Privacy Policy

Last reviewed: October 2026 · Next review: October 2027

1. Who We Are

London Elite Exams Limited, trading as London Elite Exams ("we", "us", "our"), is an independent examination entry service for private candidates. We arrange entries with awarding bodies and seats at JCQ-registered partner examination centres in London. For the personal data described in this notice we are the data controller: London Elite Exams Limited, a company registered in England and Wales (company number 17499558), registered office Office 2070, 60 Tottenham Court Road, Fitzrovia, London, W1T 2EW.

This notice explains what we collect, why, on what legal basis, who receives it, how long we keep it and what your rights are, as required by the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003. It applies to candidates, parents and guardians, people who make an enquiry, newsletter subscribers and visitors to londoneliteexams.co.uk. It should be read with our Cookie Policy, Terms & Conditions and Safeguarding & Child Protection Policy.

2. The Data We Collect

We collect only what an awarding body, a partner centre or the law requires for a valid examination entry, plus what we need to run the service.

We do not collect criminal-offence data, and we do not make any decision about you by automated means or profiling. If you give us information about another person (for example an emergency contact), please make sure they know you have done so.

3. Why We Use It and Our Lawful Basis

Special category data. Health and disability information is used only to apply for, arrange and deliver access arrangements or special consideration. We process it on the basis of:

• your explicit consent (UK GDPR Art. 9(2)(a)), given when you tell us about a need and upload evidence — you may withdraw it at any time, although the arrangement cannot then be applied for or kept in place; and
• where applicable, substantial public interest (Art. 9(2)(g)) under Schedule 1, Part 2 of the Data Protection Act 2018 — equality of opportunity or treatment for disabled candidates, and the safeguarding of children and individuals at risk.

This information is seen only by the staff who handle access arrangements, the partner centre's SENCo / exams officer and the awarding body, and it is never used for any other purpose.

4. Children's Data

Many of our candidates are under 18. For those candidates the booking is made by a parent or legal guardian, who is our main point of contact and receives all significant communications. We collect no more about a child than the examination entry requires, we do not use children's data for marketing, and we do not publish images of candidates. A young person who is able to understand their rights may exercise them personally.

5. Who We Share Data With

Data is shared only where the examination entry requires it, and only the minimum needed:

• Awarding bodies — AQA, Pearson Edexcel, OCR, Cambridge International and WJEC Eduqas (and the professional body for professional examinations) — to make the entry, issue results and certificates, and deal with post-results services and malpractice. Each is an independent controller with its own privacy notice.
• JCQ-registered partner examination centres — to verify your identity, seat you, supervise the examination and put any access arrangement in place. Each centre is an independent controller for what happens on its premises, including any CCTV it operates.
• The Joint Council for Qualifications (JCQ) — through Access Arrangements Online (AAO), for arrangements that need awarding body approval, and through the JCQ centre inspection service.
• Service providers acting on our instructions (processors): Google Cloud / Firebase (database), our web hosting and email provider, and Google Analytics and Google Tag Manager (unless you reject analytics). If you contact us on WhatsApp, Meta processes that conversation under its own terms. They may use the data only to provide their service to us.
• Authorities — local authority children's or adult social care, the police, HMRC or a court, where the law requires or permits it.
• Professional advisers and a successor business — our accountants and legal advisers under a duty of confidence, and a buyer of the business if it were ever transferred, on the same terms as this notice.

6. International Transfers

Awarding bodies and partner centres are in the United Kingdom (Cambridge International also operates internationally). Some of our service providers store or process data outside the UK — in particular our web hosting provider's servers, which are located in Singapore, and Google's cloud infrastructure — and members of our administrative team may access candidate records securely from outside the UK. Where personal data leaves the UK we rely on a UK adequacy regulation where one exists and otherwise on the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with encryption in transit and access controls. You can ask us for details of the safeguard that applies to your data.

7. How Long We Keep It

We keep personal data only for as long as the purpose requires, then delete or irreversibly anonymise it. The periods below are maximums.

Where a complaint, an appeal, a malpractice investigation or a legal claim is open, the relevant records are kept until it is concluded.

8. How We Protect It

• Encryption in transit: every page, form and upload uses HTTPS (TLS).
• Encryption at rest: our candidate database is encrypted at rest with AES-256 by our cloud provider, and the most sensitive values we hold — private booking access tokens and payment-provider keys — are additionally encrypted by us with AES-256-GCM before they are stored.
• Private document storage: uploaded identification and evidence are held in a private store that is not reachable from the public web; a document can be opened only by our authorised staff, the candidate's own signed-in account, or the candidate's private booking link.
• Access control: staff access requires a password and a one-time code (two-step verification); sessions can be revoked centrally; access is limited to those who need it.
• Step-up security for payments: changing the bank account or payment keys through which candidates pay requires an additional one-time code and triggers an immediate security alert, so a compromised login cannot divert payments.
• Audit trail: changes to bookings and payment settings are logged, and every staff sign-in session is recorded and can be ended remotely.

No system is perfectly secure. If a personal data breach is likely to result in a risk to your rights and freedoms we will notify the Information Commissioner's Office within 72 hours of becoming aware of it, and tell you without undue delay where the risk is high.

9. Your Rights

Under the UK GDPR you have the right to:

• access the personal data we hold about you (a “subject access request” or SAR) and receive a copy;
• rectification of anything inaccurate or incomplete — note that details already submitted to an awarding body can be changed only within its amendment rules;
• erasure where we no longer need the data or you withdraw consent, unless we must keep it by law or for a legal claim;
• restriction of processing while a query is resolved;
• object to processing based on our legitimate interests, and to direct marketing at any time;
• data portability for data you gave us that we process by automated means under contract or consent;
• withdraw consent at any time where we rely on it, without affecting what was done before;
• not be subject to a decision based solely on automated processing — we make none.

How to make a request: email info@londoneliteexams.co.uk with the subject “Data Protection Request”, or write to the address at the top of this page. Tell us the candidate's full name and booking reference so we can find the record; we may ask for proof of identity before releasing anything. There is no fee. We respond without undue delay and within one calendar month (normally within 30 days); for a complex request the law allows this to be extended by up to two further months, and we will tell you if that applies. A parent or guardian may make a request on behalf of a child who is too young to understand their rights.

10. Cookies and Marketing

Strictly necessary cookies keep you signed in and your booking secure. Analytics cookies are active by default and are switched off if you choose “Reject”; the full list and how to change your choice are in our Cookie Policy. We send deadline-alert emails only to people who have subscribed to them, and every such email carries a one-click unsubscribe link; using it removes your address from the list and deletes it immediately. You can also simply reply “unsubscribe”. Service emails about your own booking (confirmations, Statements of Entry, reminders about missing documents) are not marketing and are sent as part of the contract.

11. Complaints and the ICO

If you are unhappy with how we have handled your data, please contact us first using the details at the top of this page; we take every concern seriously and will reply within one calendar month. You also have the right to complain to the UK supervisory authority at any time:

12. Changes to This Notice

We review this notice at least once a year and whenever we change what we collect or who we share it with. The “Last reviewed” date at the top shows the current version. If a change materially affects how we use data we already hold about you, we will tell you by email before it takes effect.