Data protection notice
Privacy Policy
This notice explains what personal data Profion handles, who is responsible for it, and what you can ask us to do about it. Profion is a mock examination platform used by schools, so most of the data on it belongs to a school and the school stays in charge of it. We have kept the language plain and the detail specific, because the people who have to check this are usually busy.
Last updated 18 August 2026
In short
- Your school controls learner data. We only process it on the school's written instructions.
- All data is stored in the United Kingdom. There are no routine transfers overseas.
- We never sell data, never show advertising and never market to learners.
- A UK GDPR Article 28 processing agreement is available to any school on request.
1 Who we are
Profion is operated by Apps4Education Limited, a company registered in England and Wales under company number 12614353, whose registered office is 124 City Road, London, EC1V 2NX. In this notice, "we", "us" and "Profion" mean Apps4Education Limited.
We handle personal data in accordance with the UK GDPR and the Data Protection Act 2018.
Questions about this notice, about how we handle personal data, or about a data protection request should go to hello@profion.co.uk. That address reaches the person responsible for data protection at Apps4Education Limited, and it is the fastest route to an answer.
2 Controller and processor
Where a school uses Profion with its learners, the school is the data controller for learner data and assessment results. The school decides who is enrolled, what is assessed, and how long the data is kept.
For that data we are a data processor. We act only on the school's documented instructions, we do not use learner data for our own purposes, and we do not decide what happens to it.
We are the data controller in our own right for staff and teacher account data, for enquiries sent through our contact form, and for billing and contract records.
In practice, for a head of department, this means a request about a learner is answered by the school with our support, while a request about your own staff account comes straight to us.
Note
If you are not sure which of us to ask, email hello@profion.co.uk. We will tell you who is responsible and, where that is the school, what we can do to help.
3 What we collect
We collect four kinds of personal data, and no more than we need to run the service.
- Staff account data
- Name, work email address, school, and role on the platform. Where your school signs in with Google or Microsoft, we receive the basic profile that the provider returns, which is your name, email address and provider account identifier. We never receive your password.
- Learner data
- The name or candidate identifier supplied by the school, the class or teaching group, answers and responses given during an assessment, marks, and timing information such as when an attempt started and finished.
- Enquiry data
- Name, school, work email address and the message you send us through the contact form on this website, together with the date it was sent.
- Technical data
- IP address, browser and device type, and the pages viewed. This comes from our own self-hosted, cookie-free analytics, and we use it to keep the site working and to see which pages are useful.
We do not ask for and do not want special category data, home addresses, free school meal status or additional learning needs status. Please do not upload it to the platform, and please do not include it in a message to us.
4 Lawful basis and retention
This table sets out why we hold each kind of data, the lawful basis we rely on where we are the controller, and how long we keep it.
| Data | Purpose | Lawful basis | Retention |
|---|---|---|---|
| Staff account data | Creating and running accounts, authenticating users, providing support | Contract, and our legitimate interests in securing and supporting the service | Deleted 12 months after last sign-in, or on closure of the account if that is sooner |
| Learner assessment data | Delivering mock assessments, marking, and reporting results to the school | Processed on the school's behalf as processor. The school relies on public task for its own processing | Deleted within 90 days of the school's subscription ending, or sooner on the school's instruction |
| Enquiry data | Answering your enquiry and keeping a record of what was agreed | Our legitimate interests in responding to schools that contact us | Deleted after 24 months |
| Technical and analytics data | Keeping the site available, secure and usable | Our legitimate interests in operating a secure and functioning website | Aggregated and retained for 26 months |
Where we rely on legitimate interests we have considered the effect on you, and you can object at any time using the contact details in this notice.
5 Learners and children
The school decides which learners use Profion and tells parents and carers about it through its own privacy notice. We have no direct relationship with learners or their families.
We do not market to learners, we do not show advertising anywhere on the platform, and we do not sell, rent or trade personal data. There is no advertising technology in Profion.
Objective questions are marked automatically. That produces a provisional mark, which the teacher can review, change or override before it is used for anything.
Because a teacher makes the decisions that matter, there is no solely automated decision-making with legal or similarly significant effect on a learner.
7 International transfers
Platform data, including all learner data, is stored on servers in the United Kingdom. We do not transfer personal data outside the United Kingdom as a matter of routine.
If that ever changed we would rely on UK adequacy regulations or on the International Data Transfer Agreement, and we would tell schools before the change took effect.
8 Security
We take the measures below. We have listed what we actually do, rather than what sounds reassuring.
- All traffic to and from the platform is encrypted in transit using HTTPS and TLS.
- Passwords are stored as salted hashes, never as readable text, and we cannot see them.
- Access is role based and scoped to a single school, so one school cannot see another school's data.
- Inside Apps4Education, access to school data is limited to named staff who need it to run or support the service.
- Backups are taken regularly, encrypted, and held off site.
- Administrative actions are logged, so we can see who changed what and when.
- We have a documented process for identifying, containing and reporting a personal data breach.
No system is completely secure and we do not claim otherwise. If we become aware of a weakness that affects your data, we will tell you what it is and what we are doing about it.
Note
If a personal data breach affects a school's data, we will notify the school without undue delay and in any event within 72 hours of becoming aware of it, with enough detail for the school to meet its own duty to report to the Information Commissioner's Office.
9 Your rights
Under the UK GDPR you have the following rights over your personal data.
- The right to be told what we do with your data, which is what this notice is for.
- The right of access to a copy of the personal data we hold about you.
- The right to have inaccurate data corrected.
- The right to have data erased where there is no good reason for us to keep it.
- The right to ask us to restrict how we use your data while a question about it is resolved.
- The right to receive your data in a portable format, and to have it sent to another provider.
- The right to object to processing we carry out on the basis of legitimate interests.
- The right not to be subject to a solely automated decision with legal or similarly significant effect.
To exercise any of these rights over your own data, email hello@profion.co.uk. We will respond within one month, and we will tell you if we need longer because the request is complex.
A request about a learner should go to the school, because the school is the controller for that data. If you send one to us we will pass it to the school promptly and help the school answer it.
If you are unhappy with how we have handled your data you have the right to complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first, so that we get a chance to put it right.
11 Data processing agreement
A written processing agreement that meets Article 28 of the UK GDPR is available to any school on request from hello@profion.co.uk. It covers our instructions, confidentiality, security, sub-processors, breach notification, audit, and deletion on exit.
Where the processing agreement and this notice say different things about learner data, the processing agreement governs.
12 Welsh language
Profion is delivered in Welsh and English. You can use the platform, contact us, and receive our replies in either language.
We welcome correspondence in Welsh and we answer it in Welsh. A request made in Welsh will not be treated less favourably than one made in English, and it will not take longer to answer.
13 Changes to this notice
We may update this notice. The version date is at the top of this page, and we keep the section numbering stable so that anything you have cited stays findable.
For a material change, such as a new sub-processor or a new purpose, we will email school administrators at least 30 days before the change takes effect.