AQA Stride privacy notice

Share this page

AQA Stride privacy notice

The personal information you give to AQA is important. Utilising your personal data means that we can offer you services that best meet your needs.

This privacy notice has been compiled in relation to your personal data processed within the AQA Stride learning environment, it explains what information we collect, what we do with it, how we collect it and keep it secure. This should be read in conjunction with our AQA Stride terms of use

If you require any further information on your rights, or this processing, you can reach out to AQA’s Data Protection team via GDPREnquiries@aqa.org.uk, or review AQA’s privacy notice for further privacy related information.

Last updated: September 2026

Parties involved in processing your data

The legal entities that control and process your personal information are:

Data Controller: Your school/centre (you). For issues relating to your personal information held within the AQA Stride platform, you may also contact your school or centre, who acts as the Data Controller.
Data Processor: AQA Education Ltd (registered office: Devas Street, Manchester, M15 6EX).
Sub-processor: Area9 Lyceum (registered office: Galionsvej 37, 1437 København, Denmark).

AQA processes personal data only on documented instructions from the school or centre, except where required to do otherwise by applicable law. AQA will inform the school or centre of such legal requirements unless prohibited from doing so.

To find out more about the platform, please visit the Area9 Lyceum website.

View the Area9 Lyceum privacy policy.

The data we collect

We collect data on the following categories of Data Subjects:

Students
Teachers
School administrators
School contacts
MAT/College Group Administrators
AQA support contacts

The data collected within the platform, and the use of, is as follows:

Centre data: centre name, postcode, centre number, centre internal ID, centre UK PRN, centre URN, group name, group internal ID, group UK PRN, student names, teacher names, accounts, school email addresses, student email addresses, teacher email addresses, student user IDs, teacher user IDs, schools’ subscriptions, teacher and student authentication credentials (stored securely in hashed/encrypted form as applicable);
Student data: name, email address, user ID, student UPN, authentication credentials (stored securely in hashed/encrypted form as applicable), assessment data;
Teacher data: name, email address, user ID, authentication credentials (stored securely in hashed/encrypted form as applicable), assessment data;
Caller data: name, email address, job role, centre number, organisation name, organisation type, contact preferences, subject interest, specification, course data, forecast entries, qualification type, academic period, student and teacher notes;
Webform data (added to Dynamics CRM): name, email address, job role, centre number, organisation name, organisation type, contact preferences, subject interest, specification, course data, forecast entries, qualification type, academic period, student and teacher notes.

What we do with your data

This data is required for the purpose of providing access to the platform for the purposes of diagnostic assessments and personalised learner content to support students for the duration of your subscription to the AQA Stride platform and will be deleted in line with our retention schedule after your subscription has ended. AQA processes personal data on behalf of the school or centre under a contractual arrangement with the school or centre. The school or centre is responsible for identifying the appropriate lawful basis for processing personal data. You warrant that you have an appropriate lawful basis for the processing and have provided the necessary privacy information to staff, students, parents and guardians where required. You as a Data Controller can revoke use of the AQA Stride platform at any time, you are not obliged to provide any personal data and can decide not to at no detriment.

Your data will be shared with AQA as a Data Processor and their Sub-processor. For further details, please see parties involved in processing your data or contact us.

In order to set up the AQA Stride platform and provide user, and technical support for your use of the learning environment, AQA and the Sub-processor will require access to the data collected within the platform. AQA and the Sub-processor have a contract in place between them, which is no less onerous than the Terms of Use with you as a centre.

Where users contact AQA for support, enquiry details may be recorded within Microsoft Dynamics 365 CRM for case management, customer support and service improvement purposes.

For the most up-to-date information on how AQA collect and use personal data, please refer to AQA's privacy notice

How the data is protected

Any third party AQA engage with has to meet stringent security and data protection criteria. For high risk processing AQA also deploys privacy by design and default within our Data Protection Impact Assessment (DPIA) procedures.

The platform and Sub-processor been vetted by AQA in the following areas:

Incident/risk management
Employee training and awareness
Information handling and encryption
Role Based Access Control
Platform infrastructure
Vulnerability management
Encryption in transit and at rest
Logging and Monitoring
Assurance Reviews
Disaster recovery and business continuity
Cloud security
Data sharing

To find out more about the platform, please visit the Area9 Lyceum website.

Artificial Intelligence (AI) within the platform

The AQA Stride platform uses AI to select the most relevant content to show a learner at a given time. Data used is: how other learners have performed on the same content and how the learner themselves has performed. Metrics are scores, timings, answers, metacognition, as well as the structure and priorities of the learning objectives.

The algorithm does not have access to any metadata about the user, and thus it cannot utilise any specific personal information about the user. Neural network machine learning is also used to estimate the time required to complete content. This is done using historical data from the population of learners, as well as semantic analysis of the content text using word-vectors. The result is trained to fit the data and serves as the initial guess for time requirements.

The platform also utilises math probe, which can be used when solving math problems. It allows the learners to enter their work towards the solution. The underlying math engine uses AI to evaluate the response according to mathematical truths.

The platform does not make solely automated decisions that produce legal effects or similarly significant effects on individuals within the meaning of Article 22 UK GDPR.

To find out more about the platform, please visit the Area9 Lyceum website.

International data transfers

Data is stored in the Frankfurt region of Amazon Web Services which is covered by UK GDPR adequacy in the European Economic Area.

Data sharing and retention

We will not share personal data with third parties other than those required to provide the service to you. The AQA Stride platform does require the use of sub-processors to store data but they are vetted and contracted to the same standards as AQA demand within our Data Protection and ISO27001 certified processes.

AQA will store personal data for the minimum period required, after this point any data will be deleted or anonymised as soon as possible after its use, unless there is a lawful basis to continue to process the data provided. Data will be retained as per our data retention routines and schedules.

If your account is deemed to be inactive, we may review deleting your account and associated personal data after two years.

If you make a valid request for deletion, we will ensure this is carried out in accordance with data protection legislation.

Certain achievement, progress and assessment records may need to be retained for longer where required to demonstrate historic learner attainment, platform usage or contractual obligations.

We may share anonymous data with the wider AQA Group of companies for research purposes but will not involve any personal data. You can find out more about AQA Group of companies by visiting our privacy notice.

Automated decision making

The platform does utilise some AI techniques to: show relevant content to learners, how learners have performed, estimating time to complete content, math probes to evaluate responses against mathematical truths, and to allows learners to put work towards math solutions.

The platform does not make solely automated decisions that produce legal effects or similarly significant effects on individuals within the meaning of Article 22 UK GDPR.

The adaptive learning functionality, content recommendations, estimated completion times and mathematics support tools are designed to support learning and development and are not used in summative regulated high-stakes assessments.

Your rights

As your school or centre is the Data Controller for information processed within the AQA Stride platform, requests to exercise data protection rights should normally be made through your school or centre in the first instance. AQA will assist schools and centres in fulfilling such requests where required. Where AQA acts solely as a processor, requests may need to be referred to the relevant school or centre as controller.

Individuals have several rights under the data privacy legislation. This includes, under certain circumstances, the right to:

Access your data – you can access your data at any time by speaking to your school or centre. We will where required facilitate this process.
Correct your data – you can ask your school or centre to correct any data held about you that is inaccurate.
Request erasure – you have the right to ‘be forgotten’, in certain circumstances. This does not apply if it would prevent the performance of a contract with you. Or if there is another legal requirement for us to keep your data. If erasure is not possible, you may be able to ask your school or centre to restrict processing.
Request the restriction of processing of your data – you can suspend the processing of your data under certain circumstances. For example, pending a review of the accuracy of the data or after you have objected to our use of the data, and we need to establish whether your school or centre may lawfully continue processing it.
Request the transfer of your data – in some cases, you can ask your school or centre to transfer the data you originally provided to yourself or to another company. This only applies to data you provided directly, or that has been observed about you through automated means.
Object to the processing of your data – you can object to our processing of your data for direct marketing purposes, based on stated legitimate interests. In some cases, your school or centre may have compelling lawful grounds to process your data which override your rights and freedoms.
Object to automated decision making – you can also object to the processing of your personal data where profiling is being used to make assumptions about your behaviours or preferences; for example, to target marketing communications. You have the right not to be subject to automated decision making and can require that a human reviews any such decisions.

List of sub-processors

Please see below a list of our sub-processors in relation to AQA Stride:

• Area9 Lyceum for delivery, hosting, support and operation of the adaptive learning platform.
• Microsoft Dynamics 365 CRM for customer relationship management and support services.

Making a complaint

We take the handling of your personal data very seriously. But, if you feel your data is being handled in a way that breaches data protection legislation, you can make a complaint.

For more information on how you can make a complaint to AQA, and your rights surrounding this, please visit this link.

You can also contact our Data Protection Office at GDPRenquiries@aqa.org.uk for further information or to make a complaint too.

You have the right to complain to the UK Information Commissioner if we are unable to resolve your complaint.

Contact us

If you have any questions about the way in which AQA collect, hold, or process your data – or wish to exercise your rights – please contact us at GDPRenquiries@aqa.org.uk.