Biometric data policy

What we collect, and why

Only learners who choose to verify their identity are scanned. Our verification service, Persona, photographs a government photo ID and takes a live selfie, compares the face with the ID photo, and before each saved mock exam matches a new selfie to the same person. The comparison uses face geometry, a biometric identifier. The sole purpose is that a saved mock exam result belongs to the person it names. Verification is optional: mock exams can always be taken unsaved.

Who holds it

Persona holds the ID images, selfies and face data and processes them only on our instructions. We do not receive or store the images or face data. We keep a verified learner's legal name, date of birth, ID expiry date and verification date. We never sell, lease, trade or otherwise profit from biometric identifiers, and disclose them to no one but Persona, except where the law requires it.

Consent

Before anything is scanned, the learner reads what is collected and agrees in writing (a box they tick and a button they press, recorded with the time and this policy's version). Learners of 16 and 17 verify only after a parent or legal guardian consents in writing, by signing with their name. We do not verify anyone under 16.

Retention and destruction

We instruct Persona to permanently destroy a learner's biometric identifiers and ID images at the earliest of:

• the learner withdrawing consent, which they can do at any time on their identity page;
• the learner deleting their account, or our deleting it under the account retention schedule;
• 365 days after the learner's last saved mock exam, or after their verification if they took none.

In every case this is well within three years of the learner's last interaction with us. We review this schedule, and whether each learner's data is still needed, at least once a year.

Security

What we keep is protected at least as carefully as the rest of a learner's record: encrypted in transit, held in a database reachable only by the application, and included in the account's export and deletion. Persona is bound by contract to protect the data and to tell us of any breach.

Your rights

A learner can see what we keep on their identity page and in the export on their "Your data" page, withdraw consent at any time, and delete their account. Questions go to the address on the licensing page.