Last updated: 21/07/2026
1. Introduction
This Privacy Policy explains how Exam Papers Plus Ltd, Company number: 09089974 ("we", "us", "our") collects, uses, shares, and protects personal information when you or your child use Exam Beacon (the "Service"), our AI-assisted tutoring platform for 11+ exam preparation.
We are the data controller for the personal information described in this policy. Our registered office is at 40 Bowling Green Lane, London, EC1R 0NE, United Kingdom and we are registered with the Information Commissioner's Office (ICO) under registration number ZB576998.
Exam Beacon is designed primarily for children aged 8 to 11. Because of this, we take particular care over how we handle children's personal data, and we have written this policy to be as clear as possible. We encourage parents and carers to read it with their child where appropriate.
2. Who uses Exam Beacon
Exam Beacon is used by:
- Children (typically aged 8 to 11) who complete exam preparation activities and interact with the AI study companion.
- Parents and guardians who set up and manage accounts, monitor progress, and make decisions about their child's use of the Service.
- Schools or tutoring organisations (where applicable) that provide access to the Service.
An account is created and managed by a parent, carer, or authorised adult. Children do not create their own accounts.
3. The information we collect
We collect the following categories of personal information.
Account and contact information
- Parent or carer name, email address, and (where provided) telephone number.
- Billing and payment information, which is processed by our payment provider Stripe. We do not store full card details on our own systems.
- The child's first name or display name, year group, and (where provided) age or date of birth, device/session data used to tailor the learning experience.
Learning and performance information
- Answers, responses, and work submitted by the child.
- Photographs of completed printed mock papers. If you use our printed mock exam feature, you upload photographs of your child's completed handwritten paper so we can mark it.
- Progress, scores, time spent, and patterns of activity within the Service.
- Interactions with the AI study companion, including questions asked and feedback given.
- Special educational needs accommodation. Where a parent or carer enables the SEND conditions setting, we record that the child qualifies for extra time or learning support. This is health-related information and is treated as special category data under UK GDPR Art. 9. It is used solely to adjust exam timers and is not shared with third parties or used for any other purpose.
Technical and usage information
- Device type, browser, operating system, and IP address.
- Log data such as access times, pages or features used, and error reports.
- Cookies and similar technologies (see Section 12).
Where we rely on legitimate interests, we have considered the impact on children and have given their interests and rights particular weight, in line with the ICO Children's Code.
The only special category data we ask for is the SEND accommodation flag described above. We do not ask users to provide any other special category data (such as information about health, ethnicity, or beliefs). However, because children can type freely to the AI study companion, their messages may sometimes reveal information about their health or wellbeing; where that happens we handle it as described in Section 4 ("To keep children safe") and our Safeguarding Policy.
4. How we use information and our lawful bases
Under UK GDPR we must have a lawful basis for using personal information. We rely on the following.
- To provide and personalise the Service (lawful basis: performance of a contract, and our legitimate interests in operating an effective learning product). This includes setting up accounts, delivering tutoring activities, adapting difficulty and feedback to the child, and tracking progress.
- To support and communicate with account holders (lawful basis: performance of a contract and legitimate interests). This includes responding to enquiries, sending service-related messages, and providing customer support.
- To keep the Service safe, secure, and working (lawful basis: legitimate interests and legal obligation). This includes preventing misuse, diagnosing problems, and protecting children using the Service, and recording sign-in details (including IP address) for parent and child accounts to keep sessions secure. You can review recent sign-in activity for your own account (device) and sign out other sessions.
- To improve the Service and understand how it is used (lawful basis: legitimate interests, UK GDPR Art. 6(1)(f)). We use product analytics (provided by PostHog, hosted in the EU) to understand how the Service is used — which features are visited and where users encounter difficulty — so we can identify friction and improve the learning experience. Analytics from children's (learner) use of the platform is non-identifying: it carries no name, username, or other identifier that singles out a child, is used only in aggregate, and is never used for profiling, advertising, or shared for those purposes. We have carried out a legitimate-interests assessment giving particular weight to children's interests (Recital 38 and the ICO Children's Code). This analytics is on by default; you can turn it off at any time — for your account and your child(ren) — in Settings (your right to object under Art. 21).
- To keep children safe (safeguarding) (lawful basis: legitimate interests and, where applicable, legal obligation; for special category data, the safeguarding condition in Schedule 1, paragraph 18 of the Data Protection Act 2018). The platform monitors a child's messages and activity for signs that they may be at risk or worried about something. Where something is detected, the platform responds gently to the child at the time and pauses the session, notifies the child's parent or carer — by email and in the parent dashboard — so they can check in on the child, and alerts a responsible member of our team. That team member reviews the concern (automated systems do not decide the outcome on their own) and, where we believe a child may be at risk of significant harm, we will report it to the relevant authorities, such as local authority children's social care or the police. Because a child's messages can reveal information about their health or wellbeing (and, where we contact the police, information relating to possible offences), this can involve special category and criminal-offence data, which we handle under the safeguarding conditions in UK data protection law and only ever to protect the child. We explain this in full in our Safeguarding Policy.
- For marketing (lawful basis: consent). We only send marketing communications to parents or carers, never to children, and only where they have agreed. You can withdraw consent at any time.
- To apply SEND accommodations (lawful basis: explicit consent under Art. 9(2)(a)). Where you enable the SEND conditions setting for your child, we process that information to adjust timers accordingly. This setting is off by default. You can change it at any time from the learner settings page, and withdrawing consent will immediately remove the accommodation from your child's sessions.
Where we rely on legitimate interests, we have considered the impact on children and have given their interests and rights particular weight, in line with the ICO Children's Code.
5. Children's privacy
Protecting children is central to how we have built Exam Beacon. In particular:
- We design the Service so that the best interests of the child are a primary consideration.
- We collect the minimum amount of personal information needed to provide the learning experience.
- We apply high privacy settings by default and do not use children's data in ways that are likely to be detrimental to their wellbeing.
- We do not use children's personal data for behavioural advertising or to build marketing profiles of children.
- We do not sell children's personal data.
- We do not use techniques designed to encourage children to provide unnecessary personal data or to stay engaged beyond what supports their learning.
Parents and carers can review the information held about their child, ask us to correct or delete it, and control how the Service is used. See Section 11 for how to exercise these rights.
If you believe a child has provided us with personal information without appropriate parental involvement, please contact us at policy@exambeacon.com and we will take appropriate steps to address it.
6. Our Beacon, study partner and automated processing
Exam Beacon uses artificial intelligence to provide tutoring, marking, and feedback. This means:
- A child's responses are processed automatically to generate feedback, adapt difficulty, and suggest next steps.
- This processing supports the child's learning and does not produce legal effects or similarly significant effects on the child.
- A human reviews the design and behaviour of the AI study companion, and parents and carers can see the feedback and progress information the Service generates.
We use Google Cloud Vertex AI to power our AI features. We do not use children's submitted content to train AI models, and our AI provider (Google) does not use prompts or responses to train its models. Content may be processed transiently to generate a response but is not used for model training.
7. Sharing information and our sub-processors
We share personal information only where necessary, and with appropriate safeguards in place. We may share information with:
- Service providers and sub-processors who help us run the Service, such as hosting, payment processing, customer support, analytics, and AI providers.
- Payment processors: billing and payment information is handled by our payment provider (Stripe), who is PCI-DSS certified. We do not store full card details.
- AI service providers: The AI study companion processes your child's responses using Google Cloud Vertex AI, hosted in Google's EU multi-region (data centres within the European Union). We have confirmed that customer data is not used to train Google's AI models.
- Cloud hosting and database providers: our platform and database are hosted with a UK/EEA-based cloud provider.
- Email delivery providers: we use a third-party email service to send service notifications and, where consent is given, marketing communications to account holders.
- Product analytics providers: we use an analytics platform (hosted in the EU) to understand how the Service is used. See Section 12 for detail on what is tracked.
- Schools or tutoring organisations, where they provide access to the Service for a child, limited to what is necessary for that purpose.
- Professional advisers, auditors, and authorities, where required by law or to protect our rights, the Service, or the safety of users.
- A successor organisation, in the event of a sale, merger, or reorganisation, subject to this policy continuing to apply.
- Customer-relationship management: we use a CRM to store parent/carer contact details and a record of our communications with you.
- Workflow automation: we use a third-party workflow automation platform to move information securely between our systems.
We require all sub-processors to protect personal information and to use it only for the purposes we specify.
8. International transfers
We store and process personal information within the UK or the European Economic Area (EEA) wherever possible, and we choose providers that offer UK or EU data centres where we can. Some of the providers we rely on (for example, certain payment and email providers) may process personal information outside the UK or EEA. Where information is transferred outside the UK, we put in place appropriate safeguards, such as UK adequacy regulations or the International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses). You can ask us for more detail using the contact details below.
9. How long we keep information
We keep personal information only for as long as necessary for the purposes set out in this policy, after which we delete it or anonymise it. We keep children's personal information for no longer than we need it. Our general retention periods are:
- Account information: for the duration of the account and for 6 years after closure, reflecting the period in which a legal claim could be brought.
- Children's learning and performance information: this includes answers, scores, activity, interactions with the AI study companion and any photographs of completed printed mock papers you have uploaded. We delete or anonymise this information within 90 days of account closure, unless we are required to keep specific items for a legal reason. We may keep aggregated or anonymised insights that do not identify your child to help us improve the Service.
- Safeguarding records: where we record a welfare concern and our response, we keep it securely for 6 years, then delete it, unless a legal or safeguarding reason requires us to keep it longer.
- Billing records: retained as required by law (6 years from transaction date).
- Support correspondence: retained for 6 years from the date the matter was resolved.
- Marketing preferences: processed until you withdraw consent and for 30 days after this, after which your opt-out is retained indefinitely to ensure we do not contact you again.
When an account is closed, we delete or anonymise your child's learning and performance information within the period set out above, and we keep only the limited account and billing records that we are required to retain for legal reasons.
10. How we keep information secure
We use appropriate technical and organisational measures to protect personal information, including TLS encryption in transit, encryption at rest, hashed credential storage, role-based access controls, and regular review of our security practices. Guardian and learner accounts use separate authentication flows with automatic session expiry. No system can be guaranteed to be completely secure, but we work to protect personal information and to respond promptly to any security incident.
11. Your rights
Under UK data protection law, you (and, for a child, their parent or carer acting on their behalf) have the right to:
- access the personal information we hold;
- ask us to correct inaccurate or incomplete information;
- ask us to delete information in certain circumstances;
- ask us to restrict or object to certain processing;
- ask us to provide information in a portable format; and
- withdraw consent where we rely on it (for example, for marketing).
Because Exam Beacon is used by children, parents and carers can exercise these rights on behalf of their child. We may need to verify your identity and your relationship to the child before acting on a request.
To exercise any of these rights, contact us at policy@exambeacon.com. We will respond within one month, although we may extend this for complex requests and will tell you if we do.
12. Cookies and similar technologies
We use cookies and similar technologies on the Exam Beacon learning platform to operate the Service, remember your preferences, and keep accounts secure — these are essential to running the Service. We also use PostHog, an analytics platform hosted in the EU, to understand how the Service is used — for example, which features are visited and how learners navigate the platform — so we can find and fix friction and improve it. This analytics data is used solely for statistical/analytics purposes and, for learners, is non-identifying; we do not use cookies for behavioural advertising or to profile children. Under PECR as amended by the Data (Use and Access) Act 2025, analytics used only to improve the Service does not require consent — but we give clear notice and an easy opt-out: you can turn analytics off at any time in your account Settings. (Our separate marketing website uses cookies under its own Cookie Policy and consent banner, including the Google Maps widget.)
13. Changes to this policy
We may update this policy from time to time. Where changes are significant, we will tell account holders directly (for example, by email or through the Service) before the changes take effect. The date at the top shows when the policy was last updated.
14. How to contact us and how to complain
If you have any questions about this policy or about how we handle personal information, please contact:
- Exam Papers Plus Ltd (Company number: 09089974)
- 40 Bowling Green Lane, Clerkenwell, London, England, EC1R 0NE
- complaint@exambeacon.com
If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:
- Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Helpline: 0303 123 1113 Website: ico.org.uk
We would, however, appreciate the chance to address your concerns before you approach the ICO, so please do contact us first.
