Privacy Notice
For users of the demonstration (demo) account of NFER Online Assessments
1. Why are we processing this data?
This privacy notice relates to the NFER’s processing of personal data to allow schools to use a demo account. NFER has decided what it needs to provide and is the data controller. We will use the data from the demo account request form:
- To create and administer user demo accounts on the NOA Establishment Portal.
- To send users of the demo account email reminders of the support available and useful articles, and feedback surveys on the demo environment.
Demo accounts are pre-populated with ‘dummy learners’ to allow users to trial a range of functionality. It is not necessary for users to add their own learners’ data. However, if a demo account user adds any additional users to their demo account, they will be the data processor.
2. What is the legal basis for processing activities?
The legal basis for processing is:
GDPR Article 6 (1) (f) - Legitimate interests: the processing is necessary for your (or a third party’s) legitimate interests unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests.
NFER has carried out a legitimate interest assessment. The research fulfils one of NFER’s core business purposes (developing, trialing, and delivering assessments). It has broader societal benefits as it will help maintain the accuracy and rigor of NFER assessments. This cannot be done without processing personal data, but processing does not override the data subject’s interests. To mitigate the risks to the rights and freedoms of the individual data subjects as far as possible, NFER has put in place the technical and organisational measures set out in this privacy notice.
3. What personal data is being collected?
The title, name (forename and surname), role, email address, job title, school/trust are requested. We refer to this as “user data”. This will be used for the purpose of creating demo accounts for the users and to contact users about our support offering and to request feedback on the demo environment via our online survey.
4. How will personal data be obtained?
Personal data will be collected directly from the person completing the demo account request from or when they use the NOA Establishment Portal to add new users, as well as those that complete the feedback survey.
5. Who will personal data be shared with?
User data is shared and stored on ‘Spirit’, NFER’s Customer Relationship Management software, provided by The Education Company Ltd.
NFER will host the data on servers within the UK (NFER’s servers are operated currently by NFER’s service provider, Azure within the UK).
6. Is personal data being transferred outside of the UK or European Economic Areas (EEA)?
No personal data is stored or transferred to any organisation outside of the UK or EEA. If Questback’s online survey software is used to collect your feedback on the demo it stored data in Germany. Further information is s available here https://www.questback.com/trust-center/
7. How long will personal data be retained?
Establishments can delete some or all the personal data stored in the Establishment Portal whenever they wish to do so, provided they have Admin User access.
After the demo environment closes on Saturday 31st August all user data will be deleted. Until that time Admin Users will have the opportunity to test all the functionality of the tool. NFER will retain a record of the schools and users who have used the demo areas.
8. What are the rights with respect to personal data?
Data protection legislation gives certain rights to data subjects, under certain circumstances they have the right:
- To request access to information that is held about them (a data subject access request).
- To have personal data rectified if it is inaccurate or incomplete.
- To request the deletion or removal of personal data where there is no compelling reason for its continued processing.
- To restrict processing of personal data (for example, permitting its storage but no further processing).
- To object to processing.
- To data portability.
- Not to be subject to decisions based purely on automated processing where it produces a legal or similarly significant effect.
To exercise any of these rights, data subjects should contact their establishment. The school/trust may act on such requests themselves by contacting [email protected]. You can exercise these rights at any time.
11. Who can I contact about this Privacy Notice?
For general queries about NFER products please contact [email protected]
If you have concerns about the way NFER processes personal data, please raise your concern with NFER (by contacting the Compliance Officer: [email protected]).
If you remain dissatisfied, you can contact the Information Commissioner’s Office, the body responsible for enforcing data protection legislation in the UK, at https://ico.org.uk/concerns/
If you are in the European Union, NFER’s EU data representative is Rickert Rechtsanwaltsgesellschaft mbH. You can contact them to raise queries about the use of your personal data:
Rickert Rechtsanwaltsgesellschaft mbH
National Foundation for Educational Research in England and Wales (NFER)
Colmantstraße
15 53115 Bonn
Germany
12. Updates
We may need to update this privacy notice periodically, so we recommend that you revisit this information from time to time.
This privacy notice was created in May 2024.