The Triangle Building,
||+44 (0)1223 553311
||+44 (0)1223 460278
|Data Protection Officer:
This policy is for candidates and learners. If you are a school or centre offering Cambridge Assessment programmes, please ensure that you provide your candidates with this Policy.
Cambridge Assessment (also known as the University of Cambridge Local Examinations Syndicate) is part of the University of Cambridge. We offer various education-related products and services, including academic and vocational qualifications and the exams that underpin them, training services for teachers and others involved in education and a wide range of research aimed at educators and policy makers. We do this through our central functions as well as through our exam boards: Cambridge Assessment English, Cambridge Assessment International Education and Oxford, Cambridge and RSA Examinations.
In order to provide these products and/or services we need to use personal Information. Personal information means any piece of information which can identify you, i.e. would make it clear to others that the information is about you. It can be a single piece of information, for example, your name. Or it can be separate pieces of information, for example your address, nationality, education history and sex, which, when combined, would help others to identify you.
What personal data do we have?
The personal information we collect or generate about you will vary depending on which services we provide you but may include the following:
- Identity data including your name, date of birth and sex
- Contact data including your school/home/work postal address, email address and phone number
- Your employment and education history, including any qualifications which you have
- Information contained within identity documents such as driving licence, passport or government issued ID
- Any information we are required to gather in the country where the services take place (such as copies of government issued identification documents)
- Technical data including internet protocol (IP) address, login data, browser type and technology used to access our website.
We may also need to collect special categories of personal information about you, such as:
- Health information, such as whether you have a disability in order to facilitate you sitting an assessment
- Biometric data for identity purposes such as facial recognition for online examinations
- Racial and ethnicity information for equal opportunity monitoring.
How we get the information and why we have it
Most of the personal information we process is provided to us directly by you and/or your school or college or generated by us but we may also receive your personal information from third parties such as:
- Governmental departments and designated bodies, such as the Department for Education and the Higher Education Statistics Agency
- Government agency using our services on your behalf
- Employers and/or universities seeking confirmation of your qualifications
Under the data protection law, we have to have a lawful basis to process your information. These are the reasons why we may process your personal information:
- Taking necessary steps to fulfil our obligations under a contract we have with you, for example where you have purchased one of our products or services.
- Because it is necessary for our or a third party’s (including yourself) legitimate interests. These legitimate interests include the provision of services in relation to assessments and confirmation of results.
- Because it is necessary for the performance of a task carried out in the public interest such as where we provide Ofqual regulated assessments.
- Because we have a legal obligation to process your personal information.
- Because it is necessary to protect your or another person’s vital interest.
- You have given us your consent.
We will only process your special category of personal information with your explicit consent (or that of your parent or guardian where applicable) or if it is necessary:
- For the establishment, exercise or defence of a legal claim.
- For archiving, scientific, historical research or statistical purposes.
- In the very rare occurrence, where it may be necessary to protect your or another person’s vital interests and you are not capable of giving your consent (for example, in an emergency).
- Where there is a substantial public interest.
- When you have already made the information public.
What we do with the information we have
The following activities require the use of personal information in order for us to provide our products and services. We may have to withdraw the provision of such products and services if we cannot use your personal information.
- Developing and delivering academic and vocational qualifications/programmes, including the development of assessment materials (such as exam questions and marking guidelines), the collection, marking and grading of exam scripts, the administrative systems used to support these processes and the issuing of awards and certificates.
- Developing and delivering publications and other resources that support learning in connection with our academic and vocational qualifications.
- Monitoring the performance of those involved in the provision of our academic and vocational qualifications.
- Investigating allegations of misconduct in relation to the delivery of assessments.
- Ensuring the appropriate examination facilities are available to those with specific requirements.
- Checking that an individual (e.g., a candidate) is who they say they are.
- Handling complaints.
The following are examples of other activities which involve our use of personal information:
- Carrying out research in the field of education and qualification delivery, setting standards and other activities that are required to ensure that our services are delivered to a high standard and that candidates are protected.
- Understanding the needs of candidates and other users of our services (including qualifications).
- Providing training to individuals, such as teachers and examiners, in connection with our services.
- For purposes connected with our internal business, including understanding and protecting ourselves from risks, protecting any personal information that we hold, internal record-keeping and carrying out business checks.
We may use personal information provided by you to carry out marketing and market research. We will only do this where we have your consent to contact you for these purposes or where there is a legitimate interest in contacting you about such services, for example because you have received a similar service from us previously. You can opt out of these contacts at any time.
We may sometimes use a method known as profiling. In part, this method involves automatically collecting certain information in order to understand how people might behave, but we will not make decisions based on this without some human involvement or informing you of your rights associated with profiling. We occasionally use this method when someone is doing a test on a computer to verify their identity or where their activity has been questioned, or to assist with the test itself.
Transferring Personal Information
We may share personal information with:
- Cambridge University and other affiliated businesses and organisations which are owned by it including Cambridge University Press
- People and organisations that represent us (such as examiners)
- Organisations we conduct research with
- Other people and/or businesses who provide services on our behalf
- Schools or educational establishments which you attend
- The Universities and Colleges Admissions Service, universities, potential employers and other organisations, in order to help candidates that are making applications
- Where we are required to do so by law.
The United Kingdom and countries inside the European Economic Area have specific laws which protect the way personal information is used. We may transfer personal information to countries outside of the European Economic Area where personal information is not protected in the same way (usually to other businesses who provide services on our behalf). In such cases, we will make sure that suitable safeguards are in place to protect the personal information. What that means is that whoever we transfer personal information to, will have to agree to protect the personal information in an appropriate way. You can request further information about this by emailing firstname.lastname@example.org
How we store your information
Personal information will be stored on IT systems (including email and secure file servers) and in certain circumstances hard copy records.
We take the security of your personal information very seriously. We have internal policies and controls in place to protect your personal information against loss, accidental destruction, misuse or unauthorised disclosure and to prevent access to your personal information except by employees in the proper performance of their duties.
Under data protection law, you have rights including:
- Your right of access - You have the right to ask us for copies of your personal information.
- Your right to correction - You have the right to ask us to change or add information you think is inaccurate or not complete.
- Your right to be forgotten - You have the right to ask us to delete your personal information in certain circumstances, however, this may not be possible when it comes to maintaining a record of your results.
- Your right to stop processing - You have the right to ask us to stop processing your information in certain circumstances.
- Your right to object to processing - You have the right to object to the processing of your personal information in certain circumstances.
- Your right to object to automatic decision making.
- Your right to data portability - You have the right to ask that we transfer the information you gave us to another organisation, or to you, in certain circumstances.
- You are not normally required to pay for exercising your rights. If you make a request, we have one month to respond to you.
For more information on these rights please visit the Information Commissioner’s Office website.
Please email us at email@example.com firstname.lastname@example.org if you wish to exercise any of the rights detailed above.
How to complain
If you would like to make a complaint about how your data is being handled, please contact the Data Protection Officer at:
Data Protection Officer
The Triangle Building
or by e-mail at email@example.com
Please note that Cambridge Assessment is registered with the United Kingdom’s Information Commissioner’s Office (ICO) and they are our supervisory Data Protection Authority. If you are unhappy with how we have dealt with your data or your request/complaint then you can make a formal complaint to them or by writing to them at:
Information Commissioner’s Office
ICO Helpline number: +44 (0)303 123 1113
Changes to this Privacy Statement