1. Who this notice is for
This Privacy Notice is for adult account holders, parents and guardians acting for children, tutors using EBA professionally, and authorised organisation administrators. A child remains the person that child-profile information is about, even where an adult manages the profile or makes a request for the child.
A shorter explanation for child users is available on our Privacy for children page.
2. Who is responsible
KVASIR TUTELAGE LIMITED, trading as Exam Bytes Academy, is the controller of personal information used to operate the EBA platform.
Company number: 13090072. Registered office: 127 Conisborough Crescent, London, SE6 2SQ, England. Privacy contact: support@exam-bytes.co.uk.
A tutor, school, tuition provider or other organisation may be a separate controller for information it collects or keeps outside EBA. EBA does not currently sell paid organisation plans.
3. Information we collect
| Category | Examples |
|---|---|
| Adult account | Name, email, authentication details, role, settings, accepted legal-document versions, support messages and account relationships. |
| Child profile | Name or nickname, age or school-year range, linked adults, approved tutor or class connections, settings, avatar and leaderboard choices. |
| Learning activity | Answers, scores, accuracy, response time, completed activities, attempts, levels, assignments, progress, personal bests, rewards and recommendations. |
| Tutor and administration | Classes, invitation or join information, approvals, revoked connections, assignments, reviews, class progress and organisation-management relationships. |
| Payment | Plan, trial and subscription status, billing dates, Stripe customer or transaction identifiers, refunds and payment outcome. Stripe handles full card details. |
| Technical and security | IP address, device, browser, session identifiers, login and access logs, error records, cookie choices and fraud or security signals. |
| Human-supported services | Meeting bookings, attendance, information supplied for EBA Maths Strategy, meeting notes and documents prepared for the family. |
4. Where information comes from
Information comes from the adult account holder, child activity, approved tutors or administrators, Stripe and other service providers, and EBA’s own security and technical systems. A tutor may submit assignments or reviews only for an approved connection.
5. Why we use information and lawful bases
| Purpose | Typical lawful basis |
|---|---|
| Create accounts, profiles, classes and approved connections; provide practice, reports and support. | Contract with the adult account holder and legitimate interests in providing the requested child-appropriate service. |
| Process free trials, subscriptions, refunds and payment status through Stripe. | Contract and legal obligations relating to accounts, tax and financial records. |
| Personalise starting stages, difficulty and next activities. | Legitimate interests in delivering the core adaptive practice service, assessed against the child’s rights and best interests. |
| Provide meetings and documents included in EBA Maths Strategy. | Contract and legitimate interests in administering and documenting the requested service. |
| Protect accounts, prevent fraud, apply role permissions and investigate misuse or safeguarding concerns. | Legitimate interests, legal obligation and, in urgent cases, vital interests. |
| Improve reliability, fix errors and understand use. | Legitimate interests for necessary service information; consent for non-essential analytics or similar technologies where required. |
| Handle support, rights requests and complaints. | Contract, legal obligation and legitimate interests. |
| Send optional marketing to adults. | Consent where required. Marketing is not directed to child profiles. |
6. Children and adaptive practice
EBA uses answers, accuracy, response time, completed activities and previous results to estimate a suitable starting point, adjust difficulty and recommend a next activity. This is automated processing and may be profiling for service personalisation.
It is used to deliver the practice service, not to target advertising, decide school entry, award a qualification or make another legal or similarly significant decision. Parents and approved tutors can review progress and contact EBA if data appears wrong or a recommendation seems unsuitable.
EBA does not sell child-profile or learning information and does not use practice history to create a third-party advertising profile for a child.
7. Parents, tutors, administrators and leaderboards
- An authorised parent or guardian can see and manage the child profiles linked to their account.
- A tutor connection becomes active only after both the parent or guardian and tutor approve it. Either can revoke it.
- An approved tutor sees only the class-scoped information made available through that connection.
- An authorised organisation administrator may manage multiple tutors or children where the feature is available and must have authority for every relationship shown.
- Removing a connection stops future access through EBA but cannot erase information a tutor or organisation lawfully keeps outside EBA.
- Where a leaderboard is enabled, the audience stated in the setting may see a nickname, avatar, score, rank or achievement. Child profiles should not use a full legal name for public display.
8. Service providers, disclosure and international transfers
EBA uses providers for hosting, databases, authentication, Stripe payment processing, email, error monitoring, customer support, security, backups and business administration. Providers may process information only for the contracted purpose and under appropriate data-protection terms.
Some providers may store or access information outside the UK. Where this is a restricted transfer, EBA uses an available lawful mechanism, such as UK adequacy regulations or appropriate contractual safeguards, and completes any required transfer assessment.
EBA may also disclose limited information where required by law, to protect a child or another person, to establish or defend legal claims, or in a business sale or restructuring subject to appropriate safeguards.
9. How long we keep information
EBA keeps identifiable information only as long as needed for the stated purpose, a legal duty, a complaint, safeguarding or a legal claim. Anonymised statistics may remain after identifiable records are removed.
| Information | Normal retention |
|---|---|
| Active account and profile information | While the account or profile remains active and the information is needed to provide EBA. |
| Scores and progress after subscription cancellation | No more than 30 days after paid access ends, then deleted or anonymised unless a limited legal, complaint or safeguarding record must be kept. |
| Account deletion | The account is placed in a recoverable deletion state for up to 30 days. It may be restored by verified email request during that window. By the end of the window, account and learning information is deleted or anonymised from live systems. |
| Inactive profiles | After 12 months without activity, EBA may close the profile and begin the 30-day deletion process, after notice where reasonably possible. |
| Backups | Deleted account and learning information is overwritten or put beyond use within 30 days. |
| Payment and tax records | Normally six years, or longer where law requires. These records are restricted and are not used to restore the account. |
| Complaints, safeguarding and legal claims | For as long as reasonably needed to resolve the matter and meet legal or regulatory duties. Only information relevant to that purpose is retained. |
| Marketing suppression | A minimal record may be kept to remember an adult’s opt-out. |
10. Deletion and restoration
To request deletion, email support@exam-bytes.co.uk from the account email. We may verify identity and authority for linked child profiles.
A deleted account can be restored if a verified request reaches EBA during the 30-day deletion window. After permanent deletion or anonymisation, restoration may not be possible. Financial, complaint, safeguarding or legal records that EBA must retain are not used to recreate ordinary account access.
11. How we protect information
EBA uses authentication, role-based access, server-side permissions, restricted administrative access, secure connections, logging, backups, provider checks and incident procedures appropriate to the information and risks.
No online service can guarantee absolute security. Account holders should use strong passwords, keep login details private and report suspected unauthorised access promptly.
12. Data protection rights
Depending on the circumstances and lawful basis, a person may have rights to be informed, access information, correct it, erase it, restrict or object to its use, receive certain data in portable form, withdraw consent and challenge qualifying solely automated decisions.
Children have rights in their own name. A parent or guardian may act for a child where appropriate, but EBA may consider the child’s age, understanding, wishes and best interests.
Send requests to support@exam-bytes.co.uk. EBA may request reasonable identity or authority evidence. We normally respond within one calendar month, subject to lawful extensions and exceptions.
13. Data protection complaints
Send a data protection complaint to support@exam-bytes.co.uk. We will acknowledge it within seven business days, investigate without undue delay, keep you informed and aim to provide a substantive outcome within 30 business days.
If you remain unhappy, you may complain to the UK Information Commissioner’s Office through the ICO complaint service or seek a remedy through the courts.
14. Cookies, analytics and adult marketing
Essential storage technologies are used for login, security, checkout, preferences and core functions. Non-essential analytics or similar technologies are used only in accordance with the consent rules. Details and controls are in the Cookie Notice.
Optional marketing is directed to adults. Adults can unsubscribe at any time. EBA does not use a child’s answers, scores or inferred ability to target third-party advertising.
15. Changes and contact
We may update this notice when the service, law or providers change. Material changes to existing uses of personal information will be communicated where required.
Questions can be sent to support@exam-bytes.co.uk.