Privacy Policy

1. Who we are.

   We, the people who run this website, are Options Education Limited, UK Company No. 07355514 (the “Company“),
   e-mail address: [support@options-ed.co.uk] (the “E-Mail Address“).
   
   You can contact us by Post here:
   
   Options Education Limited
   75 Beechcroft Road,
   Swindon
   SN2 7RE
   
   Or by Email - support@options-ed.co.uk

2. How is Options Education connected to schools?

   We collect and process the information you give us on behalf of schools who use our service.  We process your data as part of your use of our product websites and the services they delivers. We deal with your personal data in a confidential and responsible way. The processing of your personal data takes place in compliance with the General Data Protection Regulation (“GDPR”).
    

3. Who is processing your data?

   The Data Controller responsible for processing your personal data is Options Education Limited.

   You can contact us via mail or email at the addresses shown above.

1. Your use of the Option course suitability tool:
   We process any personal data that you give us as a user of this website, for example:

   1. Your registration details, such as you first and last name and which social account you used to sign up with.
   2. The country where you are visiting this website from
   3. Your choice of course surveys and the answers that you give to survey questions.

2. How you browse our website:
   We also use a web analytics service (Google Analytics) to process data that your browser sends us, so that we can learn how people are using our website. We do this so that we can improve the service we give you. Google Analytics records things like:

   Google Analytics also respects your privacy and only stores information in anonymous form. It does not store anything that can identify you as an individual. It merely gives us an indication of how people in general are using our website.

   • Which pages you visit, when and for how long
   • Which website you came to our site from.
   • If loading pages were successful or failed.
   • Which browser you used, your computer’s operating system and language.
3. Registration Data: Students

   Upon registration we collect and process the following information:

   • Your first and last name.
   • Your email address (but only if you sign up with your email address and not your social media account).
   • Which school(s) you have expressed interest in by using this website tool.
   • The country where you were at the time of registration (so that we can demonstrate compliance with data protection law).
   • Registration data such as when you signed up, last use of the website.
   • Data use permissions - which uses of your data you have given us permission for.
4. Registration Data: Schools
   • The name and contact details of the school administrator responsible for managing the school’s account with Options Education.
   • The school name and address details
   • The name and contact details of the person responsible for accounts and payments at the school.

1. Purpose:

   The processing of Data is for the following purposes:

   1. To provide you with the service of better understanding your choice of courses to take.
   2. To provide and improve our services to you and to schools.
   3. To provide anonymous aggregate statistics on site use to individual schools about potential students.
   4. To provide schools with anonymous profiles of classes who are actually commencing courses.
   5. To maintain the security and stability of the Services.

2. Lawfulness of Processing:

   The lawfulness of processing stems from:

   1. Your consent, where we have asked for your explicit consent and
   2. Legitimate Interests: The legitimate interests are to monitor, analyze and improve our services, to support you with any issues, to protect the security, integrity, performance and functionality of our services, and ensure that we are compliant with the legal Digital Age of Consent in the country where you are visiting the website from.

1. Use:

   We use Data that you, as user of the product, have provided us with, only for the purposes outline in section 3 above.

2. Transfer:

   We transmit Data to third parties only, if this is

   1. necessary for the purposes outlined in section 3, (e.g. when we need to identify your country in order to look up the Digital Age of Consent for your country),
   2. in anonymous form as part of a class profile, given to the school you have expressed interest in by using this website,
   3. in anonymous form as part of a fully anonymised research database.
   4. due to a request from a national authority,
   5. due to a court ruling, or
   6. if you have consented beforehand.

1. For some parts of our Services, we use third party providers to process data for us, such as

   1. geoPlugin, France, to identify the country you are in when you register
   2. PayPal (Europe) to process subscription payment for this service by schools
   3. Google, to process anonymous website usage statistics.
2. When using some of the service providers, Data is transferred to recipients in third countries namely the USA. All service providers are part of the EU-US Privacy Shield or otherwise adhere to sufficient data protection standards.

1. How long data will be stored:

   We expect that most users of this service will only do so for a short period of time, while deciding which courses to apply for. EU data protection law says that websites should only keep data for as long as is strictly necessary to provide a service.
   
   We will store your user account data for between 1 and 3 years after your last login to this website. After this time, your data will be converted into a fully anonymous form that cannot be traced back to you, for use in educational research. Following anonymisation, your account will be effectively deleted.
   
   At certain times, most likely during the UK summer months, the school who we are providing this service to will download anonymous profiles of whole classes of students. They will upload a list of the names of students who have accepted places in a class and these names will be used to select which user’s data go into the anonymous profile. These profiles can be used by the school for purposes such as helping to plan lessons. 
   
   If you do not take up a place at this school/college, your account will not be included in the class profile making process and will anonymised and removed 1 year after your last previous login. This is to allow for if you begin looking at courses early in the school year and then return to your login again later.
   
   If you do take up a place at this school, your data will be kept for up to 3 years before anonymisation. The intended purpose is that ultimately, we may learn from your school what grades you obtained. These can then be combined with your initial options answers before being anonymised. The intension is to gather anonymous evidence for research purposes to discover any connections between students answers and final grade outcomes, in order to help improve teaching and learning in general. 

2. Deletion of data:

   Your data will be deleted if:

   1. you (a) revoke your consent to its storage,
   2. you delete your account using the "Delete My Account" facility found on the My Account page after you have logged in,
   3. the storage is or becomes legally impermissible for some reason.

   N.B. any data that has been anonymised is no longer considered by the GDPR (General Data Protection Regulation) as personal data and it is not identifiable as belonging to a person. Thus while you may request for your personal data to be deleted, if it has been anonymised and added to the research database, it is no longer personal data and cannot be deleted, as it is not identifiable.

3. Anonymisation:

   One purpose of this website is to generate anonymous data that can be used for educational research, to help improve the service that all education providers give to students everywhere. Anonymisation removes any reference to you, so that nobody can know who originally created that data.

4. Safety Measures:

   To avoid unauthorized access to Data and generally secure the Data, we apply the following safety measures:

   1. Encrypted data
      Any data that could identify you as an individual is held in encrypted form,
   2. Social media logins
      We use social media logins, technically known as the “Oauth2 verification”, or “Login with Facebook/Google/Windows” etc. This means that the social media provider, keeps your username, password and email address. We do not need these to make our service work for you. If we haven’t got it, it can’t be compromised.
   3. Email addresses
      If you sign up using your email address, it will be stored in a one-way encrypted form (hash encrypted). This means that it cannot be decrypted, but only used to verify that your account exists when you log in. For School Administrators accounts, we will store your email address in a form that can be decrypted, in order to enable us to send you admin messages.
   4. Data anonymisation
      Once any data is no longer needed, it is converted to an anonymous form by deleting anything that could be used to identify you.

   These safety measures are constantly revised to comply with the latest technological developments.

Under EU data protection law (the GDPR), you have particular rights in relation to your personal data that you have given us.

• Right to Withdraw Consent:
  You can withdraw your consent for future data processing at any time, using the facility found on the My Account page once you are logged in. This does not however affect the lawfulness of Data processing based on your consent given before you withdrew your consent.
• Right of Access:
  You have the right to obtain (i) confirmation as to whether or not your Data is currently being processed by us and, if so, (ii) more specific information on the Data. The more specific information concerns, among others, processing purposes, categories of Data, potential recipients or the duration of storage.
• Right of Rectification:
  You have the right to ask us to correct any inaccurate Data concerning you. In case that the Data processed by us is not correct, we will correct these without undue delay and inform you that this has been done.
• Right of Erasure:
  Should you decide that you do not want us to hold your data any further, you can delete your account and data at any time. You wil find the facility to do this in the My Account page available to you after you have logged in. Should there be some legal reason that prevents us from deleting your data, we will inform you without undue delay.
• Right to Restriction of Processing:

  You have the right to ask us to restrict the processing of your data in the following cases:

  1. if you so request
  2. you believe that the processing of your data is unlawful, but do not wish for the deletion of your data
  3. you still require your data for the establishment, exercise or defense of legal claims; or
  4. you have objected to the processing of your data using your right to withdraw consent.
• Right to Data Portability:
  You have the right to (i) receive your Data in a structured, commonly used and machine-readable format. You can obtain this using the Download My Data facility in the My Account page available to you after you have logged in.
• Right to Object:
  You have the right to object at any time to the processing of your Data.
• Right to Lodge a Complaint:
  You have the right to lodge a complaint with a supervisory authority (in the United Kingdom: the Information Commissioner’s Office), if you think that the processing of Data infringes applicable law, especially the GDPR (General Data Protection Regulation).

1. What are Cookies?

   This Website uses 'cookies' - small text files that are placed on the user's computer, smartphone and/or stored by the browser.

2. What are Cookies for?

   The computer that sends web pages to you (the server) has no memory of who it sends pages to, so it sends out a cookie to help it remember things like that you have logged in and what your preferences are. Cookies are neither bad nor good - it is what they are used for that is bad or good. Some cookies are essential to allow websites to function (like making logins work), while other analytics cookies can be used to track your web use from one site to another. We use analytics cookies only to learn how you use our company websites - things like which pages are more popular than others - so that we can learn how to make the websites serve you better. 

3. Disabling of Cookies:

   You can disable cookies by entering the corresponding settings in your browser software (e.g. in Internet Explorer, Mozilla Firefox, Opera, or Safari). However, if you do so, you will not be able to log into this website, as cookies are an essential part of how logins work

1. Google Analytics:

   This Website uses Google Analytics, a web usage analysis service of Google Inc. (“Google”), which uses cookies. The information on how people use this website, will usually be transmitted to a Google server in the USA and stored there. This is done in an anonymous form and does not show anything that could identify you as an individual. Your browser transmits an IP number, which can be used to locate you. This website uses Google Analytics with a setting ”_anonymizeIP()”, which means that Google discards the last part of the IP, which prevents it from knowing your exact location, only showing location to the nearest city or similar large area.  

   Purpose:
   Google uses the information gathered from your browsing of this website in order to compose reports and information on how all website visitors use the site. These statistics help us to learn how we can improve our website and service to you.

   About Google
   Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland,
   Fax: +353 (1) 436 1001;
   Terms: https://www.google.com/analytics/terms/gb.html;
   overview on data protection: https://support.google.com/analytics/answer/6004245?hl=en;
   and Privacy Policy: https://www.google.de/intl/en/policies/privacy/.

2. GeoIp

   In order to comply with the EU data protection law (the GDPR), we are obliged to make reasonable efforts to learn if you (the user of this website) are older than the minimum allowed age to create your own website account (the Digital Age of Consent). This age varies from country to country and between the ages of 13 and 16 within the EU.
   
   While this website is primarily aimed at UK students attending UK schools, we cannot know exactly who is using the website and where they are coming from. It is perfectly possible for example, that a student in Germany may wish to use our website prior to returning to the UK to study. And while the Digital Age of Consent is 13 in the UK, it is 16 in Germany. Thus we need a means to know which country you are using our website from, in order to know which age restriction to apply.
   
   We use a service from geoplugin.com to learn which country you are in. Your browser sends us your IP address. Our server sends this IP address to geoPlugin, which does not store it, but merely sends back your location. We use only the country information and discard the rest. This country location is then compared to a known list of Age of Consent values for many countries, so that we can know what rules applies where you are.
   
   About geoPlugin privacy