Privacy Policy

Issued by 123 Global Education Limited
Company Number: 15584701
Registered Office: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ

Effective Date: 04/03/2026

123 Global Education Limited (“we”, “us”, “our”) is the data controller for STEP-UK assessments.

We are committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. What Data We Collect

Depending on the assessment type, we may collect:

Identity Information

• Full name
• Date of birth
• Nationality
• Government-issued ID (for secure tests)
• Profile photograph

Contact Information

• Email address
• Phone number

Assessment Data

• Responses submitted during the test
• Scores and results
• Time logs
• System activity data

Proctoring & Monitoring Data (Secure Tests Only)

• Webcam video and/or images
• Audio (where applicable)
• Screen monitoring data
• AI-generated behaviour flags

Technical Data

• IP address
• Device information
• Browser type
• Connection logs

2. Purpose of Processing

We process personal data to:

• Deliver and administer STEP-UK assessments
• Verify candidate identity
• Maintain test integrity
• Issue certificates
• Respond to enquiries
• Prevent fraud and misconduct
• Comply with legal obligations

We do not sell personal data.

3. Legal Basis for Processing

We process personal data under the following lawful bases:

• Performance of a contract (delivering the assessment)
• Legal obligation
• Legitimate interests (test security, fraud prevention)
• Explicit consent (where required, including for junior candidates)

For proctored assessments, monitoring is necessary to protect the integrity of the qualification.

4. Special Category & Biometric Data

Where webcam monitoring or identity verification occurs, image data may be processed for the purpose of confirming identity and preventing impersonation.

Such data is:

• Processed solely for test security
• Stored securely
• Retained only for a limited period
• Not used for automated decision-making without human review

5. Data Retention

We retain data only for as long as necessary.

General guidelines:

• Test results and certification records: up to 6 years
• Proctoring recordings: typically retained for up to 90 days unless required for investigation
• Identity documents: deleted once verification is complete unless required for dispute resolution

Retention periods may vary depending on legal or regulatory requirements.

6. Data Sharing

We may share data with:

• Authorised testing platform providers
• Proctoring service providers
• Secure cloud hosting providers
• Payment processors

All third-party processors are contractually bound to comply with UK GDPR standards.

We do not transfer personal data for marketing purposes without consent.

7. International Transfers

Some service providers may process data outside the United Kingdom.

Where international transfers occur, we ensure:

• Adequate safeguards are in place
• Standard Contractual Clauses (SCCs) are applied where required
• Equivalent data protection standards are maintained

8. Your Rights

Under UK GDPR, you have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request erasure (where legally permissible)
• Restrict processing
• Object to processing
• Data portability

Requests must be submitted in writing to:

support@step-uk.com

We may require identity verification before releasing data.

9. Children’s Data (Junior Assessments)

For candidates under 18:

• Registration must be completed by a parent, legal guardian, or authorised institution
• Consent must be confirmed before processing
• Data is handled with heightened safeguards

We do not knowingly collect children’s data without appropriate consent.

10. Security Measures

We implement:

• Encrypted data transmission
• Secure cloud storage
• Access control protocols
• Monitoring against unauthorised access

However, no online transmission is completely secure.

11. Cookies & Website Tracking

Our website may use cookies to:

• Improve user experience
• Monitor performance
• Maintain session integrity

Full cookie details are provided in our Website Cookie Policy.

12. Complaints

If you are dissatisfied with how your data is handled, you may contact us directly.

You also have the right to lodge a complaint with:

The Information Commissioner’s Office (ICO)
www.ico.org.uk