About Us

Student Privacy notice

The personal information you give us is important. Getting to learn about you means that we can give you products and services that best meet your needs. This is a condensed version of our main privacy notice which is aimed solely at students. If you wish to find out more detailed information you can visit out main privacy notice here.

Our privacy notice explains what information we collect, what we do with it, how we collect it and keep it secure.

• The data we collect
• Collecting your data
• What we do with it
• How long we keep it
• How we store and protect it
• How we share your data
• Data sharing
• Third parties
• International transfers
• Automated decision making
• Artificial Intelligence (AI)
• Your rights
• Making a complaint
• Legal basis for processing data
• Contact us

Last updated: November 2024

Who we are

The legal entities that make up AQA (eg “AQA”, “we”, “us” or “our”), responsible for your personal information are:

• AQA Education (registered office: Devas Street, Manchester, M15 6EX).
• AQA Commercial Services Ltd (registered office: Devas Street, Manchester, M15 6EX).
• AQA Assessment Services Ltd (registered office: Devas Street, Manchester, M15 6EX).
• AlphaPlus Consultancy Ltd (registered office: Devas Street, Manchester, M15 6EX).
• Doublestruck Ltd (registered office: Devas Street, Manchester, M15 6EX).
• Oxford International AQA Examinations (registered address: Oxford University Press, Great Clarendon Street, Oxford, England, OX2 6DP).
• Training Qualifications UK Ltd (registered office: Crossgate House, Cross Street, Sale, M33 7FT).

The data we collect

The type and level of personal information we collect varies, for example:

• Identity – names, date of birth, gender, candidate number, passport, birth certificate, driving license.
• Contact – e-mail address, address, telephone number, marital status, next of kin, dependants, emergency contact details.
• Assessment – examination history, subject, grade, type of qualification and centre.
• On-screen assessment – biometric data such as audio, video of facial features, facial recognition by human or AI, identity documents, voice, images of home/working space, examination history, subject, grade, type of qualification and centre.
• Pupil – Unique Candidate Identifier (UCI), centre number, admission number, year group, registration group, teacher name, class, supervisor name, ethnicity, eligibility for free school meals, FSM6, pupil premium indicator, SEN status, LEA care status.
• Technical – internet protocol (IP) address, login data, operating system and platform.
• Communications – emails you send or receive via our email systems.
• Digital data – video/audio recordings of NEA / coursework taken by your centre. See also online assessment data listed, as it applies. Interaction on social media with AQA or about AQA’s products and services.
• Safeguarding – information divulged to us by children, young adults and individuals at risk through use of our services, which we have a duty to investigate and act upon.

Aggregated data

Aggregated data is data that is collected and combined from multiple individuals from a population, which is then used to create a statistical report that makes inferences about the population. Aggregated data is usually presented as an average, percentage, summary or proportion of some factor of interest.

Special category data

As a provider of assessment products and services, AQA has to collect and process special category data of students. We have in place, as required by legislation, an appropriate policy document for the types of special category data processing conducted by AQA, the lawful basis, purposes, and the conditions to be able to process such data. The main purposes AQA process special category data are for: equality, diversity and inclusion; and the safeguarding of children and adults at risk.

Collecting your data

We may collect personal data from you if you:

• register at an approved centre
• take part in our examinations, training, surveys or related events
• use our website, app, products or services
• interact with us through social media, email, post, text or phone, or use one of our cookies

What we do with your data

Your personal information supports a range of different purposes and activities. The types of data we use, the legal base(s) we rely on when processing them and our legitimate interests are:

Purpose/activity

Type of data

Lawful basis

To set and mark tests and examination papers and maintain a permanent record of the examination results (this includes the security and integrity of the examination process, the delivery of accurate results to students; and our compliance with statutory regulations).

• Identity
• Contact
• Assessment
• Transaction

• Performance of a contract with you.

• Necessary for our legitimate interests (eg to maintain and develop our core products and services in a regulated environment).

• Legal obligation.

• Public interest.

To develop, deliver, inform and publicise educational: products, policy, standards, qualifications, on-screen assessment, questions, resources and training (including the provision and funding of research to inform education policy and improve assessment practice, which may include the use of personal and special category data for equality, diversity and inclusion (EDI) purposes).

• Identity

• Contact

• Technical

• Usage

• Marketing

• Survey

• Assessment

• On-screen assessment

• Pupil

• Digital data

• Communications

• Behaviour

• Performance of a contract with you.

• Necessary for our legitimate interests (eg to maintain and develop our core products and services in a regulated environment).

• Public interest.

• Processing necessary for reasons of substantial public interest.

• Processing necessary for archiving purposes in the public interest for research purposes.

To promote education for the public benefit (this includes the provision of dedicated support and mentoring to young people through the AQA Unlocking Potential programme).

• Identity

• Contact

• Technical

• Usage

• Marketing

• Survey

• Performance of a contract with you

• Necessary for our legitimate interests (eg to promote education).

• Consent.

To gather your opinions on our products and services, or on your experiences of education. This includes the creation of our Student Advisory Group, including EDI data collection required to ensure a complete cross section of society is represented.

• Identity

• Contact

• Survey

• Marketing

• Pupil

• Consent.

• Legitimate interests (for EDI purposes).

To support law enforcement bodies in the prevention, detection and prosecution of crime. This may include: social media and internet monitoring where AQA believe our products and services may be being illegally passed on or sold; and where we may be alerted to safeguarding issues/referrals which have been divulged to AQA by students through using our services.

• Identity

• Contact

• Digital

• Pupil

• Safeguarding

• Assessment

• On-screen assessment

• The legitimate interest of helping staff, visitors and other occupants to prevent, detect and prosecute crime.

• Legal obligation (where a crime has been committed).

• Public interest (to ensure AQA examinations are free from dishonesty and malpractice).

• Article 9 (g) of the UK GDPR and Section 18 of Schedule 1 of the DPA 2018 – 'Safeguarding of children and of individuals at risk'.

To assist in the effective processing of appeals from centres or students in relation to grades received from AQA’s assessment products and services.

• Identity

• Contact

• Assessment

• On-screen assessment

• Pupil

• Digital

• Communications

The legitimate interests of AQA and our legal obligation to enable centres or students to submit an appeal against the grades received in order to ensure the integrity of assessment across the UK in AQA’s products and services. Also to ensure examinations are free from malpractice and maladministration.

AQA may deploy the use of AI in some products and services. For example, we may use AI to transcribe what is said in meetings.

• Identity

• Technical

• Digital data

• Activity

• Usage

• Communications

Necessary for our legitimate interests (use of technology to transcribe meetings quickly and easily from the audio of attendees, low-level personal data)

We may process your personal data using more than one lawful basis, this depends on the activity.

We’ll use your personal data for the reason we collected it. Unless we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your information for an unrelated purpose, we’ll let you know and explain the legal basis for this. We may process personal data without your consent, in compliance with the above rules. Where it's required or permitted by law.

How long we keep your data

We keep personal data for as long as necessary or mandated for the purposes it was intended for at the point of collection. Our retention periods have been developed from our records of processing activities (RoPA) documentation and are regularly reviewed, updated and audited within AQA. If you'd like to know more about our retention periods or require further information, please contact us.

How we store and protect it

We keep personal data confidential within a secure infrastructure protected by many firewalls and other technical and organisational measures. We are committed to keeping the security of our systems up to date.

Access to your personal data is only given to those who have a business need to know it. They can only access it on our instructions and they'll stay subject to a duty of confidentiality. Any third party we work with must have security measures in place to process your personal data. AQA ensure their third parties protect your data under the law.

How we share your information

We may share your personal information with the following, where we are the controller or joint controller of the information with other bodies and where we have a lawful basis to do so:

• The AQA group of companies (AQA Education, AQA Commercial Services, AQA Assessment Services, AlphaPlus Consultancy, Doublestruck, Oxford International AQA Examinations, and Training Qualifications UK).
• Government agencies, their partners and other third parties such as Ofqual, DfE, UCAS, Student Loan Company, Centres/Schools/Academies, and Local Authorities.
• Affiliates, associates, business partners, suppliers (including their sub-contractors) or other third parties that we use to support the operation of our business. For example, to: support the logistics involved in the secure keying, and scanning, storage and transportation of exam papers. Oxford University Press (OUP) for delivery of international products and services, other exam bodies, and the Joint Council for Qualifications (JCQ) where joint working is required to process results.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. AQA does not allow its third-party service providers to use your personal data for their own purposes and only permits them to process your personal data for specified purposes and in accordance with our instructions.

AQA may add to your personal data any information it obtains from third parties that are allowed to share your data with AQA. This may include data from its examination centres, schools and colleges, the Department for Education, search data providers or public sources. In each case, AQA will do only what is allowed by relevant laws.

Data sharing

Data sharing with UCAS

UCAS will be provided with a copy of your candidate record for the relevant year, irrespective of whether you have made any applications to higher education institutions. This is so that there is no delay in processing your application should you decide to make a late application through the clearing system. UCAS holds this information under strict instruction from AQA, and the other awarding bodies, and is strictly prohibited from using the information (even consulting it) except as instructed.

UCAS is instructed to search the records to find candidates who have applied to UCAS, and to access the records of applicants. UCAS can use this information to process your application (please see the privacy notice that UCAS provides to you for more details about the information, how UCAS uses it, and how long it keeps it). If you do not apply to UCAS, however, it is instructed not to access your information.

Once clearing has finished, UCAS is instructed to permanently delete all of the records provided by AQA and the other awarding bodies. UCAS can only keep the information it extracted from these records if you applied to UCAS, and will let AQA know whether or not it accessed your records. AQA relies on legitimate interest in facilitating the UCAS clearing process to make sure students have a seamless integration into the admissions services.

Data sharing with the Joint Council for Qualifications (JCQ)

JCQ exam boards collectively share and process candidate-level data for the following purposes:

• To build the annual GCSE National Candidates Results Archive (NCRA), for use in research on standard-setting and to calculate prior attainment measures and prediction matrices used in GCE standard-setting.
• To create the annual candidate-level Key Stage 2 Prior Attainment data set, to match learners to collated GCSE results and to produce prediction matrices used in GCSE standard setting.
• To calculate ‘screening’ statistics after the completion of an examination series and to check that standards are aligned statistically between exam boards.
• Entries and grade data for:
• awarding endorsement grades in Ofqual-accredited GCSE English Language Spoken Language and A-level sciences

• identification of students entered for the same subject with multiple exam boards in the same exam series

• preparation of JCQ results statistics for publication

• research into standards in general, vocational and technical qualifications

• inter-board statistics and specification data

• preparation of examination timetables and key dates for publication

• preparation and use of national prediction matrices for standard setting

• preparation of JCQ advanced entries analysis

• summer results for GCSE Maths and English to feed into the November crosstabs.

Third parties

We respect your data and expect all third parties to do the same. We don’t allow our third-party service providers to use your personal data for their own purposes. They can process your personal data for specific purposes and under our instructions.

We can save any information we get about you from third parties, such as:

• examination centres
• schools and colleges
• other exam bodies
• the Department for Education (DfE)
• search data providers
• public sources.

In each case we’ll do only what’s allowed by relevant laws. We can share information about our websites or products publicly or with third parties. This will not include data that can identify you.

International transfers

On the 28 June 2021, the UK was granted ‘adequacy’ by the European Commission in GDPR terms. International transfers to the UK and AQA from the European Economic Area (EEA) and other adequate countries can continue to take place with no additional safeguards. This is alongside existing measures we have in place for international transfers outside of the EEA.

Data transfers from AQA to countries outside the EEA (incl. USA and the rest of the world)

Our applications, services and products use service providers outside of the EEA. We may have to transfer some of your data to these providers so you can use our websites, services, and products. Also, low-level student personal data may be accessed from outside of the EEA for international associates (examiners) to mark AQA assessments or qualifications. Appropriate measures and controls are in place to protect the transfer of your data.

These are examples of the types of data we transfer to third countries outside of the UK and EEA using additional safeguards:

• Identity, Contact, Assessment, On-screen assessment, Pupil – this may be sent to our partners who process our physical or digital exam scripts. They are based in the Philippines, Indonesia, Mauritius, and India. We may also provide this type of data internationally in order for you to use our products and services from outside the UK.
• Technical, Digital, Safeguarding – this may be accessed by our supplier partners who support our software products. They are based in the US, India, and Norway.

If you'd like to discuss the additional safeguards outlined above, access documents, review our processes, or receive further information on our international data transfers, please contact us.

Automated decision making

In certain situations AQA may have to make semi-automated decisions on the grading of exams/exam units, mainly when exams cannot take place or if a candidate is absent and unable to take an exam or set of exams. Provided that students were entered for the units at the time, results will be generated based on results in the exams which students actually sat. This will be done by using statistical analysis processing for estimating missing marks, which is in line with JCQ guidance. The calculation takes into account any differences in assessment performance that exist across different units. This is called mark estimation or back calculated mark.

As per data protection legislation, candidates who may be affected by this process have the right to obtain human review into the grade applied, express their opinion or point of view, and to contest the decision. Visit the contact us page to find out more, or go to the contact us section at the bottom of this page.

Artificial Intelligence (AI)

Within certain products, services, suppliers, systems, and software AQA may utilise Artificial Intelligence (AI). We have developed a robust ethical framework to review any AI we implement at AQA to ensure there are no negative outcomes, bias, or discrimination, as a charitable organisation serving teachers and students across the world.

If you wish to find out more about AQA’s use of AI please visit the contact us page to find out more, or go to the contact us section at the bottom of this page.

Your rights

You have several rights under the data privacy legislation. To learn more, see the table below.

Under certain circumstances you have the right to:

For example:

Access your data – you can access your data at any time by completing the subject access request form. Please be specific about what you want to know. We’ll need to confirm your identity before we release data to you.

You can request access to your exam results, exam scripts, marks provided by examiners, or general information on how we process your data.

Correct your data – you can ask us to correct any data we hold about you that's inaccurate.

We can update your:

• name

• date of birth

• gender

Object to automated decision-making – you can also object to the processing of your personal data where profiling is being used to make assumptions about your behaviours or preferences. You have the right not to be subject to automated decision-making and can request that any such decisions are reviewed by a human.

You can ask us not to:

• give you estimated calculated grades.

(See our section on automated decision making)

Making a complaint

We take the handling of your personal data very seriously. But, if you feel your data is being handled in a way that breaches data protection legislation, you can make a complaint. Please contact our Data Protection Office at GDPRenquiries@aqa.org.uk.

We may charge a reasonable fee if your request is unfounded, repetitive or excessive. We can refuse to follow your request in these circumstances. We’ll always try to respond to any legitimate request within one month. It may take us longer if your request is complex or you've made many requests. In this case, we'll let you know and keep you updated.

You also have the right to complain to the UK Information Commissioner. AQA Education’s Information Commissioner’s Office registration number is Z6944888.

The legal basis for processing your personal data

The law requires us to inform you of the legal basis for collecting and processing your personal data, where we are the Data Controller, or Joint Data Controller. These include:

• Performance of contract – ie when we have a contract to either provide a product or service to you, or to receive something from you. We're also acting under the 'performance of contract' if we collect or process your data for the purposes of entering into a contract with us.
• Legitimate interests – ie processing personal data, which doesn't relate to the performance of a contract agreed with you. We'll check the fairness of this; and will only undertake the processing if it's reasonable to do so and will not cause undue risk to you.
• Legal obligation – we're legally bound to process certain data about you. In some cases, we're obliged to share personal data with third parties, such as Ofqual, JCQ, and DfE.
• Public interest – we're obliged to maintain a permanent record of your assessment data (eg examination history, subject, grade, and type of qualification) under the 'Conditions of Recognition' defined by Ofqual, underpinned by the Apprenticeships, Skills, Children and Learning Act (2009). This is both a legal obligation and necessary for the performance of a task carried out in the public interest. We may also share data with Ofqual, JCQ and the DfE under this lawful basis.
• Consent – we don't rely on consent as a legal basis for processing your personal data. Other than in relation to sending marketing communications via email or text message.

Contact us

We have an established Data Protection Office that oversees AQA’s activities to ensure that your personal data is handled ethically and in line with our legal obligations. If you have any questions about the way in which we collect, hold or process your data, or wish to exercise your rights, please contact us at GDPRenquiries@aqa.org.uk. Our Data Protection Officer is Graham Dwyer.