Blutick

Updated: 24th March 2023

1 Who we are & what is the purpose of this document?

1.1 We are Blutick Limited, registered office at AQA, Devas Street, Manchester, M15 6EX, United Kingdom. Throughout the rest of this document we shall be referred to as “Blutick”.

1.2 Blutick as an organisation is owned by AQA Education Group of companies. AQA Education are the leading awarding organisation of GCSE and A Levels across England.

This means that Blutick assets, including personal data, are owned and controlled by AQA Education. This Privacy Notice has been compiled in relation to your personal data (as the data controller) that is being processed by Blutick, AQA Education Group, and DoubleStruck Limited (a subsidiary of AQA Education) as data processors.

1.3 This Privacy Notice applies to blutick.com, your Blutick user account, technical support and any other services we provide to you (we’ll just call all this “Blutick Services”).

1.4 The Privacy Notice is to inform you of exactly what information about you that we collect, store and process. To generalise we do not store any information about you that does not help us provide the services you have purchased from us. We are committed to being transparent and open and this document will outline exactly what is stored and how it is used.

2 Legal entities involved in processing your data

The legal entities that control and process your personal information are:

AQA Education including subsidiary Doublestruck Ltd (registered office: Devas Street, Manchester, M15 6EX).
Blutick Ltd (registered office: Devas Street, Manchester, M15 6EX).

3 What do we mean by ‘Personal Information’

3.1 “Personal information” means any information that identifies you, things like your name or email address. Any information that falls outside of this is “non-personal information”.

3.2 If we store your personal information with information that is non-personal, we will consider the combination as personal information. If we remove all personal information from a set of data then the remaining is non-personal information.

4 Your Data

4.1 What we collect and what we do with it

The personal information you provide to Blutick and AQA Education Group is important. Utilising your personal data means that we can offer you services that best meet your needs, including new and innovative services.

We collect personally identifiable information in order to provide you with a service and identify that you are the owner of the provided service. The following is the set of personally identifiable information we may collect from you and the legal and practical justification for its collection.

Data	Process	Processing Basis
IP address	Security and system maintenance. Your IP address will be checked against a service that determines how likely an IP address is a proxy / VPN / bad IP using statistical analysis. If we determine your current location does not match your billing address we will contact you to confirm the order is genuine. Your IP address will also be recorded on system logs that will be used for general system maintenance.	Contract VAT MOSS, to add a single piece of information to determine place of supply Legitimate interest To protect us and our users from fraudulent transactions.
Full Name	Your name determines the owner of the Blutick Service.	Contract To create invoices and manage payments Legitimate interest To communicate your identity to other parties within the Blutick service, such as teachers, students and parents Legitimate interest Relationship management, we will refer to you by your full name in support communications
Billing Address	We need to know your billing address to confirm your order and assess appropriate taxes.	Contract To create invoices and manage payments Contract VAT MOSS, to add a single piece of information to determine place of supply Legitimate interest To recover owed money in the event of non payment Legitimate interest To prevent fraudulent orders
Sign up location	Your sign up location will be determined from your IP address and referenced against your billing location to determine a place of supply. This is required for both VAT purposes and fraud prevention.	Contract VAT MOSS, to add a single piece of information to determine place of supply Legitimate interest To protect us and our users from fraudulent transactions.
Email address	Your email address will be stored in our customer database and support system and will be used to contact you for various reasons.	Contract We need to be able to contact you to provide support and information regarding your products including notification of technical issues, renewals, and information related to the continued running of the service. Legitimate interest We will contact you regarding new offers and products we develop.
Telephone number	Your telephone number will be stored in our customer database.	Legitimate interest Fraud prevention, in the event of a suspicious order from your account we may contact you by phone to confirm the order. Legitimate interest We may contact you by phone to remind you of a missed renewal payment.
Date of birth	For student accounts, we optionally request your date of birth to tailor the resources to you.	Contract Students’ date of birth allows us to provide more relevant educational content to students.
All Data	To develop, deliver, inform and publicise educational: products, policy, standards, qualifications, on-screen assessment, questions, resources and training (including the provision and funding of research to inform education policy and improve assessment practice).	Contract To provide enhanced services to you. Legitmate interest To maintain and develop our core products and services in a regulated environment.

4.2 What we do not collect

Special category data. Special category data is personal data which the UK GDPR says is more sensitive, and so needs more protection. We do not collect any special categories of personal data. For your reference these special categories are:

race
ethnic origin
sex
politics
religion
trade union membership
genetics
biometrics (where used for ID purposes)
health
sex life
sexual orientation

4.3 How your data is collected

Your contact details, including your name, address, email address and phone number are collected via a form that you complete either on sign up or at a later date when ordering products that require it. If you do not order products that require these details they will not be collected unless you complete the contact details form voluntarily.

Your IP address is collected automatically when you sign up to the Blutick Service or navigate pages in the Blutick Service.

To contact you regarding your service – In order to provide your service we will need to contact you to inform you about technical problems, renewal dates and security issues.

4.4 How your data is used

Third parties

We do not provide any of your details to third parties for the purpose of marketing.

Marketing

We will provide you with choices regarding certain personal data uses, particularly around marketing and advertising. We may use your Identity, Contact, Technical, Usage and Profile Data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you. You may receive marketing communications from us if you have purchased goods or services from us and you have not opted out of receiving that marketing.

Contact & Support

Calls to Blutick are not recorded. Support tickets and emails are stored to provide historical reference information to provide product support.

Purposes

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

International Transfers

Where there is a requirement to transfer personal data outside of the UK/EEA to a third country, not deemed adequate by the UK GDPR, then additional safeguards are in place to facilitate this to occur via the latest EU SCCs and UK IDTA addendum.

Retention

The personal data in relation to this engagement will be processed for periods in line with current retention policies and where we have a lawful basis to do so. There is no automated decision making or profiling conducted on any personal data.

Further Information

If you require any further information on the data use by AQA Education, please feel free to review AQA’s Privacy Notice at https://www.aqa.org.uk/about-us/privacy-notice. There is also a ‘Contact us’ section at the bottom of this document.

5 Third Party Processors (Sub-processors)

The list of third party processors is maintained at https://blutick.com/agreements/blutick-third-party-processors/

6 Your rights

You have several rights under the data privacy legislation. This includes, under certain circumstances, the right to:

Access your data – you can access your data at any time if you cannot self-serve. Please be specific about what you want to know. We’ll need to confirm your identity before we release data to you.
Correct your data – you can ask us to correct any data we hold about you that’s inaccurate.
Request erasure – you have the right to ‘be forgotten’, in certain circumstances, mainly to withdraw consent at any time if consent is relied upon. This doesn’t apply if it would prevent the performance of a contract with you. Or if there’s another legal requirement for us to keep your data. If erasure is not possible, you may be able to ask us to restrict processing.
Request the restriction of processing of your data – you can suspend the processing of your data under certain circumstances. For example, pending a review of the accuracy of the data or after you have objected to our use of the data, and we need to establish whether we may lawfully continue processing it.
Request the transfer of your data – in some cases, you can ask us to transfer the data you originally provided to us to yourself or to another company. This only applies to data you provided directly, or that we observed about you through automated means.
Object to the processing of your data – you can object to our processing of your data for direct marketing purposes, based on our stated legitimate interests (defined in the table above). In some cases, we may have compelling lawful grounds to process your data which override your rights and freedoms.
Object to automated decision-making – you can also object to the processing of your personal data where profiling is being used to make assumptions about your behaviours or preferences; for example, to target marketing communications. You have the right not to be subject to automated decision-making and can require that any such decisions are reviewed by a human.

For further reference please see the ICO documentation.

7 Making a request or complaint

We take the handling of your personal data very seriously. But, if you feel your data is being handled in a way that breaches data protection legislation, you can make a complaint.

We may charge a reasonable fee if your request is unfounded, repetitive or excessive. We can refuse to follow your request in these circumstances. We’ll always try to respond to any legitimate request within one month. It may take us longer if your request is complex or you’ve made many requests. In this case, we’ll let you know and keep you updated.

As a security measure, we may ask you to confirm your identity. This ensures that:

personal data isn’t disclosed to any person who doesn’t have a right to receive it
your right to access your data or to exercise any of your other rights.

We may also contact you to ask you for further information in relation to your request to speed up our response. You also have the right to complain to the UK Information Commissioner at https://ico.org.uk/global/contact-us

8 Contact us

If you have any questions about how Blutick collect, hold or process your data; or you wish to exercise your rights, please contact the Data Protection Officer at GDPREnquiries@aqa.org.uk. Also please feel free to review AQA’s Privacy Notice at https://www.aqa.org.uk/about-us/privacy-notice.

GDPR