Privacy Notice
This notice explains what personal information London Maths & Science College Ltd holds about students, applicants, parents and website visitors, why we hold it, and what you can ask us to do about it.
At a glance
- UK GDPR and Data Protection Act 2018
- No automated decision-making
- No selling of personal data
- Last updated 15 August 2026
An exam centre holds an unusual mixture of information: ordinary contact details, an education record, a national candidate identifier that follows you for life, and, for some candidates, medical and psychological evidence gathered to support an access arrangement. Each is handled differently, and this page says how.
Who We Are, and What This Notice Covers
This document has not yet been reviewed by a solicitor and is a working draft: London Maths & Science College should have it checked by a qualified adviser before the site goes live.
London Maths & Science College Ltd, a company registered in England and Wales with company number 16822143, is the data controller for the personal data described here. That means we decide why and how it is used, and we are responsible for it.
This notice covers students and applicants, parents and guardians, private candidates who sit examinations with us without studying here, people who enquire or book a consultation, and visitors to this website. It does not cover staff and job applicants, who receive a separate notice.
We do not have a statutory obligation to appoint a data protection officer, because we are not a public authority and our processing is not large-scale monitoring. We do have a named internal role responsible for data protection, and you can reach that person through our contact page by marking your message for our data protection contact.
What We Collect, and Why
Most of this comes from you. Some comes from an awarding body, a previous school, or an assessor acting on your behalf.
| Category | Examples | Why we hold it |
|---|---|---|
| Enquiry and application data | Name, contact details, subjects of interest, current grades, what you told us in a consultation | To answer your enquiry and advise you properly before you commit money |
| Enrolment and contract data | Enrolment form, chosen course and payment plan, parent or guardian details where the student is under 18 | To form and perform the contract, and to know who is responsible for fees |
| Education record | Prior qualifications, diagnostic assessment, marked work, mock results, attendance, teacher assessments, predicted grades and references | To teach you, to track progress honestly, and to write a reference that can be justified |
| Examination data | Unique Candidate Identifier, candidate number, entry codes, subjects and boards, access arrangement approvals, results, certificate collection | To make and maintain your entries and to meet awarding body and JCQ requirements |
| Access arrangement evidence | Assessment reports, medical letters, education, health and care plans, evidence of normal way of working | To apply for the arrangements you need, under JCQ regulations |
| Financial data | Payments, instalment schedule, refunds. Card details are handled by our payment provider and are not stored by us | To take payment, issue refunds and meet tax and accounting obligations |
| Safeguarding and welfare | Concerns raised, records of action taken, emergency contacts | To keep students safe and to meet safeguarding duties |
| Correspondence | Emails, messages, notes of telephone calls, complaints and their outcomes | To run the college and to have a record of what was agreed |
| Website data | Pages visited and similar measurement data, where you have agreed or where a statutory exception applies | To keep the site working and to understand which pages are useful, see the cookie notice |
Our Lawful Bases
Under the UK GDPR every use of personal data needs a lawful basis. These are ours.
| What we do with the data | Lawful basis |
|---|---|
| Teach you, mark your work, run mocks, make and maintain your examination entries | Contract, the processing is necessary to perform our agreement with you |
| Take payment, issue refunds, keep accounting records | Contract, and legal obligation for the accounting records |
| Meet awarding body and JCQ requirements, retain records for audit and inspection, report suspected malpractice | Legal obligation and legitimate interests |
| Keep students safe and act on a safeguarding concern | Legal obligation, and vital interests in an emergency |
| Answer an enquiry and follow it up once | Legitimate interests, you asked us a question and it is reasonable to answer it |
| Improve teaching, plan timetables, keep the college secure and running | Legitimate interests, balanced against your interests and rights |
| Send you optional updates about courses you have not enrolled on | Consent, which you can withdraw at any time |
| Set non-essential cookies and similar technologies | Consent under the Privacy and Electronic Communications Regulations, unless a statutory exception applies |
| Apply for access arrangements using health or diagnostic evidence | Contract or legitimate interests for the underlying processing, plus an Article 9 condition, see below |
Where we rely on legitimate interests we have considered whether our interest is outweighed by your rights, and we will explain the assessment if you ask. Where we rely on consent, refusing or withdrawing it does not affect your teaching, your entry or your place.
Special Category Data and Access Arrangements
Evidence submitted for an access arrangement is usually health data, and sometimes data about a disability or a psychological assessment. Article 9 of the UK GDPR prohibits processing that kind of data unless a specific condition applies, so we need a condition as well as a lawful basis.
For access arrangements we rely on your explicit consent under Article 9(2)(a). We ask for it separately, in writing, before evidence is submitted, and we tell you exactly what we will do with the document and who will see it. You can withdraw that consent, and if you do we stop using the evidence, but be clear about the effect: without evidence, an arrangement cannot be applied for or maintained, and one already approved may have to be withdrawn.
Where a safeguarding concern arises, we rely instead on the substantial public interest condition in Article 9(2)(g), together with the condition for safeguarding of children and of individuals at risk in Schedule 1 to the Data Protection Act 2018. Consent is not the basis there, and it would not be appropriate for it to be, a safeguarding record cannot depend on the agreement of the person it concerns.
Access arrangement evidence is held separately from the general student record, is seen only by the staff who need it to make or maintain the application, and is not shared with teaching staff beyond what they need in order to deliver the arrangement itself. The regulations and process are described on the access arrangements page.
Who We Share It with
We do not sell personal data, we do not share it for anyone else’s marketing, and we do not pass student records to agents or recruiters.
We do share it where we have to. Awarding bodies receive entry data, candidate identifiers, access arrangement applications and, where relevant, non-exam assessment marks and authentication records; they are separate controllers with their own privacy notices. JCQ and the awarding bodies’ inspectors may see records as part of centre inspection, audit or a malpractice investigation. Ofqual may see material in connection with an appeal or a regulatory matter. UCAS receives an application and reference where you ask us to submit one.
We also use service providers who process data on our instructions and under contract: a payment provider, email and file storage, and website hosting. They may not use the data for their own purposes.
Beyond that, we disclose data where the law requires it, to a court, to the police in response to a lawful request, to a local authority for safeguarding, or to HMRC. Where a parent is paying and the student is 18 or over, we do not disclose results or academic records to the parent without the student’s agreement. Age brings that decision to the student, not to the payer.
How Long We Keep It
The principle is that we keep data for as long as we need it for the purpose we collected it for, and then delete it. In practice several fixed periods apply.
Financial records are kept for at least six years, because tax law requires it. Examination records, entries, candidate identifiers, results, access arrangement approvals, are kept for the period required by JCQ and the awarding bodies, which runs past the end of the appeals window for the series and long enough to answer a later query about a certificate or a certifying statement. Access arrangement evidence is kept while the arrangement is in force and for the period JCQ requires afterwards, then destroyed securely. Safeguarding records follow statutory safeguarding retention practice, which is longer than everything else.
Enquiries that do not lead to enrolment are deleted within a short period, and consultation notes with them. Marked work and internal assessment records are kept while you are a student and for a limited period afterwards so that we can write or defend a reference.
The detailed retention schedule, with a period against each record type, is one of the items to be finalised before this site goes live. When it is settled we will publish it here rather than describing it in general terms.
Your Rights
These are the rights the UK GDPR gives you over your own data. Ask for any of them in writing through our contact page. There is no fee, and we respond within one month.
- To be informed, to know what we hold and why. That is what this notice is for.
- Of access, to get a copy of the personal data we hold about you, and information about how it is used. This is a subject access request; we may ask you to confirm your identity first.
- To rectification, to have inaccurate data corrected and incomplete data completed. Worth using: a wrong date of birth or a misspelled name on an entry causes real problems later.
- To erasure, to have data deleted where we no longer need it, where you withdraw consent that was the only basis for holding it, or where we have handled it unlawfully. It does not apply where we must keep the record for a legal obligation, such as an examination or accounting record.
- To restrict processing, to have us hold data but stop using it, for example while we investigate whether it is accurate.
- To data portability, to receive data you gave us, in a machine-readable form, where the processing is based on consent or contract and is automated.
- To object, to object to processing based on legitimate interests, and an absolute right to object to direct marketing at any time.
- Relating to automated decision-making and profiling, the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects. We make no such decisions, so this right has nothing to bite on here.
Automated Decision-Making, Profiling and Artificial Intelligence
We do not make automated decisions about students. Admission, progress, predicted grades, references and access arrangement applications are all decided by people who can explain their reasoning and be challenged on it.
We do not profile students to predict outcomes, and we do not use automated scoring of work as a substitute for marking by a teacher. Where any tool is used to help with administration, a person checks and takes responsibility for the result.
If that ever changes, we will update this notice before the change takes effect and explain the logic involved and the consequences for you.
Where Your Data Is Held
We hold personal data in the United Kingdom wherever we can. Some service providers, for email, storage or hosting, may process data outside the UK.
Where that happens, we make the transfer only if the destination is covered by UK adequacy regulations, or if the contract includes the International Data Transfer Agreement or the UK Addendum to the standard contractual clauses, together with an assessment of the risk in that country.
You can ask us which providers are involved and where they process data, and we will tell you.
Security, and What Happens If Something Goes Wrong
Access to student records is limited to staff who need it for their role. Access arrangement evidence and safeguarding records are held separately with tighter access. Devices and accounts are protected, and paper records are held securely.
If a personal data breach occurs and it is likely to result in a risk to people’s rights and freedoms, we report it to the Information Commissioner’s Office within 72 hours of becoming aware of it. If the risk is high, we tell the people affected directly and without undue delay.
Under the Data Protection (Charges and Information) Regulations 2018, organisations that process personal data generally have to pay a data protection fee and register with the ICO. Our registration details will be published on this page once they are confirmed rather than stated here in advance.
How to Complain
Tell us first. Write to our data protection contact through our contact page and say what you think has gone wrong. We will look into it and reply, and we would rather fix a problem than have it explained to us by a regulator.
If you are not satisfied, you can complain to the Information Commissioner’s Office, which is the UK’s independent data protection regulator. Complaining to us first is not a barrier to complaining to the ICO, and using our complaints procedure does not remove any of your rights.
You also have the right to seek a remedy through the courts, and to claim compensation for damage caused by a breach of data protection law.
Questions
Data Protection Questions
No, and asking for it would be misleading. That processing is necessary to perform our contract with you, and some of it, examination records, accounting records, we are required to keep by law.
Consent is the basis only for things you can genuinely say no to without consequence, such as optional updates and non-essential cookies.
The staff who prepare and maintain the application, and nobody else as a matter of routine. Teaching staff are told what arrangement applies, not what the evidence says.
The awarding body sees the application, and may ask to inspect the evidence held on file. JCQ inspectors may also see it during a centre inspection. That is a requirement of the system, and we tell you before the evidence is submitted.
Not without your agreement. Paying the fees makes someone responsible for the contract; it does not give them rights over an adult student’s education record.
We are happy to set up an arrangement where you authorise disclosure to a named person, in writing, and you can withdraw it later.
Make a subject access request in writing through our contact page. There is no fee. We may ask you to confirm your identity, and we respond within one month, extendable by two further months for complex requests, if we need longer we will tell you why within the first month.
You can ask for the whole record or for a specific part of it, and asking for a specific part usually gets you what you actually wanted much faster.
No. We do not use automated decision-making or profiling of any kind. Every decision about admission, progress, a predicted grade, a reference or an access arrangement is made by a person who can explain it.
You can ask, and we will delete whatever we no longer have a reason to keep. We cannot delete records we are required to hold, examination records under awarding body and JCQ rules, accounting records under tax law, and safeguarding records.
We will tell you exactly what has been deleted and what has been kept, and why.
We keep data in the UK wherever we can. Where a supplier processes data abroad, we rely either on UK adequacy regulations or on the International Data Transfer Agreement or UK Addendum, with an assessment of the risk. Ask us and we will tell you which suppliers are involved.
Enquiry and consultation records are deleted within a short period if you do not enrol. If you tell us at the time that you may come back next year, we will keep the enquiry until then and delete it afterwards.
A free diagnostic assessment you sat is deleted on the same basis, unless you ask us to keep it because you intend to enrol later.
Keep reading
Related Pages
Ask Us About Your Data
Oliver Moy
I need help with my Maths course.
AI Assistant
You're in the right place. Let's map out the best study plan for your Maths course.