This policy is for candidates and students. If you are a school or centre offering OCR qualifications, please ensure that you provide your candidates with this notice if they want to know more about how OCR uses their information.
Cambridge Assessment (also known as the University of Cambridge Local Examinations Syndicate) is part of the University of Cambridge. We offer various education-related products and services, including academic and vocational qualifications and the exams that underpin them, training services for teachers and others involved in education and a wide range of research aimed at educators and policy makers. We do this through three different examination boards: Cambridge Assessment English, Cambridge Assessment International Education and Oxford, Cambridge and RSA Examinations. Our address is The Triangle Building, Shaftesbury Road, Cambridge, CB2 8EA.
In order to provide these products and/or services, we need to use personal data. That means that we may need to use information about you, for example, your name, address, email address, phone number, date of birth, exam results, voice or video recording or other information by which we can tell who you are. We might collect the data from you directly or from your school or centre of learning.
Sometimes we might even need to hold special personal data about you, for example, information about your health. But we would only hold this type of special information if we have a clear reason for doing so, such as to make special arrangements. Where appropriate, we would seek permission first. If you are 16 years of age or more then you would need to give us that permission, but if you are younger than that we would need to get permission from your parent or guardian.
It is important to us that we protect your privacy and any personal data that we hold about you. This Policy describes the way we use personal data so that you can know how you might be affected. If you have any questions about this, you can contact us at firstname.lastname@example.org.
Sometimes we may need to use your personal data where it is necessary to fulfil the requirements of a contract that you may be a party to. Apart from that we will only use personal data where we have what is known as legitimate interests. What that means is that if we use your personal data it is either because it is necessary in order to provide products and/or services to you or for other reasons that you might reasonably expect an organisation like us to use your personal data (without unfairly affecting your privacy or any other rights you may have).
The following activities require the use of personal data in order for us to provide our products and/or services. We may have to withdraw the provision of such products and/or services if we cannot use your personal data.
The following are examples of other activities which involve our use of personal data:
We may use personal information provided by you to carry out marketing and market research. We will only do this where we have your consent to contact you for these purposes. You can opt-out of these contacts at any time.
We may sometimes use a method known as profiling. In part, this method involves automatically collecting certain information in order to understand how people might behave, but we will not make decisions based on this without some human involvement. We occasionally use this method when someone is doing a test on a computer where his or her activity has been questioned, or to assist with test itself.
We may also use profiling for marketing purposes and to improve the quality of our services.
We may share personal data with:
The United Kingdom and countries inside the European Economic Area have specific laws which protect the way personal data is used. We may transfer personal data to countries outside of the European Economic Area where personal data is not protected in the same way (usually to other businesses who provide services on our behalf). In such cases, we will make sure that suitable safeguards are in place to protect the personal data. What that means is that whoever we transfer data to will have to agree to protect the personal data in an appropriate way. You can request further information about this by emailing email@example.com.
We may keep personal data only for as long as necessary to fulfil the purposes for which we are processing your personal information unless the law permits or requires longer. For example, we might need to keep your personal data for quality assurance of the service we have provided, or we might need to keep it to defend future legal claims.
Depending on the country in which you live, you may have certain rights over any personal data of yours which we hold. If so, you will be informed of these rights before your personal data is collected or as soon as is reasonable afterwards.
If you think that we have used your personal data unfairly then you may have the right to complain about us to the authority in your country which is responsible for guarding data protection laws.