Privacy Notice for users of the NFER Online Assessments (NOA) interactive demonstration (demo)
1 Why are we collecting this data?
NFER provides staff at schools who are considering using their online assessment with the opportunity to access an interactive demonstration of the NOA system. This allows users to view examples of tests, the reporting and marking tools. This privacy notice sets out how personal data is used to create and administer interactive demo accounts. NFER has decided what personal data is required and how it is used and is the data controller.
2 What is the legal basis for processing activities?
The legal basis for processing is:
GDPR Article 6 (1) (f) - Legitimate interests: the processing is necessary for your (or a third party’s) legitimate interests unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests.
NFER has carried out a legitimate interest assessment. The research fulfils one of NFER’s core business purposes (developing, trialling, and delivering assessments). It has broader societal benefits as it will help maintain the accuracy and rigor of NFER assessments. This cannot be done without processing personal data, but processing does not override the data subject’s interests. To mitigate the risks to the rights and freedoms of the individual data subjects as far as possible, NFER has put in place the technical and organisational measures set out in this privacy notice.
3 How will personal data be obtained?
Personal data will be collected directly from the person completing the interactive demo account request form.
4 What personal data is being collected?
To set up a user account for the interactive demo site, we will request title, name (forename and surname), role, email address, job title and details of school/trust. We refer to this as “user data”.
We may collect additional data (users’ views and experiences) if we use online surveys to collect feedback on the interactive demo or during conversations with the Schools Partnerships Team.
5 Who will personal data be shared with?
User data is shared and stored on ‘Spirit’, NFER’s Customer Relationship Management software, provided by The Education Company Ltd.
NFER will host the data on servers within the UK (NFER’s servers are operated currently by NFER’s service provider, Azure within the UK).
If user surveys are undertaken, user data is shared and stored on ‘Questback’, a survey solution and feedback platform provided by Tivian.
6 Is personal data being transferred outside of the UK or European Economic Areas (EEA)?
No personal data is stored or transferred to any organisation outside of the UK or EEA.
If Tivian’s online survey software (Questback) is used to collect your feedback on the interactive demo, it stores data in Germany. Further information is available here https://www.questback.com/trust-center/
7 How long will personal data be retained?
Users will have access to the interactive demo for 30 days. After that time, personal data will be removed from the platform. Personal data will be retained in ‘Spirt’ as NFER will retain a record of the schools and users who have been given access to the interactive demo. For further information on that please see our stakeholder communications privacy policy.
8 What are my rights with respect to personal data?
Data protection legislation gives certain rights to data subjects; under certain circumstances they have the right:
-
To request access to information that is held about them (a data subject access request).
-
To have personal data rectified if it is inaccurate or incomplete.
-
To request the deletion or removal of personal data where there is no compelling reason for its continued processing.
-
To restrict processing of personal data (for example, permitting its storage but no further processing).
-
To object to processing.
-
To data portability.
-
Not to be subject to decisions based purely on automated processing where it produces a legal or similarly significant effect.
To exercise any of these rights, data subjects should contact their establishment. The school/trust may act on such requests themselves by contacting [email protected]. You can exercise these rights at any time.
9 Who can I contact about this processing?
For general queries about NFER products please contact [email protected]
If you have concerns about the way NFER processes personal data, please raise your concern with NFER (by contacting the Compliance Officer: [email protected]).
If you remain dissatisfied, you can contact the Information Commissioner’s Office, the body responsible for enforcing data protection legislation in the UK, at https://ico.org.uk/concerns/
If you are in the European Union, NFER’s EU data representative is Rickert Rechtsanwaltsgesellschaft mbH. You can contact them to raise queries about the use of your personal data:
Rickert Rechtsanwaltsgesellschaft mbH
National Foundation for Educational Research in England and Wales (NFER)
Colmantstraße
15 53115 Bonn
Germany
10 Updates
We may need to update this privacy notice periodically, so we recommend that you revisit this information from time to time.
It was first published in May 2025.
It was updated in June 2025 to reflect the replacement of the NOA demonstration platform with an interactive demonstration of the NOA system.
For users of the demo account of NFER Online Assessments (NOA).