Privacy Policy
Issued by 123 Global Education Limited
Company Number: 15584701
Registered Office: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ
Effective Date: 04/03/2026
123 Global Education Limited (“we”, “us”, “our”) is the data controller for STEP-UK assessments.
We are committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. What Data We Collect
Depending on the assessment type, we may collect:
Identity Information
• Full name
• Date of birth
• Nationality
• Government-issued ID (for secure tests)
• Profile photograph
Contact Information
• Email address
• Phone number
Assessment Data
• Responses submitted during the test
• Scores and results
• Time logs
• System activity data
Proctoring & Monitoring Data (Secure Tests Only)
• Webcam video and/or images
• Audio (where applicable)
• Screen monitoring data
• AI-generated behaviour flags
Technical Data
• IP address
• Device information
• Browser type
• Connection logs
2. Purpose of Processing
We process personal data to:
• Deliver and administer STEP-UK assessments
• Verify candidate identity
• Maintain test integrity
• Issue certificates
• Respond to enquiries
• Prevent fraud and misconduct
• Comply with legal obligations
We do not sell personal data.
3. Legal Basis for Processing
We process personal data under the following lawful bases:
• Performance of a contract (delivering the assessment)
• Legal obligation
• Legitimate interests (test security, fraud prevention)
• Explicit consent (where required, including for junior candidates)
For proctored assessments, monitoring is necessary to protect the integrity of the qualification.
4. Special Category & Biometric Data
Where webcam monitoring or identity verification occurs, image data may be processed for the purpose of confirming identity and preventing impersonation.
Such data is:
• Processed solely for test security
• Stored securely
• Retained only for a limited period
• Not used for automated decision-making without human review
5. Data Retention
We retain data only for as long as necessary.
General guidelines:
• Test results and certification records: up to 6 years
• Proctoring recordings: typically retained for up to 90 days unless required for investigation
• Identity documents: deleted once verification is complete unless required for dispute resolution
Retention periods may vary depending on legal or regulatory requirements.
6. Data Sharing
We may share data with:
• Authorised testing platform providers
• Proctoring service providers
• Secure cloud hosting providers
• Payment processors
All third-party processors are contractually bound to comply with UK GDPR standards.
We do not transfer personal data for marketing purposes without consent.
7. International Transfers
Some service providers may process data outside the United Kingdom.
Where international transfers occur, we ensure:
• Adequate safeguards are in place
• Standard Contractual Clauses (SCCs) are applied where required
• Equivalent data protection standards are maintained
8. Your Rights
Under UK GDPR, you have the right to:
• Access your personal data
• Request correction of inaccurate data
• Request erasure (where legally permissible)
• Restrict processing
• Object to processing
• Data portability
Requests must be submitted in writing to:
support@step-uk.com
We may require identity verification before releasing data.
9. Children’s Data (Junior Assessments)
For candidates under 18:
• Registration must be completed by a parent, legal guardian, or authorised institution
• Consent must be confirmed before processing
• Data is handled with heightened safeguards
We do not knowingly collect children’s data without appropriate consent.
10. Security Measures
We implement:
• Encrypted data transmission
• Secure cloud storage
• Access control protocols
• Monitoring against unauthorised access
However, no online transmission is completely secure.
11. Cookies & Website Tracking
Our website may use cookies to:
• Improve user experience
• Monitor performance
• Maintain session integrity
Full cookie details are provided in our Website Cookie Policy.
12. Complaints
If you are dissatisfied with how your data is handled, you may contact us directly.
You also have the right to lodge a complaint with:
The Information Commissioner’s Office (ICO)
www.ico.org.uk