Updated: 7th December 2022
1 Who we are & what is the purpose of this document?
1.1 We are Blutick Limited, registered office at AQA, Devas Street, Manchester, M15 6EX, United Kingdom. Throughout the rest of this document we shall be referred to as “Blutick”.
1.2 Blutick as an organisation is owned by AQA Education Group of companies. AQA Education are the leading awarding organisation of GCSE and A Levels across England.
This means that assets, including personal data, are owned and controlled by AQA Education. This Privacy Notice has been compiled in relation to your personal data that is being handled both by Blutick and the data controller, AQA Education Group (including DoubleStruck Limited a subsidiary of AQA Education).
1.3 This Privacy Notice applies to blutick.com, your Blutick user account, technical support and any other services we provide to you (we’ll just call all this “Blutick Services”).
1.4 The Privacy Notice is to inform you of exactly what information about you that we collect, store and process. To generalise we do not store any information about you that does not help us provide the services you have purchased from us. We are committed to being transparent and open and this document will outline exactly what is stored and how it is used.
2 Legal entities involved in processing your data
The legal entities that control and process your personal information are:
Joint Data Controllers:
- AQA Education including subsidiary Doublestruck Ltd (registered office: Devas Street, Manchester, M15 6EX).
- Blutick Ltd (registered office: Devas Street, Manchester, M15 6EX).
3 What do we mean by ‘Personal Information’
3.1 “Personal information” means any information that identifies you, things like your name or email address. Any information that falls outside of this is “non-personal information”.
3.2 If we store your personal information with information that is non-personal, we will consider the combination as personal information. If we remove all personal information from a set of data then the remaining is non-personal information.
4 Your Data
4.1 What we collect and what we do with it
The personal information you provide to Blutick and AQA Education Group is important. Utilising your personal data means that we can offer you services that best meet your needs, including new and innovative services.
We collect personally identifiable information in order to provide you with a service and identify that you are the owner of the provided service. The following is the set of personally identifiable information we may collect from you and the legal and practical justification for its collection.
|IP address||Security and system maintenance. Your IP address will be checked against a service that determines how likely an IP address is a proxy / VPN / bad IP using statistical analysis. If we determine your current location does not match your billing address we will contact you to confirm the order is genuine. Your IP address will also be recorded on system logs that will be used for general system maintenance.||
|Full Name||Your name determines the owner of the Blutick Service.||
|Billing Address||We need to know your billing address to confirm your order and assess appropriate taxes.||
|Sign up location||Your sign up location will be determined from your IP address and referenced against your billing location to determine a place of supply. This is required for both VAT purposes and fraud prevention.||
|Email address||Your email address will be stored in our customer database and support system and will be used to contact you for various reasons.||
|Telephone number||Your telephone number will be stored in our customer database.||
|Date of birth||For student accounts, we optionally request your date of birth to tailor the resources to you.||
4.2 What we do not collect
Special category data. Special category data is personal data which the UK GDPR says is more sensitive, and so needs more protection. We do not collect any special categories of personal data. For your reference these special categories are:
- ethnic origin
- trade union membership
- biometrics (where used for ID purposes)
- sex life
- sexual orientation
4.3 How your data is collected
Your contact details, including your name, address, email address and phone number are collected via a form that you complete either on sign up or at a later date when ordering products that require it. If you do not order products that require these details they will not be collected unless you complete the contact details form voluntarily.
Your IP address is collected automatically when you sign up to the Blutick Service or navigate pages in the Blutick Service.
To contact you regarding your service – In order to provide your service we will need to contact you to inform you about technical problems, renewal dates and security issues.
4.4 How your data is used
We do not provide any of your details to third parties for the purpose of marketing.
We will provide you with choices regarding certain personal data uses, particularly around marketing and advertising. We may use your Identity, Contact, Technical, Usage and Profile Data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you. You may receive marketing communications from us if you have purchased goods or services from us and you have not opted out of receiving that marketing.
Contact & Support
Calls to Blutick are not recorded. Support tickets and emails are stored to provide historical reference information to provide product support.
If there is an expectation that your personal data may be used for another purpose other than that for which it was obtained, we shall inform you prior to that further processing with information on that other purpose.
Where there is a requirement to transfer personal data outside of the UK/EEA to a third country, not deemed adequate by the UK GDPR, then additional safeguards are in place to facilitate this to occur.
The personal data in relation to this engagement will be processed for periods in line with current retention policies and where we have a lawful basis to do so. There is no automated decision making or profiling conducted on any personal data.
If you require any further information on the data use by AQA Education, please feel free to review AQA’s Privacy Notice at https://www.aqa.org.uk/about-us/privacy-notice. There is also a ‘Contact us’ section at the bottom of this document.
5 Third Party Processors (Sub-processors)
The list of third party processors is maintained at https://blutick.com/agreements/blutick-third-party-processors/
6 Your rights
You have several rights under the data privacy legislation. This includes, under certain circumstances, the right to:
- Access your data – you can access your data at any time if you cannot self-serve. Please be specific about what you want to know. We’ll need to confirm your identity before we release data to you.
- Correct your data – you can ask us to correct any data we hold about you that’s inaccurate.
- Request erasure – you have the right to ‘be forgotten’, in certain circumstances, mainly to withdraw consent at any time if consent is relied upon. This doesn’t apply if it would prevent the performance of a contract with you. Or if there’s another legal requirement for us to keep your data. If erasure is not possible, you may be able to ask us to restrict processing.
- Request the restriction of processing of your data – you can suspend the processing of your data under certain circumstances. For example, pending a review of the accuracy of the data or after you have objected to our use of the data, and we need to establish whether we may lawfully continue processing it.
- Request the transfer of your data – in some cases, you can ask us to transfer the data you originally provided to us to yourself or to another company. This only applies to data you provided directly, or that we observed about you through automated means.
- Object to the processing of your data – you can object to our processing of your data for direct marketing purposes, based on our stated legitimate interests (defined in the table above). In some cases, we may have compelling lawful grounds to process your data which override your rights and freedoms.
- Object to automated decision-making – you can also object to the processing of your personal data where profiling is being used to make assumptions about your behaviours or preferences; for example, to target marketing communications. You have the right not to be subject to automated decision-making and can require that any such decisions are reviewed by a human.
For further reference please see the ICO documentation.
7 Making a request or complaint
We take the handling of your personal data very seriously. But, if you feel your data is being handled in a way that breaches data protection legislation, you can make a complaint.
We may charge a reasonable fee if your request is unfounded, repetitive or excessive. We can refuse to follow your request in these circumstances. We’ll always try to respond to any legitimate request within one month. It may take us longer if your request is complex or you’ve made many requests. In this case, we’ll let you know and keep you updated.
As a security measure, we may ask you to confirm your identity. This ensures that:
- personal data isn’t disclosed to any person who doesn’t have a right to receive it
- your right to access your data or to exercise any of your other rights.
We may also contact you to ask you for further information in relation to your request to speed up our response. You also have the right to complain to the UK Information Commissioner at https://ico.org.uk/global/contact-us
8 Contact us
If you have any questions about how Blutick collect, hold or process your data; or you wish to exercise your rights, please contact the Data Protection Officer below:
- Name Rob Percival
- Email Address firstname.lastname@example.org