Privacy Policy

Last updated: March 2026 Applies to: exampadplus.co.uk (registration website only) Regulation: UK GDPR & Data Protection Act 2018

We collect only what is strictly necessary to register your school. We have no access to student data whatsoever — all student data remains entirely within your school's own systems.

Who We Are
What Data We Collect
How We Use Your Data
Student Data
How Long We Keep Data
Who We Share Data With
Where Your Data Is Stored
Cookies and Tracking
Your Rights
Contact and Complaints

1. Who We Are

ExamPad+ is a free Windows-based exam word processor for UK schools, operated by the ExamPad+ project ("we", "us", "our") on a not-for-profit basis.

This privacy policy applies only to our registration website at exampadplus.co.uk. The ExamPad+ application itself runs locally on your school's devices and network — we have no connection to, or visibility of, anything that happens within the application.

If you have any questions about this policy, please contact us via the details on our website.

2. What Data We Collect

We collect only the information needed to register your school and provide access to ExamPad+:

Name — the name of the staff member registering on behalf of the school
Email address — used for account access and service communications
School name — to identify the registering institution
School postcode — to verify the school's location within the UK

We do not collect any other personal data. We do not ask for phone numbers, dates of birth, job titles, or any other information beyond the above.

3. How We Use Your Data

We use this registration data solely to:

Create and manage your school's ExamPad+ account
Send account verification and password reset emails
Send important service updates (e.g. new software versions, security notices)

We do not use your data for marketing, advertising, or profiling of any kind. We do not sell personal data to any third party.

Our legal basis for processing is legitimate interests — specifically, the legitimate interest of the registering school in accessing the ExamPad+ service, balanced against the minimal privacy impact of collecting only basic registration details.

4. Student Data

We have absolutely no access to student data. ExamPad+ is a Windows application that runs entirely on your school's own devices and network. Student names, exam scripts, and any other data entered into the application are stored locally within your school and never transmitted to us.

Schools are solely responsible for managing student data within the ExamPad+ application in accordance with their own data protection policies and UK GDPR obligations. This includes ensuring appropriate staff access controls and data retention practices within your own systems.

5. How Long We Keep Data

We retain your registration data for as long as your school's account remains active. If you wish to have your school's registration data deleted, please contact us and we will remove it promptly.

We do not retain any data beyond what is required to maintain your active account.

6. Who We Share Data With

We do not sell or share your personal data with third parties for their own purposes. Your registration data is stored on Cloudflare's infrastructure, which we use to host the ExamPad+ website and manage school accounts.

We will only disclose personal data where required to do so by law or court order.

7. Where Your Data Is Stored

Your registration data is stored on Cloudflare's European Union infrastructure. Cloudflare is a US-headquartered company, but the data for this service is stored and processed within the EU, with appropriate data transfer safeguards in place including Standard Contractual Clauses (SCCs).

Cloudflare's privacy practices are described at cloudflare.com/privacypolicy.

8. Cookies and Tracking

Our website uses only strictly necessary cookies to operate the registration and login functionality:

Session cookie: Keeps you logged in during an active session. Deleted when you close your browser or log out
Security cookie: Protects against cross-site request forgery (CSRF) attacks

We do not use advertising cookies, analytics cookies, or any third-party tracking. We do not use Google Analytics or any similar service.

Because we use only strictly necessary cookies, no cookie consent banner is required.

9. Your Rights

Under UK GDPR, you have the following rights in relation to the registration data we hold about you:

Right of access — request a copy of the data we hold
Right to rectification — ask us to correct any inaccurate data
Right to erasure — ask us to delete your data
Right to restrict processing — ask us to limit how we use your data
Right to object — object to processing based on legitimate interests

To exercise any of these rights, please contact us via the details on our website. We will respond within 30 days.

As we are a not-for-profit project and are not registered with the ICO, we are not subject to mandatory ICO registration requirements. However, you retain the right to raise a concern with the ICO if you believe your data has been mishandled:

Information Commissioner's Office (ICO)
Website: ico.org.uk
Helpline: 0303 123 1113

10. Contact and Complaints

If you have any questions or concerns about this Privacy Policy or how we handle your registration data, please contact us via the details on our website. We will always do our best to address your concerns promptly.

Contents