Privacy policy

1. Who are we?

Educoda Ltd (company number 16434698) operates the P16 platform across the following domains: p16.uk, p16.app, p16app.com, sixthform.org, and any subdomain thereof. We provide post-16 admissions and enrolment software to schools, sixth forms and colleges in the United Kingdom, and a P16 profile for students who apply through it.

We are registered with the Information Commissioner's Office (ICO registration number: ZB949031).

Contact details:

• Email: [email protected]
• Registered address: available on request

If you are a student (or parent/carer) and you have questions about how your data is used, you can always email us at [email protected].

2. What This Policy Applies To

This Policy relates to your use of the P16 platform only.

Throughout the platform, we may link to other websites owned and operated by schools, colleges, or third-party service providers. Those websites may also gather information about you in accordance with their own separate privacy policies. For privacy information relating to those third party websites, please consult their privacy policies.

This Policy does not cover how a school or college uses your data once it has received it. Each school or college is responsible (as data controller) for the information it receives from you through the platform, and its own privacy notice explains how it uses that information. Section 3 explains exactly who is responsible for what, and when.

3. Who Is Responsible for Your Data

UK GDPR distinguishes between a data controller (who decides why and how personal data is processed) and a data processor (who processes data on a controller's instructions). Who the controller is depends on which part of your data we are talking about, and what stage you are at.

a. Your account and P16 profile: Educoda is the controller

Your P16 account and profile belong to the platform, not to any one school. You can use the same profile to apply to several schools and colleges, and it stays with you if an application doesn't go ahead. Because we decide what the profile contains, how it is kept and when it is shared, Educoda Ltd is the data controller for your account and P16 profile.

Your P16 profile includes your name and contact details, date of birth, sex, address, school history, qualifications and the grades you predict or have achieved, ethnicity, nationality, religion, languages, SEN and SEA information, Free School Meals eligibility, looked after status, medical and dietary needs, emergency contacts, future plans, photograph, identity documents, and any reference requested from your referee.

b. Your application: the school or college is the controller

When you apply to a school, sixth form or college, we share the information it needs to consider your application. That institution is the data controller for the information it receives, and Educoda acts as its data processor, handling that information only on its instructions (for example, showing it to admissions staff, sending emails on its behalf, or recording its decisions).

Most schools with sixth forms must follow the School Admissions Code. The Code says a school may only ask for, or use, information that has a direct bearing on its published admission arrangements when deciding on an application. It must not use information such as SEN, medical conditions, family details or reports from previous schools. Admissions Code mode is on by default for new schools, and existing schools switch it on from their settings. For schools that follow the Code, the school receives only:

• your name, date of birth, sex, contact details and home address
• the schools you have attended, and your unique pupil number (UPN) where the school asks for it
• your looked after status
• your course choices
• the grades you predict or have already achieved
• answers to any questions linked to its published oversubscription criteria (for example faith or sibling information), and any faith documents you choose to provide
• the name and contact details of one parent or carer

Your unique learner and candidate numbers (ULN, UCI) and any identity documents are received when you submit your enrolment, not at application.

The rest of your P16 profile, including any reference and any grades your referee gives, is not shared with or visible to the school, and plays no part in its decision.

Some providers are not bound by the School Admissions Code (for example some 16 to 19 academies and further education colleges). Where a provider has told us this is the case, it receives your whole P16 profile when you apply, and its own privacy notice explains how it uses it.

c. When you enrol: the rest of your profile is shared

When you take up a place (for example on GCSE results day), the school needs the rest of your profile to support you, keep you safe and meet its legal duties. You will be asked to complete your P16 profile before you submit your enrolment. Once you submit your enrolment, we share your full profile with the school. From then on the school is the controller of the information it has received, and we process it on the school's behalf as its processor. Educoda remains the controller of your P16 profile itself, so you can keep using it.

d. Other purposes for which Educoda is the controller

• Operating and securing the platform (user accounts, authentication, security, fraud prevention)
• Error monitoring and system performance (maintaining platform integrity and reliability)
• Communicating with schools and staff about the platform itself (sales, support, billing, product updates), and with referees about the platform (see section 11)
• Complying with Educoda's own legal obligations (e.g., data protection law, company law)

Educoda and each school or college are separate (independent) controllers, not joint controllers. This Policy covers our processing as a controller in full, and explains how data flows through our systems when we act as a processor. For how a school uses your data, see its privacy notice.

4. Protection of Children's Personal Data

This platform is primarily used by students applying to post-16 institutions - be that a sixth form, college or other educational institution. As such, many users are under 18 years old and are therefore considered children under UK data protection law.

Under the Data (Use and Access) Act 2025 (DUAA 2025), organisations providing online services likely to be accessed by children must take into account "children's higher protection matters". We specifically consider:

• How best to protect and support children when using this service
• That children merit specific protection regarding their personal data, because they may be less aware of the risks and consequences of processing and their rights
• The importance of providing information to children in a clear, plain-language, age-appropriate manner

Our commitments to protecting children:

• We implement age-appropriate safeguards throughout the platform
• We only share sensitive information with a school when it needs it, and (at schools that follow the School Admissions Code) not until you submit your enrolment on results day
• Educoda does not send marketing to students or parents (schools may send you information about their own courses, see section 11)
• We do not use profiling or automated decision-making that could be harmful to children
• We do not sell children's data or share it for purposes unrelated to education
• We provide this information in clear language

Students aged 13 and over can usually exercise their own data protection rights. A parent or carer can also contact us on your behalf, and we may check that you are happy for them to do so.

5. Personal Data We Collect About You

The personal data we collect about you depends on the particular activities carried out through the platform and your interactions with us or the educational institution you are applying to.

Student personal data

• Full name, preferred name
• Date of birth, sex/gender
• Email address, phone number, home address
• Photograph (used so staff can recognise you; it is not used for facial recognition)
• Ethnicity and nationality
• Religion or belief
• First language and home language
• Special Educational Needs and Disabilities (SEND) information and Special Educational Arrangements (SEA) information
• Looked After Child (LAC) status
• Free School Meals (FSM) eligibility
• Medical needs, allergies and dietary requirements
• Academic history, qualifications, predicted grades and final exam results
• Unique Learner Number (ULN), Unique Pupil Number (UPN), Unique Candidate Identifier (UCI)
• Career and university aspirations
• Emergency contact details (parents, carers, guardians)
• Identity documents and results certificates you upload
• Payment status for any fees or deposits a school charges (card details are handled by Stripe and never reach us)

Parent, carer and referee personal data

• Name, email address, phone number
• Relationship to the student
• Address (where the same as the student or separately provided)
• Predicted grades and reference information (for referees such as teachers)
• School or college affiliation and role (for referees)

Technical and usage data

• IP address and browser/device information (collected by our hosting and security providers, and by the services that deliver web fonts and code libraries, see section 9)
• Platform activity logs (actions taken on the platform, timestamps)
• Session data (maintained for the duration of your session)
• Error reports (technical details of the error and the page address; we configure our error monitoring not to send names, email addresses or IP addresses)

Data received from the Department for Education ("DfE")

Where a school or college has registered with the DfE and asked for it, we may receive your education record from the DfE's View Education Record (VERA) service, usually after you have chosen to share it. The record can include your ULN, date of birth, sex, address, school history, exam results, and SEN and Free School Meals information. The school is the controller of this record and we process it on its behalf, to check and pre-fill your results. At schools that follow the School Admissions Code, SEN and Free School Meals information in the record is not shown to staff until you submit your enrolment on results day. The DfE's own privacy notice explains how it shares this data.

Whether you must provide personal data

Some information is needed to create an account and to apply. Where something is required, the form will tell you. Where you have a choice, we will tell you, along with what (if anything) happens if you don't provide it.

• To create an account: name and email address.
• To apply (at schools that follow the School Admissions Code): date of birth, contact details, home address, looked after status, a parent or carer's contact details, qualifications and predicted grades, and course choices. Some schools also ask questions linked to their oversubscription criteria.
• To enrol: the rest of your P16 profile, including diversity information, SEND information, medical and dietary needs, emergency contacts and future plans. The school needs this to support you and to meet its legal duties (for example the school census).
• Optional: a photograph, and a referee. At schools that follow the School Admissions Code, a reference is never a condition of your application.

Schools that are not bound by the School Admissions Code may ask for more of your profile when you apply.

Information for referees

If you are a referee (teacher or school staff member) providing a reference for a student:

• You must provide or otherwise verify your contact details (name, email, school affiliation) to submit a reference; this is necessary to verify the authenticity of the reference
• We will use your contact details for two purposes: (1) to facilitate the reference process for the student, and (2) to send you marketing communications about our platform and services (you can opt out of marketing at any time, see section 11)
• Your reference forms part of the student's P16 profile, which Educoda controls. Where the student applies to a school that follows the School Admissions Code, your reference and any grades you give are not shown to the school or used in its admissions decision. They are only shared once the student's enrolment there has been approved. Schools not bound by the Code receive them with the application.

6. How Your Personal Data is Collected

We collect personal data from you:

• Directly, when you enter or send us information, such as when you:
  • Register an account on the platform and complete your P16 profile
  • Complete and submit an application or enrolment form
  • Upload documents (such as exam results, certificates, identity documents or photographs)
  • Contact us via email or support channels
  • Participate in surveys or provide feedback
  • Book appointments or respond to invitations (e.g., taster days, results day slots)
  • Make a payment a school has asked for
  • Provide a reference for a student (for referees) - when you do this, we collect your contact details both to facilitate the reference and because we have a legitimate interest in contacting you about our platform and services
• Indirectly, such as:
  • From referees (teachers) who submit predicted grades or references for you
  • From the school or college you apply to (for example its decisions, meeting notes, or results it imports for its own students)
  • From your school's management information system through Wonde, where your school uses this integration (for example, if you are already a student there)
  • From the Department for Education via the VERA service (where requested by the school)
  • From Stripe, which confirms whether a payment succeeded
  • From our technology and security providers in the course of providing services to us (e.g., Cloudflare may collect network data for security purposes)

7. How and Why We Use Your Personal Data

Under data protection law, personal data can only be used where there is a proper reason (a "lawful basis"), for example:

• where you have given consent
• to comply with legal and regulatory obligations
• for the performance of a contract with you or to take steps at your request before entering into a contract
• for legitimate interests, so long as these are not overridden by your own rights and interests
• for the performance of a task carried out in the public interest (available to schools and other public bodies, not to Educoda)

Under DUAA 2025, new lawful bases called "recognised legitimate interests" have been introduced for specific purposes such as crime prevention, safeguarding vulnerable people, and national security. We do not currently rely on recognised legitimate interests.

a. Where Educoda is the controller

Where we rely on legitimate interests, we have carried out a balancing test to make sure our interests are not overridden by your rights. You have the right to object to processing based on legitimate interests.

b. Where we act for a school or college (as its processor)

For the following, the school or college decides the lawful basis and explains it in its own privacy notice. Maintained schools and academies usually rely on public task (providing education) and legal obligation (for example the school census and safeguarding duties).

• Considering your application against the school's published entry requirements and admission arrangements, including checking your predicted or achieved grades
• Sending you messages about your application, meetings, taster days, offers and results day
• Taking payments the school has asked for
• Checking your results and education record (including through the DfE's VERA service)
• Enrolling you and passing your details to the school's management information system
• Supporting safeguarding, inclusion and pastoral care once you are enrolled
• Statutory reporting to the DfE and other regulators
• Sending information about the school's own courses and events to people who have asked for it through an enquiry form (consent)

8. Special Category and Sensitive Personal Data

Some of the personal data in your P16 profile is special category data under Article 9 of the UK GDPR, which receives extra protection:

• Racial or ethnic origin (ethnicity)
• Religion or belief
• Health data (medical needs, allergies, and dietary requirements where they reveal a health condition)
• Data concerning disability (SEND and SEA information)

Looked after status and Free School Meals eligibility are not special category data, but they reveal social vulnerability, so we protect them in the same way. Your photograph is not special category data because we do not use it for facial recognition. First language is not special category data in itself, though it may sometimes indicate ethnic origin, so we treat it with the same care.

a. While your P16 profile is held by Educoda

Before any school needs it, we hold your special category information on the basis of your explicit consent (Article 9(2)(a) UK GDPR). We ask for it with a tick-box when you add the information to your profile, and record when you gave it. You don't need to give this information, or your consent, to apply to a school that follows the School Admissions Code.

You can withdraw consent at any time using the Withdraw consent button on your learner details page, or by contacting us. When you do, we delete your ethnicity, religion, SEN and health details from your P16 profile.

We don't ask for consent where a school already needs the information under its own lawful basis, because consent has to be freely given. That is the case once you start enrolling with a school (for example on results day), and when you apply to a provider that is not bound by the School Admissions Code. The information is then collected for that school, which explains its basis in its privacy notice (see below). If you withdraw consent at that point, the school keeps the information it needs; contact the school if you want it changed.

b. Once a school or college receives it

The school or college relies on its own Article 9 condition and explains it in its privacy notice. For schools these are usually:

Under the School Admissions Code, a school that follows the Code must not ask for or use this information when deciding on your application. On P16, staff at those schools cannot see it, and their admissions rules cannot use it, until you submit your enrolment on results day.

9. Who We Share Your Personal Data With

We share your personal data with the following recipients:

a. The schools and colleges you apply to

This is the main purpose of the platform. Each school or college you apply to receives the information described in section 3. At schools that follow the School Admissions Code, that is your application to start with, and the rest of your P16 profile once you submit your enrolment on results day. Schools you have not applied to never see your data. Each school is the data controller for what it receives and uses it under its own privacy notice.

b. Department for Education (DfE)

Where a school has asked for it, we receive your education record from the DfE's VERA service on the school's behalf (see section 5). Schools may also pass data to the DfE for statutory purposes such as the school census; they do this under their own legal obligations.

c. Technology service providers (sub-processors)

We use a number of third-party technology suppliers to operate the platform. They are bound by data processing terms and may only process personal data on our instructions and in accordance with UK data protection law.

We only allow these organisations to handle your personal data if we are satisfied they take appropriate measures to protect it, and they may only use it to provide services to us and to you.

d. Data integration (Wonde)

Where your school chooses to connect its management information system to P16, Wonde passes the student details your school authorises from its MIS to P16. Wonde acts on your school's instructions, and your school controls which data is shared. Wonde processes data in the UK.

e. Other recipients

We or the third parties mentioned above may occasionally also share personal data with:

• External auditors in relation to any audit of our accounts (the recipient will be bound by confidentiality obligations)
• Professional advisors (such as lawyers) for legal advice (the recipient will be bound by confidentiality obligations)
• Law enforcement agencies, courts, tribunals and regulatory bodies to comply with our legal and regulatory obligations
• Other parties that have or may acquire control or ownership of our business (and their professional advisers) in connection with a merger, acquisition, or sale. Information will be anonymised where possible and recipients will be bound by confidentiality obligations.

We do not sell, rent or trade personal data to any third party for their own commercial purposes.

10. How Long We Keep Your Personal Data

We only keep your personal data for as long as necessary for the purposes described in this notice, or as required by law. Different retention periods apply for different types of personal data.

Schools and colleges may keep the information they have received for longer under their own policies or statutory requirements (e.g., safeguarding records). After the applicable retention period, data is securely deleted or irreversibly anonymised.

Note on DUAA 2025: When responding to subject access requests, we conduct "reasonable and proportionate" searches. Data stored in backups or archives beyond normal retention periods may not be retrieved unless it is reasonable and proportionate to do so.

11. Marketing

Marketing to students

Educoda does not send marketing communications directly to students or parents about our platform or services.

Where a school or college uses this platform to send marketing communications to prospective students (e.g., open day invitations, course information), the school is responsible for them and this is only done where:

• The recipient has provided consent via an enquiry form submitted to that institution, or
• A prior relationship with the institution exists and the communication relates to similar educational services (the "soft opt-in" under Regulation 22 of the Privacy and Electronic Communications Regulations 2003)

Every marketing email sent via this platform on behalf of an institution includes an unsubscribe link. You can use this at any time to opt out of further marketing from that institution.

Marketing to referees (teachers and school staff)

We may use the contact details of referees (teachers and other school staff) who provide references through this platform to send marketing communications about our platform and services.

Lawful basis: We rely on our legitimate interest in promoting our platform to educational professionals who may benefit from using it, either personally or by recommending it to their schools or colleges. Where electronic marketing rules (PECR) require consent for a particular message, we will ask for it first.

We have carried out a legitimate interests assessment and determined that our interest in marketing to educational professionals is not overridden by your interests, rights and freedoms, because:

• As an educational professional who has used this platform, you have a reasonable expectation that we may contact you about similar services
• Our marketing is directly relevant to your professional role and activities
• You can easily opt out at any time (see below)
• We do not send excessive communications
• We do not share your data with other organisations for their marketing purposes

What marketing communications may include

Marketing communications to referees may include:

• Updates about new features on the platform
• Information about how the platform can benefit your school or college
• Case studies and best practices from other educational institutions
• Invitations to webinars or training sessions
• Information about our other products or services that may be relevant to your role

Your right to opt out

You have the right to opt out of receiving marketing communications from us at any time by:

• Using the 'unsubscribe' link in any marketing email we send you
• Emailing us at [email protected]

We will process your opt-out request within 2 working days and you will not receive further marketing communications after that time. This will not affect any transactional or service-related communications (e.g., notifications about students whose references you have provided).

Email tracking

Some emails sent via this platform may contain a tracking pixel (a 1×1 pixel transparent image) and tracked links to help us and the sending school understand whether communications have been received. When you open an email, the tracking pixel loads and records that the email was opened. When you click a link, the click is recorded before you are redirected.

We use this information to:

• Understand which communications are most useful to recipients
• Improve the relevance and timing of our communications
• Follow up with important information if communications have not been opened

The lawful basis for email tracking is legitimate interests (ensuring important communications reach recipients and improving our service). You have the right to object to this processing. You can also block it by turning off automatic image loading in your email app.

What we will never do

We will never:

• Sell or rent your data to other organisations for their marketing purposes
• Share your data with other organisations outside our group for marketing purposes
• Send you marketing about products or services wholly unrelated to education or our platform
• Use your data to market to the students whose references you provided

12. Transferring Your Personal Data Outside the UK

Countries outside the UK have differing data protection laws, some of which may provide lower levels of protection of privacy. Where we transfer your personal data outside the UK, we comply with UK law designed to keep it protected.

Most of our data processing happens in the UK or the European Economic Area (EEA), which the UK recognises as providing adequate protection.

Under DUAA 2025, the test for international data transfers has been updated. We must ensure that the standard of data protection in the receiving country is "not materially lower" than the standard in the UK.

Where we transfer your personal data

Amazon Web Services (email delivery), Ideal Postcodes (address lookup), Wonde (MIS integration) and the DfE VERA service process data in the UK, so no international transfer takes place.

13. Automated Processing and Decision-Making

Under Article 22 of the UK GDPR, as amended by DUAA 2025, you have rights regarding automated decisions made about you.

What automated processing takes place

Schools and colleges can set rules on the platform that are applied automatically:

• Entry requirement checks: the platform checks your predicted or achieved grades against the school's published entry requirements (for example a minimum average point score, or a grade in GCSE maths for A-level maths) and flags the result to admissions staff.
• Grouping and conditional offers: a school can group applications using rules, and can choose to make conditional offers automatically when an application meets its entry requirements.
• Applications below the entry requirements: a school can choose to process all applications at once, and those whose predicted grades fall below its published minimum entry requirements are marked as not meeting them and the student is told by email. This is started by a member of staff, but the outcome for each student is decided automatically by the school's rules.
• Reminders: automated reminders are sent to applicants and referees based on time-based rules.
• CAPTCHA verification: Cloudflare Turnstile automatically assesses whether form submissions are from a human user, and may block submissions it assesses as coming from a bot.

Safeguards

• Automated admissions rules only use information that the school's published admission arrangements rely on, such as grades. At schools that follow the School Admissions Code, they cannot use special category information (such as ethnicity, religion, SEN or health) or references.
• At schools that follow the School Admissions Code, being marked as not meeting the entry requirements on predicted grades is never final. If your actual results meet the requirements, you can still enrol on results day on the same basis as everyone else.
• Decisions on enrolment are made by a member of staff at the school.
• You can ask the school for a member of staff to review any automated outcome, ask for an explanation, give your point of view and challenge it.

Your rights regarding automated processing

You have the right to:

• Be told when a significant decision about you has been made by automated means
• Ask for human intervention and review of the decision
• Receive a meaningful explanation of the logic involved and its consequences
• Express your point of view and contest the decision

Because the school makes the admissions decision, please contact the school or college first. You can also contact us at [email protected] and we will pass your request on.

14. Cookies and Similar Technologies

A cookie is a small text file placed on your device (e.g., computer, smartphone or other electronic device) when you visit a website. We use cookies to make this platform work correctly and securely.

14a. Strictly necessary cookies

These cookies are essential for the platform to function. They do not require your consent under the Privacy and Electronic Communications Regulations 2003 (PECR) because they are strictly necessary to provide the service you have requested.

Stripe may set its own cookies on its hosted payment page to prevent fraud. These are covered by Stripe's privacy policy.

14b. Analytics and non-essential cookies

We do not use advertising cookies or cookie-based analytics (such as Google Analytics) anywhere on this platform. No non-essential cookies are set.

Our public marketing pages (the pages describing the product, not the school portals you log in to) use Cloudflare Web Analytics to count page views. It is cookie-free, does not store personal data or track you across sites, and records only aggregate information such as the page visited, referring site, browser type and country.

14c. Your cookie choices

Because we only use strictly necessary cookies, we are not required by PECR to obtain your consent before placing them. You cannot opt out of strictly necessary cookies without significantly affecting how the platform works (e.g., you would not be able to remain logged in or submit forms securely).

You can control and delete cookies through your browser settings. For guidance, visit:

• ICO guidance on cookies
• www.aboutcookies.org

If you disable cookies, please be aware that you may lose some of the functionality of the platform.

15. Your Rights

Under the UK GDPR, DPA 2018, and DUAA 2025, you have the following rights regarding your personal data. You can usually exercise these rights free of charge.

Who to ask: For your account and P16 profile, Educoda is the controller, so ask us. For the information a school or college has received from you (your application, and your full profile once you enrol there), the school is the controller, so ask the school. If you are not sure, ask us and we will either deal with it or pass it on.

If you are under 18: You can usually exercise these rights yourself from age 13. A parent or carer can also act for you; we may ask for proof of the relationship, and may check with you, to protect your data.

For further information on each right, including the circumstances in which they apply, please contact us or refer to the ICO's guidance for the public.

16. How to Exercise Your Rights

1. Self-service: Some rights can be exercised directly on the platform:
   • Edit your P16 profile to correct inaccurate data or remove optional information
   • Unsubscribe from marketing emails using the link in each email
2. Email us: For anything else, email [email protected] with:
   • Your full name and email address registered on the platform
   • A clear description of your request and the right you are exercising
   • Proof of identity where we need to verify who you are (for example for Subject Access Requests)
3. Response time: We will acknowledge your request within 5 working days and respond in full within 1 calendar month. If your request is complex or numerous, we may extend this by a further 2 months (you will be notified). Under DUAA 2025, we may pause the one-month response period if we need further information from you to verify your identity or clarify the scope of your request. The clock resumes once we receive your response.
4. Reasonable and proportionate searches: For Subject Access Requests, we search the systems and locations where your data is reasonably likely to be held, but are not required to search every possible system if doing so would be disproportionate to the request.
5. No fee: Rights requests are free of charge. We may charge a reasonable fee only where requests are manifestly unfounded or excessive.
6. Requests about data a school controls: If your request is about information a school or college has received from you, we will pass it to them promptly and tell you. The school is responsible for responding, and we will help it to do so.

17. How to Complain

If you are unhappy with how we have handled your personal data, please let us know. We hope we will be able to resolve any issues you may have.

Complaints to Educoda Ltd

Under the Data (Use and Access) Act 2025, we must provide a clear and accessible way to make complaints about how we process your personal data.

How to complain:

• Email: [email protected] with the subject line "Data Protection Complaint"

What happens next:

1. We will acknowledge your complaint within 30 days of receiving it
2. We will investigate your complaint and respond without undue delay
3. We will explain our findings and any action we have taken or will take
4. If you are not satisfied with our response, we will explain how you can escalate your complaint to the Information Commissioner's Office (ICO)

Complaints about a school or college

If your complaint is about how a school, sixth form or college has used your data, or about an admissions decision, contact that institution directly using its complaints procedure. Concerns that a school's admission arrangements do not follow the School Admissions Code can also be raised with the Office of the Schools Adjudicator. We can help direct your complaint to the right place.

Complaints to the Information Commissioner's Office (ICO)

You have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent data protection regulator. Under DUAA 2025 the ICO may expect you to raise your complaint with us first, though you can contact it at any time.

• Website: ico.org.uk/make-a-complaint
• Phone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

18. Keeping Your Personal Data Secure

We have appropriate security measures in place to prevent personal data from being accidentally lost, or used or accessed unlawfully. We limit access to your personal data to those who have a genuine business need to access it.

We also have procedures in place to deal with any suspected data security breach. We will notify you and the Information Commissioner's Office of a suspected data security breach where we are legally required to do so, and we will tell any affected school or college without undue delay.

Security measures include:

• Encryption of data in transit (HTTPS/TLS) and at rest (AES-256)
• Access controls and authentication (passwords, multi-factor authentication for staff)
• Separation between schools, so staff at one school cannot see another school's applicants
• A database that only our own servers can reach, over a private network
• Staff at schools that follow the School Admissions Code cannot see the rest of a student's P16 profile until they submit their enrolment on results day
• Regular security monitoring and logging
• DDoS protection and bot mitigation (Cloudflare)
• Daily encrypted backups held in two separate locations, with point-in-time recovery
• Data processing terms with all sub-processors requiring appropriate security measures

If you want detailed information from Get Safe Online on how to protect your information and devices against fraud, identity theft, viruses and many other online problems, please visit www.getsafeonline.org. Get Safe Online is supported by HM Government and leading businesses.

19. Changes to This Privacy Policy

We review this privacy notice regularly to ensure it reflects our current practices and complies with applicable law, including changes arising from the implementation of the Data (Use and Access) Act 2025.

We may change this privacy policy from time to time. If we make a significant change, such as a change to who is responsible for your data, we will tell you by email or on the platform before it takes effect.

October 2026: we explained the P16 profile, clarified that Educoda is the controller of it, described how information is shared with schools in stages under the School Admissions Code, corrected our list of service providers (adding Stripe and the services that deliver web fonts and code libraries), and updated how we describe automated decisions. We also corrected our hosting location to Germany, described how data is encrypted at rest and backed up, extended the time erased data can remain in encrypted backups to 13 weeks, and added Wonde for schools that connect their MIS.

Previous versions of this privacy notice are available on request by emailing [email protected].

20. How to Contact Us

You can contact us by email if you have any questions about this privacy policy, the information we hold about you, to exercise a right under data protection law, or to make a complaint.

Contact details:

• Email: [email protected]
• Subject line for rights requests: "Data Protection Rights Request"
• Subject line for complaints: "Data Protection Complaint"
• Registered address: Available on request via email

When contacting us, please provide:

• Your full name and email address registered on the platform
• A clear description of your query, request, or complaint
• Any supporting documentation (e.g., proof of identity for rights requests)

We aim to respond to all enquiries within 5 working days.