examday

1. Who we are

ExamDay (“ExamDay”, “we”, “us” or “our”) is an independent revision service. ExamDay provides free revision for GCSE, A level and university admissions tests through examday.co.uk and its subdomains (together, the “Service”).

For the purposes of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, we are the controller of the personal information described in this notice. You can contact us about anything in this notice at [email protected].

2. The information we collect

Information you give us

• Account details: your email address and, if you sign up with an email address, a password. We store only a secure, one-way hash of your password, never the password itself.
• Your exam choices: the exams and qualifications you tell us you are revising for.
• Your revision: the questions you attempt and your answers, papers and topics you mark as done, scores you record, bookmarks and notes you write.
• Reports and messages: the content of any report you make about a question and any message you send us.

We do not ask for your name, date of birth, school, address or phone number, and we ask you not to include personal details in notes or reports. We do not knowingly collect special category information (such as information about health or religion).

Information from Google

If you choose to sign in with Google, Google tells us your email address, that it has verified that address, and an identifier for your Google account. We do not receive your Google password or access to anything else in your Google account.

Information collected automatically

• Sign-in sessions: when you sign in we record when, which of our sites you signed in on and the browser and device type your browser reports (its “user agent”), so that you can see and end your sessions.
• Security and abuse prevention: your IP address and a random identifier stored in a cookie, used to limit repeated sign-in attempts and to stop automated copying of our past-paper libraries. This includes a short-lived record of which past papers have been opened.
• Server logs: like most websites, our servers record technical information about requests (such as IP address, the page requested, the time and the browser type) to keep the Service running and secure.

We do not use analytics services, tracking pixels or social media plugins, and we do not collect your precise location. The ads on pages for browsing past papers come from Google (see Cookies).

3. How we use it, and our lawful bases

Data protection law requires us to have a lawful basis for each use of your personal information. These are ours:

Where we rely on legitimate interests we have balanced them against your rights, taking particular account of the fact that many of our users are under 18. You can object to any use based on legitimate interests (see Your rights).

We do not send marketing emails. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. The only automated decisions we make are security measures, such as temporarily limiting access after too many sign-in attempts or after unusually rapid downloading; these are temporary, and you can contact us if you think one has been applied to you wrongly.

4. Children and young people

ExamDay is designed for students, many of whom are under 18. You must be at least 13 years old to create an account. If we learn that we hold the personal information of a child under 13 who has an account, we will delete it.

Because the Service is likely to be used by children, we follow the Information Commissioner’s Office Age Appropriate Design Code (the “Children’s Code”) for all users. In particular:

• we collect only the information we need to provide the features you use, and settings are private by default;
• the ads we show are not personalised and never appear while you work through questions; we do not profile users for marketing, and we do not sell or share personal information for those purposes;
• we do not collect precise location information;
• we do not use design techniques intended to encourage you to share more information or to weaken your privacy.

If you are a parent or guardian and have a question about a child’s information, or would like it deleted, please contact us at [email protected].

5. Cookies and storage on your device

Cookies are small files stored by your browser. We use only cookies, and similar storage, that are strictly necessary to provide the Service you ask for or to keep it secure, or that remember a choice you have made. Under the Privacy and Electronic Communications Regulations 2003 (“PECR”) these do not need your consent, but we tell you about each one:

These are the only cookies we set ourselves. We do not use analytics cookies. You can block or delete cookies in your browser settings, although signing in will not work without the session cookie.

Advertising

Pages for browsing past papers show ads served by Google AdSense: one below the page and, on wide screens, one in each margin beside it. Pages where you work through questions never show any. We ask Google for ads that are not personalised: they are chosen from the page you are on, not from what you have browsed elsewhere. Google may still use cookies or similar storage on those pages, for example to limit how often you see the same ad and to detect fraud. Where the law requires your consent for this, Google’s consent message asks for it first, and you can change your choice at any time with “Privacy and cookie settings” at the foot of any page. To learn more, see how Google uses information from sites that use its services.

6. Who we share information with

We do not sell your personal information. We share it only as follows:

• Service providers who process it on our behalf, under written contracts that require them to keep it secure and use it only on our instructions: the company that hosts our servers, our email delivery provider (for sign-in codes and account emails) and Cloudflare, Inc. (which stores and delivers files and may protect our sites from attacks).
• Google, if you choose to sign in with Google. Google’s use of information is governed by its own privacy policy.
• Google, which serves the ads on pages for browsing past papers. Your browser sends Google the information any web request carries (such as your IP address and the page’s address), and Google may read the cookies described in Cookies. Google’s use of information is governed by its own privacy policy.
• Professional advisers, such as lawyers and accountants, where necessary and under a duty of confidentiality.
• Law enforcement, regulators and others where the law requires it, or where it is necessary to protect someone’s safety or to establish, exercise or defend legal claims.
• A successor, if ExamDay or its assets are transferred to another organisation, which will be bound by this notice. We will tell you before that happens.

7. International transfers

Some of our service providers, including Google and Cloudflare, are based in, or process information in, the United States and other countries outside the UK. Where personal information is transferred outside the UK, we make sure it is protected by one of the safeguards UK law requires: a country the UK has found to provide adequate protection (including the UK Extension to the EU–US Data Privacy Framework, for certified US organisations), or the International Data Transfer Agreement or Addendum approved by the Information Commissioner. You can ask us for details of the safeguard that applies.

8. How long we keep information

We keep personal information only for as long as we need it for the purposes described in this notice:

We may keep information for longer where the law requires it, or where it is needed for a legal claim.

9. How we protect information

We use appropriate technical and organisational measures to protect personal information. These include encrypting information in transit (HTTPS), storing only hashed passwords and session tokens, limiting access to personal information to people who need it, and limiting repeated sign-in attempts. No service can be completely secure; if you think your account has been compromised, change your password and use “Sign out everywhere” on your Account page, and tell us.

If a personal data breach occurs that is likely to result in a risk to your rights, we will report it to the Information Commissioner’s Office within 72 hours, and tell you without undue delay where the law requires it.

10. Your rights

Under UK data protection law you have the right to:

• access the personal information we hold about you and receive a copy of it;
• rectification of information that is inaccurate or incomplete;
• erasure of your information (the “right to be forgotten”);
• restrict how we use your information;
• object to our use of your information where we rely on legitimate interests;
• data portability: to receive information you gave us in a structured, machine-readable format;
• withdraw any consent you have given, at any time, without affecting what was done before.

You can exercise several of these yourself on your Account page: download your information, change your exam choices, end your sign-in sessions and permanently delete your account. For anything else, email [email protected]. If you are under 18, you can exercise these rights yourself, and a parent or guardian may also act on your behalf.

We will respond within one month. We may need to confirm your identity first, usually by asking you to write from the email address on your account. We do not charge a fee unless a request is manifestly unfounded or excessive.

11. Complaints

If you are unhappy with how we have handled your personal information, please contact us first at [email protected] and we will try to put it right. You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection: ico.org.uk/make-a-complaint, or by telephone on 0303 123 1113.

12. Changes to this notice

We may update this notice from time to time, for example when we add features. The date at the top shows when it last changed. If we make significant changes, we will tell account holders by email or on the Service before they take effect.

13. Contact us