1. Who this notice is for
This notice covers adult account holders, parents and guardians acting for children, tutors using EBA professionally, authorised organisation administrators and adult prospects who receive EBA communications. A child remains the person the child-profile information is about, even when an adult manages the profile.
2. Who is responsible
KVASIR TUTELAGE LIMITED, trading as Exam Bytes Academy, is the controller for personal information used to run EBA. Company number 13090072. Registered office: 127 Conisborough Crescent, London, SE6 2SQ, England. Privacy contact: support@exam-bytes.co.uk.
3. Information we collect
EBA may hold adult account details, child profile information, learning activity such as answers, scores, accuracy and response time, tutor and class information, payment status and Stripe identifiers, technical and security information, and information needed for EBA Strategy meetings or documents.
For adult communications and outreach, EBA may hold adult business or contact details, communication preferences, replies, unsubscribe or suppression records, campaign membership, the source of an adult contact, and limited funnel events such as a pricing view, a demo start or completion, or a signup CTA. Where a personalised EBA email link is intentionally followed, EBA may record that requested link as low-confidence recipient-linked outreach activity.
4. Where information comes from
Information can come from the adult account holder, child activity, approved tutors or administrators, Stripe and other service providers, and EBA’s own technical and security systems.
Adult prospect information may also come from the adult, an organisation connected with the adult, an EBA event or enquiry, or a data source from which the adult’s contact details are lawfully supplied to EBA. EBA does not obtain child contact data for outreach.
5. Why we use information and lawful bases
EBA uses information to run accounts and practice, process trials and subscriptions, choose suitable starting points and next activities, provide EBA Strategy, protect accounts, fix errors, support users, handle rights requests and send optional adult marketing or outreach. The lawful basis depends on the purpose and may include contract, legal obligation, legitimate interests, consent or vital interests.
EBA uses only adult-relevant aggregate platform state, such as a count of connected children, completed practice or assigned work, to work out an appropriate adult next action. That does not transfer child names, emails, answers, question responses or detailed performance into the Outreach system.
6. Children and personalised practice
EBA uses answers, accuracy, response time and past activity to suggest a starting point, adjust difficulty and recommend what to do next. This automated processing is used to deliver the practice service. It is not used to decide school admission, award a qualification or create a third-party advertising profile.
Child learning activity is not used to target adult prospects, send a child marketing, or create a child profile in the Outreach system.
7. Parents, tutors, administrators and leaderboards
Authorised parents can manage linked child profiles. Tutors see class information only after both sides approve the connection. Organisation administrators must have authority for the relationships they manage. If a leaderboard is enabled, the stated audience may see a nickname, avatar, score, rank or achievement.
8. Service providers, disclosure and international transfers
EBA uses providers for hosting, databases, authentication, payments, email, error monitoring, support, security, backups and business administration. EBA’s protected Outreach system processes adult communications, suppression choices, campaign decisions, pseudonymous attribution and limited funnel analytics; browser clients do not write its CRM tables directly. Some providers may process data outside the UK. Where required, EBA uses an appropriate lawful transfer mechanism and may disclose limited information where law, child safety, legal claims or a business restructuring requires it.
9. Adult marketing, outreach and attribution
EBA may send adult-facing product marketing or outreach where permitted by law. A person can use the unsubscribe route in an EBA marketing email; no login or cookie is required. EBA keeps a suppression record where needed to honour that choice and does not treat an account sign-up as permission to restart cold outreach.
EBA does not use email-open tracking pixels. A personalised EBA CTA can record the requested link on EBA’s server before the destination opens. This helps measure campaign performance and is treated as low-confidence because a security scanner can request a link. Where consent is given, EBA can also preserve an opaque first-party attribution token and record limited meaningful public-site or demo events. EBA does not label recipient-linked activity as anonymous.
10. How long we keep information
Active account data is kept while needed to provide EBA. Scores and progress after paid access ends are kept for no more than 30 days. Deleted accounts stay recoverable for up to 30 days before ordinary account and learning data is deleted or anonymised. Inactive profiles may enter deletion after 12 months. Payment and tax records are normally kept for six years. Complaint, safeguarding and legal records may be kept longer where needed.
Pseudonymous first-party attribution sessions expire after 30 days. Detailed public-site, demo and outreach analytics are subject to EBA’s configured retention period, which is 180 days by default. Operational send history is kept separately where needed to manage communications, and suppression information is retained where necessary to honour an opt-out.
11. Deletion and restoration
Deletion can be requested by email from the account email. EBA may verify identity and authority. A deleted account may be restored during the 30-day deletion window. After permanent deletion or anonymisation, ordinary account access may not be recoverable.
12. How we protect information
EBA uses authentication, role-based access, server-side permissions, restricted administration, secure connections, logging, backups, provider checks and incident procedures. Browser clients do not have direct access to the Outreach CRM. No online service can guarantee absolute security, so users should protect their passwords and report suspected unauthorised access.
13. Data protection rights
Depending on the circumstances, people may have rights to be informed, access information, correct it, erase it, restrict or object to use, receive certain data in portable form, withdraw consent and challenge qualifying automated decisions. Children have rights in their own name. Requests can be sent to support@exam-bytes.co.uk.
14. Data protection complaints
Data protection complaints can be sent to support@exam-bytes.co.uk. EBA acknowledges them within seven business days, investigates without undue delay and aims for a substantive outcome within 30 business days. People may also complain to the UK Information Commissioner’s Office.
15. Cookies, analytics and adult marketing
Essential technologies support login, security, checkout and core features. Non-essential public-site and demo analytics are used only under the applicable consent rules. Optional marketing is aimed at adults. Child answers, scores and inferred ability are not used for third-party advertising. The Cookie Notice lists the EBA storage currently used for consent, pseudonymous visitor activity and attribution.
16. Changes and contact
EBA may update this notice when the service, law or providers change. Material changes are communicated where required. Questions can be sent to support@exam-bytes.co.uk.