1. Who this notice is for
This notice covers adult account holders, parents and guardians acting for children, tutors using EBA professionally and authorised organisation administrators. A child remains the person the child-profile information is about, even when an adult manages the profile.
2. Who is responsible
KVASIR TUTELAGE LIMITED, trading as Exam Bytes Academy, is the controller for personal information used to run EBA. Company number 13090072. Registered office: 127 Conisborough Crescent, London, SE6 2SQ, England. Privacy contact: support@exam-bytes.co.uk.
3. Information we collect
EBA may hold adult account details, child profile information, learning activity such as answers, scores, accuracy and response time, tutor and class information, payment status and Stripe identifiers, technical and security information, and information needed for EBA Guidance meetings or documents.
4. Where information comes from
Information can come from the adult account holder, child activity, approved tutors or administrators, Stripe and other service providers, and EBA’s own technical and security systems.
5. Why we use information and lawful bases
EBA uses information to run accounts and practice, process trials and subscriptions, choose suitable starting points and next activities, provide Guidance, protect accounts, fix errors, support users, handle rights requests and send optional adult marketing. The lawful basis depends on the purpose and may include contract, legal obligation, legitimate interests, consent or vital interests.
6. Children and personalised practice
EBA uses answers, accuracy, response time and past activity to suggest a starting point, adjust difficulty and recommend what to do next. This automated processing is used to deliver the practice service. It is not used to decide school admission, award a qualification or create a third-party advertising profile.
7. Parents, tutors, administrators and leaderboards
Authorised parents can manage linked child profiles. Tutors see class information only after both sides approve the connection. Organisation administrators must have authority for the relationships they manage. If a leaderboard is enabled, the stated audience may see a nickname, avatar, score, rank or achievement.
8. Service providers, disclosure and international transfers
EBA uses providers for hosting, databases, authentication, payments, email, error monitoring, support, security, backups and business administration. Some providers may process data outside the UK. Where required, EBA uses an appropriate lawful transfer mechanism and may disclose limited information where law, child safety, legal claims or a business restructuring requires it.
9. How long we keep information
Active account data is kept while needed to provide EBA. Scores and progress after paid access ends are kept for no more than 30 days. Deleted accounts stay recoverable for up to 30 days before ordinary account and learning data is deleted or anonymised. Inactive profiles may enter deletion after 12 months. Payment and tax records are normally kept for six years. Complaint, safeguarding and legal records may be kept longer where needed.
10. Deletion and restoration
Deletion can be requested by email from the account email. EBA may verify identity and authority. A deleted account may be restored during the 30-day deletion window. After permanent deletion or anonymisation, ordinary account access may not be recoverable.
11. How we protect information
EBA uses authentication, role-based access, server-side permissions, restricted administration, secure connections, logging, backups, provider checks and incident procedures. No online service can guarantee absolute security, so users should protect their passwords and report suspected unauthorised access.
12. Data protection rights
Depending on the circumstances, people may have rights to be informed, access information, correct it, erase it, restrict or object to use, receive certain data in portable form, withdraw consent and challenge qualifying automated decisions. Children have rights in their own name. Requests can be sent to support@exam-bytes.co.uk.
13. Data protection complaints
Data protection complaints can be sent to support@exam-bytes.co.uk. EBA acknowledges them within seven business days, investigates without undue delay and aims for a substantive outcome within 30 business days. People may also complain to the UK Information Commissioner’s Office.
14. Cookies, analytics and adult marketing
Essential technologies support login, security, checkout and core features. Non-essential analytics are used only under the applicable consent rules. Optional marketing is aimed at adults. Child answers, scores and inferred ability are not used for third-party advertising.
15. Changes and contact
EBA may update this notice when the service, law or providers change. Material changes are communicated where required. Questions can be sent to support@exam-bytes.co.uk.