third-party sites. Since we do not control those third-party sites and have no control over how your data is collected, stored, and used by them, we advise you to review the privacy notices of such sites before providing your data to them.

About us

GL Education Group is a Limited Company registered in England and Wales under company number 02603456.

Registered address: 1st Floor, Vantage London, Great West Road, Brentford, TW8 9AG

Telephone number: +44 (0)20 8996 3369

Data Protection officer: Karl Oertel

Email address:  [email protected]

In this Notice, reference to Data Protection Legislation means the Data Protection Act 2018, the General Data Protection Regulation (“the GDPR”), and the Privacy and Electronic Communications Regulations 2003.

What is Personal Data?

‘Personal Data’ is defined by the GDPR as: “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”

In simpler terms, Personal Data is any information about you that enables you to be identified. For example, this could be your name or contact details.

Scope

The GL Education Group routinely receives both organisational and Personal data in order to provide the products, services and reporting required by our customers and partners. It also receives similar data to underpin a range of research and development activity conducted for commercial and non-commercial purposes at the GL Education Group.

This Notice is intended to give reassurance to those providing Personal Data to the GL Education Group, by explicitly stating how such data is collected, stored, and accessed according to Data Protection Legislation. 

The GL Education Group complies fully with the ISO/IEC 27001 international standard regarding information security management, the highest standard in industry specifically for data security. At the GL Education Group, this standard is maintained for all online resourceswhich includes Testwise, the GL Education Group’s online testing system, the Testwise Reporting System, and our SEN testing platform (GL Ready). 

Introduction

The GL Education Group provides a rich collection of resources, including the ability to set up and administer various tests online, allow test takers to complete tests online and on paper, alongside associated marking and scoring services and to view reports on test performance and other relevant sets of data about tests and test takers (the “Service”). 

The Service is provided for those using our published products as well as those who have given explicit permission to participate in any research and development the GL Education Group is undertaking, including pre-published trial activity carried out as part of the development of our products (the “Research”). The latter is governed by our research code of practice (the “Code”) which is available on request. 

As part of the Service, organisations will choose and consent to the provision of organisational and Personal Data through the uploading of relevant information to the GL Education Group. In doing so, the GL Education Group acknowledges that the ownership of the Personal Data remains with the administrating organisation. All requests to share Personal Data with other non-fee-paying organisations will only be done on receipt of a certified permission form, for example where a school explicitly requests the GL Education Group to facilitate sharing of the school's Personal Data with other schools or organisations.

The Service may include certain communications from the GL Education Group, such as service announcements and administrative messages, and these communications are considered part of the Service subscription, and it will not be possible to opt out of receiving such notifications. The GL Education Group undertakes to limit such communications as much as possible.

Collection and use of Personal Data

The Personal Data provided by organisations helps to personalise and continually improve the Service offered. We use any Personal Data provided to help administer accounts, and to continuously refine the reliability and ease of use of the Service. We also use this information to help develop new services. We use the Personal Data provided to process an individual test and to process reports on tests. We also use this Personal Data to improve the platform, prevent or detect fraud or abuses of our website and enable third parties to securely carry out technical, logistical or other functions on our behalf.

• We maintain physical, electronic, and procedural safeguards in connection with the collection, storage, and disclosure of Personal Data. Our security procedures mean that we may occasionally request proof of identity before we disclose Personal Data to you.
• It is important for you to protect against unauthorised access to your password and to your computer. You should be sure to sign off when you finish using a shared computer.
• Organisations have access to a broad range of information about their accounts and interactions. On request, any user whose Personal Data we hold may request a copy of that information. In addition, on request, we will anonymise, amend, or erase any Personal Data we hold in relation to a user. Students can typically not access their own personal details since this may include assessment results but on request a suitably qualified system Administrator (typically an administrator or teacher at their school) can access this information on their behalf.
• Data will be accessible for the duration of the current academic year, or the past six months, whichever is longest, at which stage all data is archived from live access.
• Archived data will be deleted at regular intervals (typically 24 months) so it will only be held for the minimum time required.

Data controller/ Data processor

Our products are predominantly used by schools, Local Education Authorities (LEAs), hospitals and other learning institutions (each an “Education Institution”).

For the purposes of the Data Protection Legislation:

• where we process Personal Data on behalf of an Education Institution (e.g., student or parent data), the relevant Education Institution is the data controller and GL Education Group Limited is the data processor; and
• where we process the Personal Data of someone who uses or orders our products or services for or on behalf of an Education Institution or for some other professional purposes (e.g., home based specialist teacher/tutor or clinical psychologist), GL Education Group Limited is the data controller.

This Notice only applies to Personal Data that we collect and process as data controller.

What Personal Data do we collect?

Information you give us: We collect Personal Data from you when you create an account on our platform, when you make a purchase with us or in any other way that you chose to provide us with your Personal Data. 

The Personal Data you give us may include (but is not limited to):

• Contact details: your name, email address, telephone number and address
• Financial and payment details: We will collect details of your bank account and other data necessary for processing payments including credit/debit card numbers, security code numbers and other related billing information.
• Other Personal Data: We may collect further Personal Data such as (if you are purchasing on behalf of a school or other organisation) your job title, your role in the organisation and your qualifications. There are occasions when we will ask for additional information. We do this to be able to better understand your needs, and to provide you with services that we believe may be valuable to you. (It is important that your Personal Data is kept accurate and up to date. If any of the Personal Data wehold about you changes, please keep us informed)

Information collected automatically: 

We receive and store certain types of information whenever you interact with us. For example, like many websites, we use “cookies”, and we obtain certain types of information when your Web browser accesses our websites. We also collect the Internet protocol (IP) address used to connect your computer to the Internet, login, email address, password, computer, and connection information such as browser type and version, your operating system and platform. We also analyse other aspects of your system like plugins and plugin version that may affect how our platforms performs. This data helps us to support you with any problems or issues you might experience when using our platforms. For more information, please refer to our Cookie Policy.

Email communications: to help us make emails more useful and interesting, we often receive a confirmation when you open email from www.gl-assessment.co.uk if your computer supports such capabilities.

We collect Student Personal Data from you and process this under your instructions. The Personal Data you provide on the platforms relating to Students includes (but is not limited to): Name, age, gender, unique pupil number, assessment results, observations about students’ performance in tests, the environment during tests and any other relevant information, for example, any illness of a student prior to or during the testing, ethnic and socio-economic information – this data can be provided to us by schools as part of the assessment setup and our platforms can analyse ethnic and socio-economic information enabling schools to understand particular needs and focus among specific ethnic or socio-economic groups.

As part of its wider research focus and to improve future products The GL Education Group may use historic results data as part of its further analysis of historic trends and changing Assessment requirements.Such data may be derived from your Personal Data, but once in aggregated form it will not constitute Personal Data for the purposes of the GDPR as this data does not directly or indirectly reveal your identity. 

What is our lawful basis for using your Personal Data?

In respect of each of the purposes for which we use your Personal Data (described in the next section), the GDPR requires us to ensure that we have a ‘lawful basis’ for that use. Most commonly, we will rely on one of the following lawful bases:

• Where we need to use your Personal Data to deliver our Service to you (including creating an account, accessing our website and mobile apps, or using our products) (“Contractual Necessity”).
• Where we need to use your Personal Data for our legitimate interests, and your interests and fundamental rights do not override those interests (“Legitimate Interest”).
• Where we need to use your Personal Data to comply with our legal or regulatory obligations (“Compliance with Law”).
• Where we have your consent to use your Personal Data for a specific purpose (“Consent”).

How do we use your Personal Data?

We have set out below, in a table format, the purposes and applicable lawful bases we rely on when we use your Personal Data.

International data transfers

The Personal Data that we hold will not be stored at a destination outside the United Kingdom or the European Economic Area (“Europe”). 

Nevertheless, your Personal Data may sometimes need to be shared with a third-party recipient located outside of Europe or may otherwise need to be accessed outside of Europe. For example, some of our affiliates, partners and external third-party suppliers are based outside Europe, so their processing of your Personal Datamight involve transferring your Personal Data outside Europe.

Where we share your Personal Data with third parties who are based outside Europe, we try to ensure a similar degree of protection is afforded to it by making sure one of the following mechanisms is implemented:

• Transfers to territories with an adequacy decision. We may transfer your Personal Data to countries or territories whose laws have been deemed to provide an adequate level of protection for Personal Data by the relevant European authorities.
• Transfers to territories without an adequacy decision. We may transfer your Personal Data to countries or territories whose laws have not been deemed to provide an adequate level of protection for Personal Data by European authorities. However, in these cases, we will use specific appropriate safeguards, approved by relevant European authorities, which are designed to give your Personal Data the same protection it has in Europe – for example, requiring the recipient to enter into the relevant form of the so-called ‘Standard Contractual Clauses’ or ‘International Data Transfer Agreement’ issued or approved from time to time.

Should you wish to find out more about these controls and safeguards, please contact us.

Sharing of Personal Data

The table below describes who we share your Personal Data with, and why we share it.

Protecting your Personal Data

We have put in place appropriate security measures to prevent your Personal Data from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. We limit access to your Personal Data to those employees and other staff who have a business need to have such access. All such people are subject to a contractual duty of confidentiality.

We have put in place procedures to deal with any actual or suspected Personal Data breach. In the event of any such breach, we have systems in place to work with applicable regulators. In addition, in certain circumstances (including where we are legally required to do so), we may notify you of breaches affecting your Personal Data.

Data retention

We retain your Personal Data for as long as necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, accounting or reporting requirements, to establish or defend legal claims, or for fraud prevention purposes.

To determine the appropriate retention period for your Personal Data, we consider the amount, nature and sensitivity of the relevant data, the potential risk of harm from unauthorised use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Anonymised data

We may use information relating to Students and schools in anonymised format to produce reports that we produce and share with third parties. These reports would, for example, be comparable reports about the type of organisation (for example, type of school, % of students with different languages) and their performance. No Student User or school would be identifiable in such reports. 

What are your rights?

Under the Data Protection Legislation, you have the following rights:

• Request access to your Personal Data. This enables you to receive a copy of the Personal Data we hold about you, and to check that we are lawfully processing it.
• Request the correction of your Personal Data. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request the erasure of your Personal Data. This enables you to ask us to delete or remove Personal Data where there is no good reason for us continuing to process it. This may not always be available.
• Object to our processing of your Personal Data. This right exists where we are relying on Legitimate Interest as the legal basis for our processing, and there is something about your particular situation which makes you want to object to our processing on this ground.
• Request the restriction of our processing of your Personal Data. This enables you to ask us to temporarily suspend the processing of your Personal Data, for example if you want us to establish its accuracy or our reason for processing it.
• Request the transfer of your Personal Data. This enables you to ask us to provide to you, or a third-party you have chosen, your Personal Data in a structured, machine-readable format.
• Withdraw consent. This enables you to withdraw your consent. This right only exists where we are relying on Consent as our lawful basis to process your Personal Data.

If you want to exercise any of the rights described above, please contact us.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your Personal Data. This is a security measure to ensure that your Personal Data is not disclosed to any person who has no right to receive it.

Typically, you will not have to pay a fee to exercise your rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. We may also refuse to comply with your request in limited circumstances.

We try to respond to all legitimate requests within a month. It may take us longer than a month if your request is particularly complex or you have made a number of requests; in this case, we will notify you and keep you updated.

Please note that applicable law may require or permit us to decline your request. If we decline your request, we will tell you why, subject to legal restrictions.

Complaints

If you would like to make a complaint regarding this Notice or our practices in relation to your Personal Data, please contact us. We will reply to your complaint as soon as we can.

If you feel that your complaint has not been adequately resolved, please note that applicable privacy law gives you the right to contact your local data protection supervisory authority.

Operating Systems

Our platforms operate on the Microsoft Windows™ operating system and can only be accessed by a small number of approved staff members at the GL Education Group’s Technical Development site. This number can change but is usually limited to a small core maintenance team responsible for monitoring and ensuring systems are online at all required times. Access is only possible using an account login and password and all access attempted is logged in real time. Access from any other location other than the GL Education Group’s Technical Development office is only possible once senior management permission has been granted (via an authorisation process) and only then is it implemented by the GL Education Group’s Technical Development office.

Databases

Our platforms use Microsoft SQL Server™ databases, where all data pertaining to registered test takers to take the GL Education Group tests and their test results are stored. Like its operating system, the databases can only be accessed by a very small number of approved staff members at the GL Education Group’s Technical Development site. Access is only possible using an account login and password and all attempted access is logged in real time. Access from any location other than the GL Education Group’s Technical Development office is only possible once senior management permission has been granted (via an authorisation process) and only then is it implemented by the GL Education Group’s Technical Development office.

Infrastructure

The platforms’ infrastructure is protected by multiple firewalls that can only be accessed from the GL Education Group’s Technical Development office using a secure login and password made available only to the network administrator and a very small technical team. 

The servers hosting our platforms are located in either EEA based Microsoft Azure™ or Amazon Web Services (AWS) environments. Only a small number of the GL Education Group’s technical team are able to access the environments. Permission to access the environments must be gained in advance from company directors and all access is logged and recorded. All back up routines for data recovery are also hosted within the EEA based Microsoft Azure™ or Amazon Web Services (AWS) environments.

User interface – organisations

Access to each customer account is only possible using the administrator password that is set by the school administrator. Only once access has been successfully gained can test taker data be viewed, altered, or added. It is the responsibility of the school to safeguard the administrator password which is not made known to the GL Education Group.

Administrator passwords can be changed by the administrator as often as required. However, in line with ISO 27001 requirements, administrators are encouraged to change passwords at least once every 6 months. Should an invalid administrator password be entered into a customer account three times in succession, the account will automatically be suspended for a configurable period of time, which is set to 5 minutes by default.

User interface – test takers

A test taker accessing the testing platformswill only be able to take any outstanding tests set for him or her. It is not possible for test takers to view their own test scores or the data and scores of any other test takers. Test taker access codes are created by the system and will be unique to each test taker.

User interface – GL Education Group staff

No member of the GL Education Group staff can routinely log into an organisation’s or test taker’s account on our platforms. Only in very rare and exceptional circumstances is this allowed to happen on verification of received consent from an organisation, and the purpose of the access is purely to support that organisation with a technical query or data request. In this instance, any access to the data is tracked and a detailed audit log, together with the exceptional circumstances instigating the access, is shared with company directors at the GL Education Group.

Changes to this Notice 

We may change this Notice from time to time. This may be necessary, for example, if the law changes or if we change our business practices in a way that affects how we collect or use your Personal Data. 

Any changes will be made available on this site.

Contact

If you have any further queries regarding this Notice, please contact our Data Protection Officer at: [email protected].