Website Privacy Notice

At GL Education Group Limited ("we", "us") we value the privacy of all our customers. We recognise that when you choose to provide us with information about yourself, you trust us to act in a responsible manner. We believe this information should only be used to help us provide you with a better service. We will only collect and use Personal Data in ways that are described in this Privacy Notice (“Notice”), and always in compliance with ourobligations and your rights under the law.

This Notice applies to your use of our websites www.gl-education.com and www.gl-assessment.co.uk. These websites may provide links to third-party sites. Since we do not control those third-party sites and have no control over how your data is collected, stored, and used by them, we advise you to review the privacy notices of such sites before providing your data to them. 

About us

GL Education Group is a Limited Company registered in England and Wales under company number 02603456

Registered address: 1st Floor, Vantage London, Great West Road, Brentford, TW8 9AG

Telephone number: +44 (0)20 8996 3369

Data Protection officer: Karl Oertel

Email address:  [email protected]

In this Notice, reference to Data Protection Legislation means the Data Protection Act 2018, the General Data Protection Regulation (“the GDPR”), and the Privacy and Electronic Communications Regulations 2003.

What is Personal Data?

‘Personal Data’ is defined by the GDPR as: “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.

In simpler terms, Personal Data isany information about you that enables you to be identified.For example, this could be your name or contact details.

What Personal Data do we collect through our websites?

We collect Personal Data from you when you create an account on our websites, when you make a purchase with us or in any other way that you chose to provide us with your Personal Data. 

The Personal Data you give us may include (but is not limited to):

• Contact details:We will collect your contact details including, but not limited to, your name, email address, telephone number and address. This information is collected from you as you register or make a purchase through our websites. 
• Financial and payment details: We will collect details of your bank account and other data necessary for processing payments including credit/debit card numbers, security code numbers and other related billing information.
• Other Personal Data: We may collect further Personal Data such as (if you are purchasing on behalf of a school or other organisation) your job title, your role in the organisation and your qualifications. There are occasions when we will ask for additional information. We do this to be able to better understand your needs, and to provide you with services that we believe may be valuable to you. 

We also receive and store certain types of information whenever you interact with us. For example, like many websites, we use “cookies” and we obtain certain types of information when your Web browser accesses our websites. We also collect the Internet protocol (IP) address used to connect your computer to the Internet, login, email address, password, computer, and connection information such as browser type and version, your operating system and platform. We also analyse other aspects of your system like plugins and plugin version that may affect how our platforms performs. This data helps us to support you with any problems or issues you might experience when using our platforms. For more information, please refer to our Cookie Policy.

It is important that your Personal Data is kept accurate and up to date. If any of the Personal Data wehold about you changes, please keep us informed.

What is our lawful basis for using your Personal Data?

In respect of each of the purposes for which we use your personal data (described in the next section), the GDPR requires us to ensure that we have a ‘lawful basis’ for that use. Most commonly, we will rely on one of the following lawful bases:

• Where we need to use your personal data to deliver our Service to you (including creating an account, accessing our website and mobile apps, or using our products) (“Contractual Necessity”).
• Where we need to use your personal data for our legitimate interests, and your interests and fundamental rights do not override those interests (“Legitimate Interest”).
• Where we need to use your personal data to comply with our legal or regulatory obligations (“Compliance with Law”).
• Where we have your consent to use your personal data for a specific purpose (“Consent”).

How do we use your Personal Data?

We have set out below, in a table format, the purposes and applicable lawful bases we rely on when we use your Personal Data.

International data transfers

The Personal Data that we hold will not be stored at a destination outside the United Kingdom or the European Economic Area (“Europe”). 

Nevertheless, your Personal Data may sometimes need to be shared with a third-party recipient located outside of Europe or may otherwise need to be accessed outside of Europe. For example, some of our affiliates, partners and external third-party suppliers are based outside Europe, so their processing of your Personal Data might involve transferring your Personal Data outside Europe.

Where we share your Personal Data with third parties who are based outside Europe, we try to ensure a similar degree of protection is afforded to it by making sure one of the following mechanisms is implemented:

• Transfers to territories with an adequacy decision. We may transfer your Personal Data to countries or territories whose laws have been deemed to provide an adequate level of protection for Personal Data by the relevant European authorities.
• Transfers to territories without an adequacy decision. We may transfer your Personal Data to countries or territories whose laws have not been deemed to provide an adequate level of protection for Personal Data by European authorities. However, in these cases, we will use specific appropriate safeguards, approved by relevant European authorities, which are designed to give your Personal Data the same protection it has in Europe – for example, requiring the recipient to enter into the relevant form of the so-called ‘Standard Contractual Clauses’ or ‘International Data Transfer Agreement’ issued or approved from time to time.

Should you wish to find out more about these controls and safeguards, please contact us.

Do we share your Personal Data?

The table below describes who we share your Personal Data with, and why we share it.

Protecting your Personal Data

We have put in place appropriate security measures to prevent your Personal Data from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. We limit access to your Personal Data to those employees and other staff who have a business need to have such access. All such people are subject to a contractual duty of confidentiality.

We have put in place procedures to deal with any actual or suspected Personal Data breach. In the event of any such breach, we have systems in place to work with applicable regulators. In addition, in certain circumstances (including where we are legally required to do so), we may notify you of breaches affecting your Personal Data.

Data retention

We retain your Personal Data for as long as necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, accounting or reporting requirements, to establish or defend legal claims, or for fraud prevention purposes.

To determine the appropriate retention period for your Personal Data, we consider the amount, nature and sensitivity of the relevant data, the potential risk of harm from unauthorised use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal requirements.

What are your rights?

Under the Data Protection Legislation, you have the following rights:

• Request access to your Personal Data. This enables you to receive a copy of the Personal Data we hold about you, and to check that we are lawfully processing it.
• Request the correction of your Personal Data. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request the erasure of your Personal Data. This enables you to ask us to delete or remove Personal Data where there is no good reason for us continuing to process it. This may not always be available.
• Object to our processing of your Personal Data. This right exists where we are relying on Legitimate Interest as the legal basis for our processing, and there is something about your particular situation which makes you want to object to our processing on this ground.
• Request the restriction of our processing of your Personal Data. This enables you to ask us to temporarily suspend the processing of your Personal Data, for example if you want us to establish its accuracy or our reason for processing it.
• Request the transfer of your Personal Data. This enables you to ask us to provide to you, or a third-party you have chosen, your Personal Data in a structured, machine-readable format.
• Withdraw consent. This enables you to withdraw your consent. This right only exists where we are relying on Consent as our lawful basis to process your Personal Data.

If you want to exercise any of the rights described above, please contact us.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your Personal Data. This is a security measure to ensure that your Personal Data is not disclosed to any person who has no right to receive it.

Typically, you will not have to pay a fee to exercise your rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. We may also refuse to comply with your request in limited circumstances.

We try to respond to all legitimate requests within a month. It may take us longer than a month if your request is particularly complex or you have made a number of requests; in this case, we will notify you and keep you updated.

Please note that applicable law may require or permit us to decline your request. If we decline your request, we will tell you why, subject to legal restrictions.

Complaints

If you would like to make a complaint regarding this Notice or our practices in relation to your Personal Data, please contact us. We will reply to your complaint as soon as we can.

If you feel that your complaint has not been adequately resolved, please note that applicable privacy law gives you the right to contact your local data protection supervisory authority.

Changes to this Notice

We may change this Notice from time to time. This may be necessary, for example, if the law changes or if wechange ourbusiness practices in a way that affects how we collect or use your Personal Data. 

Any changes will be made available on our websites.

Contact details: 

Questions, comments, and requests regarding this Notice are welcomed and should be addressed to [email protected].