PRIVACY POLICY

Date: 01-08-2025

Frequently asked questions

Question	Answer
Who is using my data?	QLAMaster LTD
What is my data being used for?	QLAMaster LTD stores and processes data to help us maintain your account, process and store transaction details, offer customer support, offer system services and send system updates.
What will happen to my data?	QLAMaster LTD will use the data to offer automated feedback services and to improve upon the system.
What data will be kept and stored?	QLAMaster LTD stores registration details, transaction details, usage information and any information about your web preferences on our website.
What data will be shared with others?	We only share your data with regulators or government bodies if requested. Certain trusted processors (AWS, Cloudflare) handle data under contract solely to provide hosting and security services.
How long will my data be kept for?	QLAMaster LTD will store your data for a period of 2 years after subscription has terminated. After this period, your account and subsequent sub-accounts will be anonymised. You can request your subscription to be cancelled at any time.
Who will be able to access my data?	QLAMaster LTD will never sell or share your data to any third-party, unless granted explicit permission to do so.
How will my data be kept and made secure?	QLAMaster LTD stores your data on secure servers that are based in the UK and the EEA. Data is processed in the UK and the EEA, and we use standard industry security protocols.

QLAMaster LTD takes your privacy seriously. That is why we will only use your personal information to provide you with the products and services you have requested, as well as to administer your account. We will not sell or share your information, school information, student information, or any teacher or school details with third parties unless you grant us explicit permission to do so, and we will never use the gathered personal data for any reason other than the reasons described within this policy.

About our privacy policy

Our privacy policy outlines your relationship with our company and explains in detail how we use the information that you provide us with.

About QLAMaster LTD

QLAMaster LTD is the trading name of QLAMaster LTD, which is registered with the UK’s Information Commissioner’s Office under the Data Protection Act 2018. Our data controller is Michael Wit Dolatko, and we encourage you to get in touch with any questions you may have about QLAMaster LTD.
Our controller contact is [email protected]. Michael Wit Dolatko acts as Privacy Lead (non-statutory) and can be contacted at the same address.

Post: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ
Email: [email protected]
Website: www.QLAMaster.com

How we do business

QLAMaster LTD is committed to upholding and maintaining your personal rights. We operate our business in-line with the European Union’s General Data Protection Regulation and observe your rights to change or withdraw your opt-in options at any time. As part of our ongoing commitment to uphold your rights, QLAMaster LTD will also extend advice on how you can issue formal complaints to relevant authorities, such as the Information Commissioner’s Office.

Who our privacy policy applies to

This privacy policy has been developed to inform users of QLAMaster LTD how we use their data. QLAMaster LTD is an Educational Web-platform Business, and we need to process the data of individuals to offer our products and/or services. Bearing that in mind, our privacy policy applies to any and all individuals registered with us as a user, customer, administrator or in any other capacity.

What information this policy applies to

There is a lawful basis for processing your data, and this section of our privacy policy outlines how this applies to the personal information you provide us with or allow us to collect.

The information this policy applies to includes information that you:

Provide as part of any registration process
Provide as part of any campaign creation activity
Provide in the form of numerical data, metadata or communications
Give us as part of our ongoing relationship

This policy also applies to information that we:

Collect relating to how you interact with our website
Must process to complete purchases and other transactions

Our company obligations

As a data controller, QLAMaster LTD is legally responsible for the data you provide us with. In honouring that responsibility, we pledge to uphold our commitments under GDPR and the Data Protection Act 2018.

We will only ever use your data:

In ways that are both fair and legal
As described within this policy
In ways that are necessary for the purposes described

In addition, QLAMaster LTD processes the personal data you submit to us or we collect as a data processor. As part of this role, QLAMaster LTD takes all necessary precautions to secure the personal data we collect, process and store.

We may occasionally use the data you provide us with for marketing, relationship management or account management activities. These activities are designed to ensure you have adequate information about other products and/or services we offer, that we have reason to believe you may be interested in. You have the right to opt-out of these activities at any time. We do not use pupil data for any marketing, profiling or advertising purposes.

Third-Party data processors

QLAMaster LTD does not sell or disclose personal data to any organisation for its own commercial purposes. To run the platform we rely on three trusted service providers, each bound by a UK-GDPR Article 28 data-processing agreement:

Amazon Web Services (AWS) – UK/EU regions – cloud hosting & encrypted storage
Cloudflare – EU points-of-presence – edge security & traffic routing
Stripe Payments UK Ltd – EU data centre – secure payment processing and tokenisation

These processors act solely on our written instructions and must not use your data for their own purposes. We regularly verify that their controls comply with UK GDPR and that all personal data remains within approved UK/EEA regions.

For details of how QLAMaster LTD processes personal data on behalf of schools as a data processor, please see our Data Processing Agreement.

Our security

As part of our ongoing commitment to GDPR, QLAMaster LTD will report any security breaches or attempted breaches to the relevant authorities within 72 hours. We will subsequently contact all those affected by the breach without undue delay of its occurrence.

Legitimate interests

As part of the Data Protection Act 2018, QLAMaster LTD observes the right to share selected information with third-parties that use data for non-marketing purposes. This could include (but is not limited to) organisations that provide credit assessments, identification services and fraud prevention activities.

Name and details of Data Controller

Michael Wit Dolatko is the designated data controller for QLAMaster LTD and committed to upholding our commitments to protect the rights of individuals under legislation outlined within the Data Protection Act 2018 and the General Data Protection Regulation (GDPR).

Name and details of Privacy Lead

QLAMaster LTD has appointed Privacy Lead Michael Wit Dolatko to assist us in upholding our commitment to individual rights. Our Privacy Lead can be contacted through our email [email protected].

Description of the data being collected

QLAMaster LTD stores the following personal data necessary to operate and provide services:

First and surnames of students, teachers, and school faculty
School address
School years associated with individual students
Marks and grades assigned to individual students on submitted papers
Classes overseen by teachers
Teachers overseen by heads of departments
Usernames and encrypted passwords for website accounts
Financial data related to administrative accounts
IP Addresses of users and visitors on the website

Sensitive data

QLAMaster LTD does not collect any special-category personal data (Art 9 UK-GDPR), such as racial or ethnic origin, political opinions, religious beliefs, health information, biometric data, or sexual orientation. The data collected is limited to basic personal information necessary for service provision and account management.

Provision of Services to Children

QLAMaster LTD provides services to schools and educational institutions, not directly to children. It is the responsibility of the school, as the data controller, to ensure compliance with applicable data protection laws, including obtaining valid consent where required for students under the age of 13. QLAMaster LTD processes student data solely on the basis of contractual agreement with the school and does not engage directly with students for consent.

Why data is processed

QLAMaster LTD processes personal data only when necessary to deliver services to schools, manage our operations, and fulfill legal obligations. The purposes for processing include:

Financial administration
Provision of support and information services
Account setup and management
Research, analysis, and service improvement
Provision of operational communications
Security and system integrity
Safeguarding where applicable
Protection of our legitimate interests, including ensuring the proper functioning of our platform, improving upon the platform and compliance with contractual obligations

We do not make any automated decisions that produce legal or similarly significant effects on individuals.

QLAMaster LTD only uses personal data for the purposes for which it was collected. If we need to use personal data for a new purpose that is compatible with the original reason, we will inform you. In certain circumstances, we may also be legally required to process personal data without prior notification.
QLAMaster LTD will never use personal data for marketing purposes.

Legal basis for processing personal data

Action	Data / Information type	Legal grounds for processing
Registering schools, faculty, and students	Names · School address · Usernames · Encrypted passwords	Performance of a contract with the school · Legitimate interest in setting up and managing accounts
Managing school year, classes, and student-teacher assignments	School-year data · Class data · Teacher responsibilities · Department oversight	Performance of a contract · Legitimate interest in providing core functionality of the platform
Storing and displaying student marks and grades	Academic marks · Grades · Linked student identity	Performance of a contract · Legitimate interest in providing educational tracking functionality
Providing platform access and account functionality	Login credentials · Session data · Technical metadata (IP, device, login times, activity)	Performance of a contract · Legitimate interest in ensuring platform functionality and security
Handling financial administration for school accounts	Administrative contact info · Payment records · Transaction history	Performance of a contract · Legal obligation (e.g. record-keeping & taxation)
Applying security measures and performing technical audits	Technical metadata (IP, device, login times, activity)	Legitimate interest in maintaining platform security and integrity · Legal obligation to protect data

The Data Recipients

QLAMaster LTD does not sell or disclose personal data to any organisation for its own commercial purposes.
We do, however, use two trusted service providers—Amazon Web Services (AWS) in UK/EU regions for cloud hosting and encrypted storage, and Cloudflare in EU points-of-presence for edge security and traffic routing.
Both act strictly as data processors under Article 28 agreements and may process personal data only to deliver hosting, security and network services on our behalf. We regularly verify that their controls comply with UK GDPR and that all data remains within approved UK/EEA regions.

Apart from AWS and Cloudflare, QLAMaster LTD does not share personal data with any other external party.

Data transfers to countries outside the UK/EEA

QLAMaster LTD hosts personal data within the UK and the EEA, using AWS’s London data centre, ensuring compliance with UK data-protection laws. However, some data (such as website traffic routed through Cloudflare) may be transferred or processed in countries outside the UK/EEA.
We only work with third-party providers who implement appropriate safeguards, such as Standard Contractual Clauses approved by the UK Information Commissioner’s Office, to ensure that your personal data is protected to UK GDPR standards regardless of where it is processed.

Data Retention Periods

QLAMaster LTD retains personal data for as long as an active subscription exists. Upon termination of a subscription, personal data is retained for a period of 2 years to allow for any necessary administrative tasks or dispute resolution.
After this 2-year period, all personal data is anonymized irreversibly, ensuring that individuals can no longer be identified from the retained information.
If you require access to your data or have any questions regarding data retention, please contact us at [email protected].

Automated decision-making processes

QLAMaster LTD provides automated feedback based on student grades and marks submitted through the platform. This automated process analyses the data to generate insights intended to support teachers and students in understanding academic performance.
No automated decisions are made that have legal or similarly significant effects on individuals. Human oversight is maintained at all times to interpret and act on the automated feedback.

Where / how data is collected

QLAMaster LTD collects personal data primarily directly from the data subjects or their authorized representatives, such as schools and teachers. In some cases, personal data may be obtained indirectly from third parties, such as school administration systems or authorized educational partners, with appropriate consent and in compliance with data protection laws.

Individual rights

QLAMaster LTD respects your rights under GDPR. You have the right to access, correct, restrict, or erase your personal data. You may also object to certain processing activities or request the transfer (portability) of your data.
To exercise any of these rights, please contact our Data Controller at [email protected].

Information security

QLAMaster implements appropriate technical and organizational measures to protect your personal data from accidental loss, unauthorized access, alteration, or disclosure. Personal data is encrypted at rest, and access is controlled through role-based permissions to ensure that individuals can only access data relevant to their role.

Access to data is strictly controlled through role-based permissions:

Students can only access their own data.
Teachers can access their own data and that of their students, including paper templates they may share.
Administrators can access data of teachers and students under their supervision, including any paper templates created by those teachers.

All personnel with access to personal data are bound by confidentiality obligations, and security is continuously managed to safeguard your information.

Contact us

QLAMaster LTD is committed to upholding your rights. If you have any questions, comments or concerns about this privacy policy or wish to exercise your rights in relation to your personal data, please contact Michael Wit Dolatko at QLAMaster LTD: [email protected]
We will process any request within one month (extendable by two months for complex cases). Subject Access Requests are normally performed free of charge, but we may need to charge individuals for excessive or unreasonable data requests.

Complaints

If you are not happy with how your personal data has been processed, you should contact Michael Wit Dolatko in the first instance by using the contact details listed above. If Michael Wit Dolatko is unable to satisfy your concerns, you have the right to apply to the Information Commissioner’s Office for a resolution.

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
www.ico.org.uk