Privacy Policy

elevenplusprep (“we”, “us”, “our”) is operated by TheKBS IT Consultants Ltd, a company registered in England and Wales with company number 13898420 and registered office at 4 Hunters Lane, Watford, Hertfordshire, United Kingdom, WD25 7BD. We are the data controller for the personal data described in this policy. We are registered with the UK Information Commissioner’s Office (ICO).

We take the privacy of children seriously. Our service is bought and managed by a parent or guardian, who creates and controls each child’s account. We design our data practices around the UK GDPR, the Data Protection Act 2018, and the ICO’s Age Appropriate Design Code (Children’s Code).

1. Who this policy covers

• Parents / guardians — the account holder who registers, pays for, and manages the subscription.
• Children — the student whose learning account is created and supervised by the parent.
• Visitors — anyone browsing our public website.

2. What we collect

Information the parent provides

• Parent name, email address, and phone number.
• Child’s first name (or a chosen display name), year/class, and target exam date.
• A username and password for each child’s login.
• Billing details, processed by our payment provider (we do not store full card numbers).

Information created through use

• Practice and exam attempts, answers, scores, timing, and progress analytics.
• Placement results and unlocked learning levels.
• Support messages and correspondence you send us.

Information collected automatically

• A strictly necessary, HttpOnly session cookie to keep you signed in. See our Cookie Policy for details.
• Basic technical data (device type, browser, and approximate region derived from IP) used to keep the service secure and working.

We deliberately minimise what we collect about children. We do not require a child’s real full name, home address, or date of birth to use the platform, and we encourage parents to choose a display name rather than a real name.

3. Why we use it, and our lawful bases

• To provide the service (create accounts, deliver practice, show analytics) — performance of our contract with the parent.
• To take payment and manage subscriptions — performance of contract and compliance with legal (accounting) obligations.
• To keep the service secure (authentication, fraud and abuse prevention) — our legitimate interests in running a safe platform.
• To respond to support requests — our legitimate interests, or performance of contract.
• To send service emails (e.g. account, billing, security notices) — performance of contract. Any optional marketing email is sent only with the parent’s consent, which can be withdrawn at any time.

4. Who we share data with

We do not sell personal data. We share it only with trusted processors who act on our instructions:

We may also disclose data where required by law, or to protect the rights, safety, and security of our users and our service.

5. Your rights

Because children’s accounts are managed by a parent, the parent exercises these rights on the child’s behalf. You can ask us to:

• access a copy of the personal data we hold;
• correct inaccurate data;
• delete data (“right to be forgotten”);
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent where we relied on it.

See our Your Data Rights (GDPR) page for how to make a request. You also have the right to complain to the ICO at ico.org.uk.

6. Security

We protect accounts with hashed passwords, HttpOnly session cookies, encrypted transport (HTTPS), and access controls. No system is perfectly secure, but we work to protect your data and will notify you and the ICO of a qualifying breach as required by law.

7. Changes to this policy

We may update this policy from time to time. We will change the “last updated” date above and, for significant changes, notify the account holder by email.