Privacy Policy: Digital Skills Assessment

1. Data Collection

We collect different types of information depending on how you interact with the Service:

Learners (Assessment Takers)

• Registration Details: To begin an assessment, you are asked to provide your full name and a unique reference number (such as a candidate or customer ID).
• Assessment Responses: We collect your answers to questions, which include multiple-choice selections, interaction coordinates (hotspots), procedural ordering (sequencing), and text inputs (gap-fill and debugging).
• Performance Metrics: We generate scores, proficiency levels, and competency mapping against UK educational standards.
• Security Flags: Certain responses may be flagged if they indicate a potential lack of digital security awareness.

We never collect more than one relevant personal information piece, to ensure compliance with GDPR and not to constitute PII.

Organisation Staff (Administrators and Members)

• Account Details: We collect email addresses and names for authentication and role-based access.
• Audit Logs: We record security-relevant actions such as role changes, password resets, and result exports to maintain system integrity.

Website Visitors

• Demo Requests: If you request a walkthrough, we collect your work email address.
• Bug Reports: If you report an issue, we collect your description of the problem and an optional name.
• Technical Data: We collect IP addresses for the purposes of rate limiting and security monitoring.

2. How We Use Data

• Assessment Services: To provide proficiency mapping and training recommendations.
• Reporting: To generate PDF summaries for learners and data exports for educational providers.
• System Security: To prevent automated abuse through rate limiting and to verify user permissions.
• Customer Support: To respond to demo requests and bug reports.

3. Data Sharing

• With Organisations: Learner results are strictly shared with the specific educational provider (Organisation) that issued the assessment link or token.
• Internal Data Isolation: We use database-level Row Level Security (RLS) to ensure that your data is siloed and never accessible to other organisations on the platform.
• Third-Party Processors: We use infrastructure providers like Vercel (hosting) and Supabase (database and authentication) to operate the service.

4. Data Storage and Retention

• Location: Data is stored securely in the cloud using industry-standard encryption.
• Soft-Deletion: When an assessment record is deleted, we wipe the personal identifying information (name and reference), but retain the score data for organisation credit accounting.
• Local Storage: We use browser local storage to allow learners to review their results on their own device after the assessment is complete.

5. Your Rights

Under the UK GDPR, you have rights regarding your data, including:

• The right to access the personal data we hold about you.
• The right to request the correction of inaccurate data.
• The right to request the deletion of your data.
• The right to object to or restrict certain data processing.

Learners wishing to exercise these rights should primarily contact the educational provider that assigned their assessment, as they act as the Data Controller.

6. Cookies

Essential Cookies

We use essential cookies to manage authenticated sessions and protect against cross-site request forgery (CSRF). These cookies are strictly necessary for the platform to function and do not require consent.

Analytics Cookies (Optional)

With your consent, we use Google Analytics to understand how visitors use the platform, including pages visited, time spent on site, and general navigation patterns. Google Analytics sets cookies (such as _ga and _ga_*) that collect anonymised usage data. Your IP address is anonymised before being sent to Google. These cookies are only set if you consent via our cookie banner. You can withdraw your consent at any time by clearing your browser cookies, after which the banner will reappear.

Cookie Consent Preference

We store a cookie_consent cookie to remember your choice regarding analytics cookies. This cookie is classified as strictly necessary and does not require separate consent. It expires after one year, at which point you will be asked to choose again.

7. Contact Information

For privacy inquiries or to exercise your data rights, please contact: