How this site handles data

What is uploaded?

Marks per question part and the pseudonymous IDs the college chose. The upload rejects any file with a name column, an email column, a date of birth or anything else that looks like personal details.

The college name and one work address, used only for notices about the upload: a problem with the file, a security incident, or a change to who processes the data. If the plan link is lost and a request comes from that address, we send the link to that address and to no other. It is kept with the upload and deleted with it.

For our own count of how the service is used, we also keep three facts with each upload: whether it was declared a whole teaching group, whether the work address belongs to a college, and which version of the terms was accepted. That holds no marks and no student IDs, and it is deleted with the upload.

Who is the controller?

For uploaded marks the college is the controller of its assessment data, and this site is its processor, acting on the college's instructions under the processor terms accepted at upload.

For a message you send from the contact page, and for any outreach we sent you, this service is itself the controller. Those two are covered separately below.

ResitLens is the trading name of a UK sole trader. Contact us through the contact page.

Is the data anonymous?

No, and it should not be described that way. The IDs are pseudonymous: the college keeps the key between its IDs and its students, we never receive it, and the marks therefore remain personal data in the college's hands.

What we can say is narrower and more useful: we never hold a name, a date of birth or contact details for any student, and we hold nothing that would let us re-identify one.

What is the lawful basis?

For uploaded marks, the college decides its own basis as controller and instructs us as processor. For contact messages and for outreach to college staff, our basis is legitimate interests: replying to an enquiry, and telling colleges about a tool built for their sector. You can object to outreach at any time, and we will stop.

How long is it kept?

Uploaded marks and the pages built from them are deleted 12 months after upload, or sooner on request.

A contact message and its reply address are kept for six months, and so is a work address left on a paper request. Counting events are kept on the same twelve-month rule as uploads, and those tied to an upload are deleted with it.

Request deletion from the contact page at any time, or delete a plan yourself from the bottom of its page. Deletion happens at once and is not queued. Our hosting provider then completes deletion from its own systems within its published maximum of 180 days.

Is there tracking?

No cookies, no analytics script, no third-party request from any page, and no browser storage. Nothing here needs consent under PECR and no consent banner will appear.

For each page opened, our own count records the path, the event type, the time and, where there is one, the upload ID. It stores no IP address, no session and no identifier of any kind. It exists so we can tell the difference between nobody visiting and people visiting without uploading. To leave out search engine crawlers, it reads the description a browser gives of itself once, in memory, and never writes it down.

Separately, our hosting provider keeps standard request logs for security and for fixing faults. They hold the IP address, the description the browser gives of itself and the address of the page requested, which for a plan includes its link. They are kept for 30 days and then deleted automatically, and we do not use them to count or identify visitors.

Where is it processed?

Uploaded marks are stored in the United Kingdom. The application that builds the pages runs in the Netherlands, because our hosting provider does not offer a United Kingdom location for it; marks pass through it while a page is built and are not stored there.

Hosting is provided by a sub-processor under its own data processing terms, named in the processor terms the college signs. Uploaded marks are stored and processed only in the United Kingdom and the European Economic Area. If our hosting provider needs to reach them from anywhere else, for example to support its own systems, that access is covered by the safeguards for international transfers in its data processing terms. The European Economic Area is recognised by the United Kingdom as providing an adequate level of protection.

Request logs are held by the hosting provider under the same data processing terms, including its safeguards for any transfer outside the United Kingdom.

Do we train models on it?

No. Uploaded data is never used to train anything, and it is never sold or shared.

Is anything decided automatically?

No. The ranking is a suggestion until a person confirms it, the whole cohort is always shown, the ordering is a lens and never a filter, and no student is ever removed from a view by the software. No decision producing a legal or similarly significant effect is taken automatically.

If we contacted you about this service

We write to named curriculum and subject leads at further education colleges. The details come from the college's own public web pages, and nothing is guessed. The categories are a name, a work role and a work email address.

The basis is legitimate interests. Every message says who we are and how to stop, one objection stops all further contact permanently, and details are kept for twelve months from the last message.

Two kinds of provider hold these details for us: our email provider, which carries the messages, and our code-hosting provider, which holds our record of who we wrote to and when. Both may store them in the United States. That transfer relies on the UK's adequacy regulations for US organisations certified to the UK Extension to the EU-US Data Privacy Framework, and both providers are certified.

Your rights

Access, correction, export, restriction, objection and deletion are available on request from the contact page.

If you are a student and want to know what is held about you, ask your college. It holds the key linking its IDs to its students. We do not, so we cannot identify you from what we hold.

You can complain to the Information Commission (formerly the Information Commissioner's Office) at ico.org.uk at any time.