About Us

The data we collect

The type and level of personal information we collect varies, for example:

• Identity – names, date of birth, gender, candidate number, passport, birth certificate, driving license.
• Contact – e-mail address, address, telephone number, marital status, next of kin, dependants, emergency contact details.
• Assessment – examination history, subject, grade, type of qualification and centre.
• On-screen assessment – biometric data such as audio, video of facial features, facial recognition by human or AI, identity documents, voice, images of home/working space, examination history, subject, grade, type of qualification and centre.
• Pupil – Unique Candidate Identifier (UCI), centre number, admission number, year group, registration group, teacher name, class, supervisor name, ethnicity, eligibility for free school meals, FSM6, pupil premium indicator, SEN status, LEA care status.
• Technical – internet protocol (IP) address, login data, operating system and platform.
• Communications – emails you send or receive via our email systems.
• Digital data – video/audio recordings of NEA / coursework taken by your centre. See also online assessment data listed, as it applies. Interaction on social media with AQA or about AQA’s products and services.
• Safeguarding – information divulged to us by children, young adults and individuals at risk through use of our services, which we have a duty to investigate and act upon.

Aggregated data

Aggregated data is data that is collected and combined from multiple individuals from a population, which is then used to create a statistical report that makes inferences about the population. Aggregated data is usually presented as an average, percentage, summary or proportion of some factor of interest.

Special category data

As a provider of assessment products and services, AQA has to collect and process special category data of students. We have in place, as required by legislation, an appropriate policy document for the types of special category data processing conducted by AQA, the lawful basis, purposes, and the conditions to be able to process such data. The main purposes AQA process special category data are for: equality, diversity and inclusion; and the safeguarding of children and adults at risk.

Collecting your data

We may collect personal data from you if you:

• register at an approved centre
• take part in our examinations, training, surveys or related events
• use our website, app, products or services
• interact with us through social media, email, post, text or phone, or use one of our cookies

Data sharing

Data sharing with UCAS

AQA shares personal data with the Universities and Colleges Admissions Service (UCAS) to support applications to higher education and the confirmation of examination results.

For A level qualifications, AQA provides UCAS with candidate results data so that universities and colleges can consider and process your application, including where you have applied or hold an offer, and to support the clearing process. UCAS will be provided with a copy of your candidate record for the relevant year, irrespective of whether you have made any applications to higher education institutions. This is so that there is no delay in processing your application should you decide to make a late application through the clearing system.

For GCSE qualifications, AQA operates a more targeted data sharing process. UCAS provides AQA with a limited set of applicant details, including name, date of birth and Unique Learner Number (ULN). AQA uses this information to identify matching candidate records and, where a match is found, securely provides relevant results to UCAS. This enables UCAS to confirm qualifications where required as part of your application.

AQA and UCAS each act as independent data controllers for the personal data they process under these arrangements.

We only share the minimum personal data necessary for these purposes and do not share special category data as part of this process. We rely on our legitimate interests in supporting students’ progression into further and higher education and ensuring that examination results can be accurately matched and used without unnecessary delay.

UCAS will process the information it receives in accordance with its own privacy notice and may share relevant details with universities and colleges to support your application. Further information is available in the UCAS privacy notice.

Personal data shared under these arrangements is retained only for as long as necessary to fulfil these purposes, after which it is securely deleted or retained in line with each organisation’s retention policies.

Data sharing with the Joint Council for Qualifications (JCQ)

JCQ exam boards collectively share and process candidate-level data for the following purposes:

• To build the annual GCSE National Candidates Results Archive (NCRA), for use in research on standard-setting and to calculate prior attainment measures and prediction matrices used in GCE standard-setting.
• To create the annual candidate-level Key Stage 2 Prior Attainment data set, to match learners to collated GCSE results and to produce prediction matrices used in GCSE standard setting.
• To calculate ‘screening’ statistics after the completion of an examination series and to check that standards are aligned statistically between exam boards.
• To maintain the integrity of exams through joint malpractice investigations between affected exam boards, trend analysis, and preventative activities. This will concern candidate, staff and centre data also.
• Entries and grade data for:
• awarding endorsement grades in Ofqual-accredited GCSE English Language Spoken Language and A-level sciences
• identification of students entered for the same subject with multiple exam boards in the same exam series
• preparation of JCQ results statistics for publication
• research into standards in general, vocational and technical qualifications
• inter-board statistics and specification data
• preparation of examination timetables and key dates for publication
• preparation and use of national prediction matrices for standard setting
• preparation of JCQ advanced entries analysis
• summer results for GCSE Maths and English to feed into the November crosstabs.

International transfers

On the 28 June 2021, the UK was granted ‘adequacy’ by the European Commission in GDPR terms. International transfers to the UK and AQA from the European Economic Area (EEA) and other adequate countries can continue to take place with no additional safeguards. This is alongside existing measures we have in place for international transfers outside of the EEA.

Data transfers from AQA to countries outside the EEA (incl. USA and the rest of the world)

Our applications, services and products use service providers outside of the EEA. We may have to transfer some of your data to these providers so you can use our websites, services, and products. Also, low-level student personal data may be accessed from outside of the EEA for international associates (examiners) to mark AQA assessments or qualifications. Appropriate measures and controls are in place to protect the transfer of your data.

These are examples of the types of data we transfer to third countries outside of the UK and EEA using additional safeguards:

• Identity, Contact, Assessment, On-screen assessment, Pupil – this may be sent to our partners who process our physical or digital exam scripts. They are based in the Philippines, Indonesia, Mauritius, and India. We may also provide this type of data internationally in order for you to use our products and services from outside the UK. You may provide this data to us so that we can enrich it with assessment data and return to you as a reverse transfer – this is low-level personal data. This type of data may be accessed by our supplier partners who support our software products. They are based in the US and India. We may also use associates, examiners or markers who are based outside of the UK/EEA to assist in our examination delivery and marking processes. The list of approved countries from which we currently recruit associates, examiners or markers is: United Arab Emirates.
• Technical, Digital, Safeguarding – this may be accessed by our supplier partners who support our software products. They are based in the US, India, and Norway.
• Recruitment, Employment, Performance, Financial, Transaction – this type of data may be accessed by our supplier partners who support our software products. They are based in the US and India. We may also use associates, examiners or markers who are based outside of the UK/EEA to assist in our examination delivery and marking processes. The list of approved countries from which we currently recruit associates, examiners or markers is: United Arab Emirates.

If you'd like to discuss the additional safeguards outlined above, access documents, review our processes, or receive further information on our international data transfers, please contact us.

Making a complaint

We take the handling of your personal data very seriously. But, if you feel your data is being handled in a way that breaches data protection legislation, you can make a complaint.

Under recent Data Use and Access Act (DUAA) legislation you have a statutory right to complain directly to AQA about the processing of your personal data.

We have put in place a formal process for individuals to follow to make data protection complaints against AQA as a data controller.

Please review our complaints procedures and complete the complaints form here which goes directly to our complaints department who will liaise internally to resolve your complaint and provide an outcome without undue delay. You will receive an acknowledgment of your complaint within 30 days and will be kept up to date with actions / progress.

Alternatively, please feel free to contact our Data Protection Department at GDPRenquiries@aqa.org.uk or use one of our contact methods on the ‘Contact Us’ link at the top of our website to make your complaint. Our Data Protection Officer is Graham Dwyer.

We may charge a reasonable fee if your request is unfounded, repetitive or excessive. We can refuse to follow your request in these circumstances.

We’ll always try to respond to any legitimate request within one month. It may take us longer if your request is complex or you've made many requests. In this case, we'll let you know and keep you updated.

As a security measure, we may ask you to confirm your identity. This ensures that:

• personal data isn't disclosed to any person who doesn't have a right to receive it
• your right to access your data or to exercise any of your other rights.

We may also contact you to ask you for further information in relation to your request to speed up our response.

You may also raise a complaint on behalf of someone else, if so we will require signed proof of authority or power of attorney for example.

You also have the right to complain to the UK Information Commissioner.

AQA Education’s Information Commissioner’s Office registration number is Z6944888.