Candidate Privacy Policy

2. Categories of Personal Data We Collect

To process your examination booking and fulfill statutory examination duties, we collect and process the following categories of information:

• Candidate Identity & Contact Details: Full legal name, date of birth, gender, residential address, email address, and contact telephone numbers.
• Parent/Guardian Information (for under-18s): Full name, relationship to candidate, email address, telephone number, and emergency contact.
• Photographic Identification Documents: High-resolution copies of passports, UK driving licences, Biometric Residence Permits (BRP), or birth certificates for identity verification.
• Educational Identifiers & History: Unique Candidate Identifier (UCI), Unique Learner Number (ULN), previous exam centre numbers, and prior statements of entry/results.
• Special Category Data (Access Arrangements): Diagnostic psychological assessments (Form 8), medical letters, disability documentation, and accommodation evidence submitted to request access arrangements.
• Payment Records: Transaction date, bank transfer reference, cash receipt identifiers, and invoiced amounts (we never store banking passwords or credit card numbers).
• Examination Performance & Assessment Records: Attendance registers, seating charts, component marks, and official grades issued by awarding bodies.

3. Lawful Bases for Processing Under UK GDPR

We process your personal data strictly under valid lawful grounds defined by the UK GDPR (Article 6 and Article 9):

• Performance of a Contract (Article 6(1)(b)): Necessary to register you with awarding bodies, organize examination sessions, conduct invigilation, and issue statements of entry and results.
• Compliance with Legal & Regulatory Obligations (Article 6(1)(c)): Fulfilling mandatory statutory duties imposed by the Joint Council for Qualifications (JCQ), Ofqual, the Department for Education (DfE), and recognised awarding bodies.
• Legitimate Interests (Article 6(1)(f)): Maintaining centre security, preventing examination fraud and malpractice, and managing facility capacity.
• Explicit Consent for Special Category Health Data (Article 9(2)(a)): Where you submit medical or diagnostic evidence to obtain access arrangements, we process this special category data with your explicit consent and for reasons of substantial public interest in the field of education (Article 9(2)(g) / DPA 2018 Schedule 1).

4. Data Sharing & Disclosures

We share candidate personal data strictly with authorized bodies necessary for examination administration:

• Approved Awarding Bodies: Pearson Edexcel, AQA, and OCR to register entries, upload marks, request access arrangements, and retrieve official results.
• Joint Council for Qualifications (JCQ): Via the Access Arrangements Online (AAO) portal and Centre Inspection Service (CIS).
• Learning Records Service (LRS): To verify or assign your Unique Learner Number (ULN) and maintain your Personal Learning Record.
• Department for Education (DfE) & Regulators: Where required by statute or examination board audit.

5. Data Security & Confidentiality

We implement strict physical, operational, and technical security safeguards:

• Encryption at Rest & Transit: All candidate data is encrypted in transit using TLS 1.3 and at rest using AES-256 in secure UK/EU datacentres.
• Role-Based Access Control (RBAC): Personal data is accessible only to authorized examinations staff who require access to perform their official duties.
• Secure Document Storage: Verification identity documents and medical records are kept in private, access-restricted storage vaults.
• Audit Logging: All access, fee assessments, and entry transitions are permanently recorded in immutable operational audit trails.

6. How Long We Retain Your Data

Personal data is retained only for as long as necessary to comply with examination regulations and statutory limitation periods:

• Application and Entry Records: Retained for 5 years following the completion of the examination series to support enquiries about results, certificate verification, and regulatory inspection.
• Identification Document Copies: Securely deleted or destroyed 12 months following final certificate issuance.
• Access Arrangement Evidence: Retained for the duration of the validity period set by JCQ (typically up to 26 months), then securely purged.
• Financial & Invoicing Records: Retained for 6 years to satisfy statutory UK tax and accounting obligations (HMRC).

7. Your Rights Under UK GDPR

Under UK data protection law, candidates and parents (where applicable) have enforceable rights regarding their personal data:

• Right of Access (Subject Access Request): You have the right to request a copy of the personal data we hold about you.
• Right to Rectification: You may request immediate correction of inaccurate or incomplete personal records.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your data where it is no longer required, subject to mandatory statutory examination retention duties.
• Right to Restrict Processing: You may request that we temporarily halt processing while an accuracy or objection claim is verified.
• Right to Data Portability: You may receive your personal data in a structured, commonly used machine-readable format.
• Right to Withdraw Consent: Where processing is based on explicit consent (e.g. access arrangement medical files), you have the right to withdraw consent at any time.

To exercise any of these rights, contact our Data Protection team in writing at exams@sydenhamasc.co.uk. We respond to all verified requests within one calendar month as required by law.