GDPR Privacy Notice

This GDPR Privacy Notice explains how AP.aiparakh-AaravGPT Cooperation Limited ("we", "us", "our") collects, uses, stores, and protects personal data when you use the AI EPQ, HPQ & Bronze CREST Award Checker (the "Service").

It is published as a standalone legal page alongside our Terms & Conditions. Where the two documents differ, this Notice governs the handling of your personal data.

We are committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

For the purposes of UK GDPR, the data controller of your personal data is AP.aiparakh-AaravGPT Cooperation Limited. The participating school acts as a joint or independent controller for the pupil data it provides, in line with its own data protection registration with the Information Commissioner's Office (ICO).

If your school has appointed a Data Protection Officer (DPO), questions about how your data is handled within the school should be directed to them first. You may also contact us at the support team.

Account data: your email address, display name, and role (student or staff), as supplied by your school account or entered at registration.

Project data: the titles, uploaded files (e.g. PDFs and photos of handwritten work, including camera-captured exam papers), and pasted text of project work you submit for assessment, together with AI-generated marks, grades, and written feedback.

Usage data: limited records such as sign-in times, project status changes, and messages exchanged with teaching staff or Study Buddies.

We do not knowingly collect special category data (such as health, ethnicity, or religion). Avoid including such information in your submitted project work unless your teacher advises it is necessary.

We rely on the following lawful bases under UK GDPR Article 6:

(a) Public task — processing is necessary for a task carried out in the public interest or in the exercise of official authority vested in the school (the provision of education).

(b) Legitimate interests — operating, securing, and improving the educational Service, in ways that are proportionate and expected by users.

(c) Consent — for optional features (for example, sharing a draft with a Study Buddy), which you can withdraw at any time without affecting the lawfulness of processing already carried out.

Where processing is based on consent, you have the right to withdraw consent at any time by contacting your school's administrators or the email below.

Your data is used to: provide AI assessment and feedback; store your projects in your personal folder; display anonymised leaderboard rankings; allow authorised teaching staff to monitor and support your progress; and maintain the security and integrity of the platform.

Project submissions are sent to third-party AI providers solely to generate feedback. We select providers that offer appropriate technical and organisational safeguards, and we minimise the data shared to what is required for marking.

We do not use your personal data for marketing, profiling, or automated decision-making that produces legal or similarly significant effects about you.

Your data is shared only with: (a) your school's authorised administrators and teachers; (b) trusted service providers necessary to run the platform (such as hosting and AI marking services); and (c) authorities where disclosure is required by law.

Some AI and hosting providers may process data outside the UK. Where this happens, we rely on appropriate safeguards such as UK International Data Transfer Agreements, Standard Contractual Clauses, or recognised adequacy decisions, and we transfer only the minimum data necessary.

We never sell your personal data.

We retain your account and project data for the duration of your studies and for a reasonable period afterwards to support appeals, quality assurance, and awarding-body requirements.

After this period, personal data is deleted or anonymised so that it can no longer identify you. Banned accounts have their associated data permanently deleted.

If you leave the school before the retention period ends, you may request earlier deletion subject to the exceptions in UK GDPR Article 17(3).

Under UK GDPR you have the right to:

(a) be informed about how your data is used (this Notice); (b) access your personal data; (c) rectify inaccurate or incomplete data; (d) erase your data (the "right to be forgotten"), subject to legal exceptions; (e) restrict processing; (f) object to processing; (g) data portability; and (h) withdraw consent where processing relies on it.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been handled unlawfully. We would, however, appreciate the chance to address your concerns first.

To exercise any of these rights, contact your school's administrators or Aarav Parakh at the support team.

The Service is used by school-age students. Where a student is under 13, the school is responsible for obtaining any necessary parental or guardian consent and for providing appropriate privacy information, in line with the age-appropriate design code and DPA 2018.

We design the Service to minimise the personal data collected from children and to avoid using it in ways that are detrimental to their wellbeing.

The Service uses essential storage (such as session tokens and your accessibility preferences) to function and keep you signed in. These are necessary for the Service to operate and are not used for advertising or tracking.

We do not use non-essential cookies that track you across other websites. You can clear local storage in your browser settings, which will sign you out.

We apply appropriate technical and organisational measures to protect your data, including access controls, encryption in transit, row-level access restrictions, and regular review of administrator privileges.

Access to student data is limited to the student themselves and to authorised school staff. No single non-owner account can read another student's private projects.

In the unlikely event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO without undue delay and, where appropriate, notify affected individuals.

If you believe a breach has occurred, please report it immediately to your school's administrators or to the support team.

We may update this Privacy Notice from time to time to reflect changes in the law or in how the Service operates. Material changes will be communicated through the platform or via your school.

Continued use of the Service after changes take effect constitutes acceptance of the updated Notice.

For any questions about this Privacy Notice, your data, or your rights, please contact your school's administrators in the first instance, or Aarav Parakh at the support team.

You may also raise a complaint with the Information Commissioner's Office (ICO): Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — ico.org.uk.