Privacy Policy

Frequently asked questions

About this privacy policy

QLAMASTER LTD takes privacy seriously. This policy explains what personal data we collect, why we process it, who may process it on our behalf and the rights available to individuals whose personal data is processed through QLAMaster.

We only use personal data where there is an appropriate reason and lawful basis for doing so. We do not sell pupil, teacher, school or customer personal data.

About QLAMASTER LTD

QLAMASTER LTD is a company registered in England and Wales.

• Company: QLAMASTER LTD
• Company number: 16543970
• Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ
• Privacy email: [email protected]
• General email: [email protected]
• Website: www.qlamaster.com

Michael Wit Dolatko acts as QLAMaster's Privacy Lead (non-statutory) and can be contacted using the privacy email address above.

Cookies and similar technologies

QLAMaster uses cookies and similar technologies where necessary to operate and secure the website and platform.

These may include cookies required to:

• keep users securely signed in;
• maintain sessions and account functionality;
• protect the Service against security threats;
• remember essential preferences; and
• support payment and other platform functionality where required.

Cookies that are strictly necessary for the operation and security of the Service may be used without optional consent where permitted by law.

If QLAMaster introduces non-essential analytics, advertising or marketing cookies, we will provide appropriate information and obtain consent where required before placing them.

Users can also control cookies through their browser settings, although disabling necessary cookies may prevent parts of QLAMaster from working correctly.

Our role when processing personal data

QLAMASTER LTD may act in different data-protection roles depending on the type of information being processed.

When QLAMaster is a data controller

QLAMASTER LTD is responsible for deciding how and why personal data is processed in areas such as:

• Account registration and administration
• Customer and school contact information
• Payment and transaction records
• Customer support
• Platform security and technical administration
• Optional marketing preferences and communications
• Website operation and service improvement

When QLAMaster is a data processor

Where a school supplies pupil or assessment data to QLAMaster so that we can provide assessment analysis, feedback or related services, the school will normally determine why that data is being processed.

In those circumstances the school normally acts as the data controller and QLAMASTER LTD processes that information on the school's instructions as a data processor.

Further details are set out in our Data Processing Agreement .

What information this policy applies to

This policy applies to personal information provided directly to QLAMaster, supplied to us by an authorised school user, or generated through use of the platform.

This may include information provided when you:

• Create or use a QLAMaster account
• Purchase or manage a Licence
• Purchase AI Mapping Credits
• Submit assessment or question-level data
• Create or manage assessment mappings
• Use AI-assisted mapping features
• Contact customer support
• Choose whether to receive marketing communications

We may also collect technical information relating to use of our website and platform where required for operation, security and troubleshooting.

Types of personal data we may process

Depending on the services being used, QLAMaster may process:

• Names of teachers, administrators and other account users
• Email addresses and account contact details
• School name and relevant school information
• User roles or responsibilities
• Pupil names or identifiers where supplied by a school
• Classes or teaching groups where used within the Service
• Assessment marks, grades and question-level performance information
• Assessment and paper information
• Account authentication information
• Transaction records, payment references and purchase history
• AI Mapping Credit balances and usage
• Marketing email preferences
• Support requests and communications
• Technical information such as IP address, browser, device or activity information where collected for security or service operation

Payment-card information is entered into Stripe's payment service. QLAMaster receives the information required to confirm and record the transaction rather than storing customers' full payment-card details itself.

Special category data

QLAMaster is not designed to require special category personal data such as racial or ethnic origin, political opinions, religious beliefs, health information, biometric data or information concerning an individual's sex life or sexual orientation.

Schools should not upload special category personal data unless it is genuinely required for an agreed service and there is an appropriate lawful basis for doing so.

Why we process personal data

Personal data may be processed where necessary to:

• Create and administer user accounts
• Provide QLAMaster services to schools
• Analyse question-level assessment data
• Generate personalised feedback and revision materials
• Provide and manage assessment mappings
• Provide AI-assisted paper mapping where selected by a user
• Manage Licences and AI Mapping Credits
• Process and record purchases
• Provide customer support
• Send important operational and service communications
• Maintain platform security and integrity
• Meet accounting, regulatory and legal obligations
• Improve the operation and reliability of our services

Where analysis or service improvement can reasonably be carried out using aggregated or anonymised information, we seek to use information in that form.

Marketing communications

QLAMaster may send occasional emails about QLAMaster products, teaching ideas, offers, platform developments and company news where the recipient has chosen to receive those communications or where another applicable lawful basis allows us to do so.

Choosing to receive marketing is not a condition of creating or using a QLAMaster account.

Where you provide a marketing preference during registration, we store that preference against your account.

You can change your mind at any time. You may ask us to stop marketing emails by contacting [email protected] . Marketing emails will also provide an appropriate way to opt out.

Service messages, security notices, purchase confirmations and other communications required to operate your account are not marketing communications and may still be sent where necessary.

Pupil and student data is never used for marketing, advertising or promotional purposes.

Legal basis for processing personal data

Pupil data and services provided to schools

QLAMaster provides its services to schools and educational institutions rather than offering a consumer service directly to children.

The School is responsible for determining the appropriate lawful basis for the pupil data it chooses to process using QLAMaster and for meeting its own transparency and data-protection obligations.

QLAMASTER LTD processes pupil information supplied by the School only for the purposes of providing the agreed QLAMaster services and in accordance with the applicable agreement with the School.

Service providers and data processors

QLAMASTER LTD does not sell personal data or provide personal data to other organisations for their own independent marketing purposes.

We use selected external service providers where necessary to operate QLAMaster. These currently include:

• Amazon Web Services (AWS) – cloud infrastructure and hosting services.
• Cloudflare – website security, network protection and traffic delivery services.
• Stripe – payment processing.
• OpenAI – processing required to provide AI-assisted paper mapping features when those features are used.

These providers may process information only where required to provide the relevant service to QLAMaster, subject to applicable contractual and data-protection requirements.

We may also disclose information where we are legally required to do so, including to regulators, courts, law enforcement bodies or other competent authorities.

AI-assisted paper mapping

QLAMaster provides an optional AI-assisted paper mapping feature.

When a user chooses to use this feature, information contained in the submitted assessment document may be sent to our AI service provider for the purpose of analysing and mapping the assessment.

AI-assisted mapping is intended for assessment-paper content. Users should avoid including unnecessary personal information in documents submitted to the AI Paper Mapper.

The output of AI-assisted mapping should be reviewed by the user before it is relied upon.

The feature assists with assessment mapping and does not make decisions that have legal or similarly significant effects on pupils or users.

Business transfers and changes of ownership

If QLAMASTER LTD is involved in a merger, acquisition, restructuring, investment, sale of the business or transfer of relevant assets, personal data associated with the Service may form part of that transaction.

Any transfer of personal data will remain subject to applicable data-protection law and appropriate confidentiality and security requirements.

Where required, affected customers or individuals will be informed of a material change affecting how their personal data is controlled or processed.

International data transfers

Some service providers used by QLAMaster may process personal data in, or make it accessible from, countries outside the United Kingdom.

Where personal data is transferred internationally, we take steps to ensure that appropriate safeguards required by applicable UK data-protection law are in place.

Data retention

QLAMaster retains personal data only for as long as it is reasonably required to provide our services, administer accounts, resolve disputes and meet legal, accounting or contractual obligations.

Following the closure of a customer relationship, relevant account and service data may be retained for up to two years unless a longer period is required for legal, regulatory, accounting, security or dispute-resolution purposes.

Certain financial and transaction records may need to be retained for longer where required by applicable accounting, taxation or legal obligations.

Information that no longer needs to identify an individual may be deleted or irreversibly anonymised.

If you have a question about retention of specific information, contact [email protected] .

Automated processing and feedback

QLAMaster uses assessment data to generate automated analysis, feedback and revision information designed to support teachers and pupils in understanding academic performance.

QLAMaster does not use this processing to make decisions that produce legal or similarly significant effects on an individual.

Teachers remain responsible for reviewing and interpreting QLAMaster outputs in the context of their pupils and assessments.

Information security

QLAMASTER LTD uses appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Access to administrative systems and personal data is limited to people who require that access for legitimate operational purposes.

We review security arrangements as the QLAMaster platform develops.

Personal data breaches

If a personal data breach occurs, QLAMASTER LTD will assess the circumstances and the potential risk to affected individuals.

Where notification to the Information Commissioner's Office is required, we will report the breach without undue delay and, where feasible, within the applicable 72-hour period after becoming aware of it.

Where a breach is likely to result in a high risk to the rights and freedoms of affected individuals, we will also notify those individuals without undue delay where required.

Your data protection rights

Depending on the circumstances, individuals may have rights under UK data-protection law including the right to:

• request access to personal data;
• request correction of inaccurate personal data;
• request deletion of personal data in certain circumstances;
• request restriction of processing;
• object to certain processing;
• request data portability where applicable; and
• withdraw consent where processing relies on consent.

Where QLAMaster processes pupil information on behalf of a School, requests relating to that pupil information may need to be handled in cooperation with the School as data controller.

To exercise a right or ask a privacy question, contact: [email protected] .

Contact us

If you have questions, comments or concerns about this Privacy Policy or the way QLAMaster processes personal data, please contact:

We aim to respond to valid data-protection requests within the timescales required by applicable law.