Privacy Policy

1. Who we are

Invent Consultancy Limited, trading as Chelmsford 11 Plus, operates this website and platform. Invent Consultancy Limited is the controller responsible for the personal information described in this Privacy Policy.

Business location: Chelmsford, United Kingdom

Privacy contact: support@chelmsford11plus.com

This Privacy Policy applies when you visit chelmsford11plus.com or use our accounts, child dashboard, courses, mock tests, practice papers, digital products, communications or related services. Children have their own data-protection rights, even when a parent or guardian provides information or acts for them.

2. Information we collect and where it comes from

Most information comes directly from a parent or guardian. Some is supplied by the child when using the dashboard or submitting work, created by tutors or administrators while delivering the service, generated by our systems, or received from providers such as Stripe when a payment is made.

• Parent or guardian details: name, email address, telephone or WhatsApp number, postal or billing address where needed, account details, communication preferences and relationship to the child.

• Child profile details: name, date of birth, expected year group, account identifier and login information, and any limited information needed to place or support the child appropriately.

• Educational and service records: waiting-list and enrolment details, classes and mock tests booked, attendance, homework, answers, assessments, scores, creative writing, scanned answer sheets, tutor feedback, progress information and parent updates.

• Order and payment records: products or services ordered, payment status and transaction references, refunds, cancellations, account credits and internal balance. Full card numbers and card security codes are entered directly into Stripe and are not stored by us.

• Communications: contact-form enquiries, emails, support and live-chat messages, WhatsApp communications, Zoom participation and notification preferences.

• Technical and security information: IP address, date and time, browser or device information, requested pages or features, login and security events, push-notification token, cookie choices, reCAPTCHA risk signals and digital-product download records.

• Additional support information: if a parent chooses to provide health, disability, accessibility or additional-learning-needs information that is genuinely necessary to support the child.

3. Why we use information and our lawful bases

We use different lawful bases for different purposes. A contract with a parent does not automatically make contract the lawful basis for the child's information, so child-service records are generally handled under our legitimate interests, with the child's interests and rights given particular weight.

Information marked as required on an account, booking, payment or service form is needed to provide the requested service or meet a legal obligation. If it is not provided, we may be unable to create the account, accept the booking, process payment or provide the service. Optional information can be left blank.

4. Children's information and the year-group eligibility check

We design our handling of children's information around their best interests, collect only what is reasonably needed, and restrict access. A child's full date of birth is visible only to the parent or guardian and authorised Chelmsford 11 Plus personnel who need it.

We use the child's date of birth and the academic-year setting for each class or mock test to calculate the child's expected year group and check whether the service is ordinarily suitable.

If the information indicates that the selected service may not match the child's expected year group, the online booking is paused. The check does not make a final decision about the child's eligibility. A parent or guardian can request a human review, during which an authorised administrator will consider corrected information and any relevant circumstances and can approve the booking or an appropriate exception. The booking message explains how to request this review. We do not use children's information for behavioural advertising or marketing notifications to child accounts.

The short summary at the start of this Privacy Policy is also available from the child dashboard. Where appropriate, we explain a particular use of information at the point it happens, such as when a date of birth is entered or a booking is blocked.

5. Payments, digital products and download security

Payments are processed through Stripe. Stripe receives the payment, transaction, contact, device and fraud-prevention information needed to process and secure the payment. Stripe may also use some information for its own legal, regulatory, security and fraud-prevention responsibilities. We receive payment status and transaction references, but not the full card number or card security code.

We record refunds, account credits and internal balances so they can be applied correctly and so that our financial records are accurate.

A purchased PDF may contain visible licence information identifying the authorised purchaser, order or licence reference. This helps show who is permitted to use the material.

When a purchased digital product is accessed or a download is attempted, we may record the relevant order, date and time, whether the request was allowed or denied, IP address and browser/user-agent information. We use this to deliver and protect purchased materials, verify authorised access, investigate suspected misuse and resolve technical problems. Ordinary download-audit records are normally kept for 12 months; relevant records may be kept longer while a dispute, misuse concern or security investigation is active.

Secure download links normally expire about 10 days after purchase. Link expiry does not delete the underlying order, financial record or audit record, which follow the retention periods in section 10. We do not place tracking pixels, analytics code, device fingerprinting or any hidden mechanism inside a PDF that reports activity after download.

6. Communications and online services

6.1 Email and service messages

We use email to confirm bookings and payments, deliver service information, answer enquiries and communicate about a child's booked classes, mocks, homework or results. Email is provided through IONOS. Essential service messages are not marketing.

We send promotional messages to parents only where they have consented or where the law permits the customer 'soft opt-in' for similar services. Every marketing message will provide a simple way to opt out. Opting out of marketing does not stop essential service messages.

6.2 Push notifications

If you enable push notifications, Firebase Cloud Messaging processes an app or browser installation identifier or push token and delivery information so requested service notifications can reach the device. Notifications are off until enabled and can be turned off in the account, browser or device settings. We do not use child accounts for marketing notifications.

6.3 Parent live chat

If a parent or guardian chooses to use live chat, we process the messages, contact details they provide and limited technical information needed to operate and secure the chat. Tawk.to processes this information for us and may store it in the United States under recognised safeguards. Ordinary chats are kept for up to 12 months unless needed longer for an unresolved complaint, safeguarding concern, dispute or legal obligation. The chat is for parents and guardians; children should not use it or provide personal information through it. Email support remains available if chat is declined.

6.4 WhatsApp

If a parent chooses to contact us on WhatsApp or asks to join a parent group, WhatsApp processes account and message information under its own terms. Joining a group is optional. Before adding a parent, we explain that other group members can see their mobile number and may see their profile name or photo, depending on their settings. Children should not use these groups, and personal educational or sensitive information should not be posted in them.

6.5 Zoom classes

Some classes are delivered through Zoom. When a participant follows a class link, Zoom processes the participant or display name, device and network information and the audio, video or chat content used during the class. Classes are not recorded unless we tell participants and parents beforehand, explain the purpose, access and retention, and obtain any permission required by law. Zoom may process information outside the UK under recognised safeguards.

7. Cookies and similar technologies

Our website uses cookies, local storage, scripts and similar technologies. Some are strictly necessary for functions such as secure login, account sessions, checkout, fraud prevention, security and remembering privacy choices. Other technologies are optional and are not activated until the required choice or consent has been given.

We use Google reCAPTCHA on selected forms to help prevent spam, fraud and abuse. When reCAPTCHA is loaded, Google may collect IP address, browser or device information, cookies or similar identifiers, and interaction data to assess risk. Google handles this information under its own Privacy Policy and Terms of Service. We load reCAPTCHA only on protected forms and obtain consent first where required by law.

Our separate Cookie Policy identifies the technologies currently in use, their provider, purpose, category and duration. A persistent Cookie Settings control allows choices to be changed. We review the Cookie Policy whenever a provider or configuration changes.

8. Who we share information with

We do not sell, rent or trade personal information. We share only what is reasonably necessary with:

• authorised tutors, administrators and support personnel who need the information to provide or protect the service;

• Stripe for payments; IONOS for email; AWS and MongoDB Atlas for core hosting, database, storage and backups; Firebase and Google reCAPTCHA for notifications and security; Cloudinary for website media; Tawk.to for parent live chat; and Zoom for online classes;

• Meta/WhatsApp where a parent chooses to use WhatsApp, including the other parent members of a group as explained above;

• IT, development, security and professional advisers acting under appropriate confidentiality and data-protection arrangements; and

• police, courts, regulators, safeguarding bodies or other authorities where disclosure is required by law or reasonably necessary to protect a child or another person, investigate wrongdoing, or establish or defend legal claims.

Some providers act only on our instructions, while others have their own legal responsibilities and purposes. We assess the role and terms of each provider and limit the information supplied.

9. International transfers

Our main website, database and secure-file storage are configured in the London region. Some service providers may process information outside the UK, including in the United States.

Where a restricted transfer is made, we use an applicable UK adequacy regulation, including the UK Extension to the EU-US Data Privacy Framework where the recipient is actively certified, or appropriate contractual safeguards such as the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, together with additional safeguards where required. Contact us for more information or a copy of the relevant safeguard.

10. How long we keep information

We keep personal information only for as long as it is needed for the purpose collected, including legal, tax, safeguarding, security and dispute requirements. The normal periods below apply unless a longer or shorter period is justified and recorded.

A parent may ask us to delete a child profile earlier. We will do so where there is no active enrolment or service and no legal, safeguarding, security or dispute reason to retain the information. Financial or complaint records may be retained separately even after the profile is deleted.

11. How we protect information

We use proportionate technical and organisational safeguards, including access permissions, secure connections, protected storage, time-limited download links, backups, monitoring and restricted administrative access. Personnel and providers receive only the access reasonably needed for their role.

No online service can guarantee absolute security. If you believe an account, message, link or file has been accessed improperly, contact support@chelmsford11plus.com promptly and avoid sending passwords, full card details or unnecessary sensitive information by email, live chat or WhatsApp.

12. Your and your child's rights

Depending on the purpose and lawful basis, you or your child may have the right to:

• ask for access to personal information and a copy of it;

• correct inaccurate or incomplete information;

• ask for deletion or restriction of use;

• object to processing based on legitimate interests or to direct marketing;

• receive certain information in a portable format;

• withdraw consent at any time where consent is the lawful basis, without affecting earlier lawful use; and

• ask for human review, provide information and challenge an outcome where a qualifying automated decision applies.

These rights belong to the child as well as to adults. A parent may exercise them for a child where authorised, where the child cannot act independently, or where this is in the child's best interests. We may need to verify identity and authority before acting. Rights are not absolute, and we will explain any lawful reason why a request cannot be met fully. Requests are normally free of charge and answered within the legal time limit.

13. Questions, rights requests and complaints

For a question or rights request, email support@chelmsford11plus.com.

To make a data-protection complaint, email the same address with the subject Data protection complaint. We will acknowledge the complaint within 30 days, investigate it without undue delay, keep the complainant informed and communicate the outcome without undue delay.

You may also complain to the Information Commissioner's Office at any time. The ICO recommends first giving the organisation an opportunity to resolve the matter. Visit ico.org.uk/make-a-complaint or call 0303 123 1113.