Version 6 June 2026
ElevenReady helps parents prepare their children for the 11+. Because we process children's personal data, we take privacy especially seriously: we comply with the UK GDPR and the Data Protection Act 2018, and we apply the standards in the Information Commissioner's Office (ICO) Age Appropriate Design Code (the "Children's Code"). This policy explains what we collect, why, who we share it with, and the choices and rights you and your child have. There is also a plain-English version written for children.
1. Who is responsible for your data (controller)
The data controller is KWINTECH SERVICES LIMITED (trading as "ElevenReady"), a company registered in England and Wales (company number 10931672, registered office Dallam Court, Dallam Lane, Warrington, England, WA2 7LT). The parent or guardian account holder is our point of contact for everything relating to their children's data. You can reach us about privacy at info@elevenready.co.uk.
2. The data we collect
About you (the parent): name, email address, password (stored only as a secure hash) or — if you sign in with Google — the basic profile Google shares with us; a parent PIN (stored hashed) if you set one; your notification and marketing preferences; and a record of the consents you give and withdraw.
About your child: first name, year group, and the schools you are targeting. We deliberately do not require — and you should not add — a child's surname, date of birth, address, photograph or contact details.
Learning data: the questions your child attempts, their answers, confidence ratings, time taken, scores, streaks, points, coins, badges and rewards, readiness estimates, study plans, and the explanations and coaching notes we generate. If you upload a completed paper for analysis, the extracted text and the resulting analysis for that child.
Billing data: your subscription status and history. Card payments are handled by Stripe; we receive confirmation and limited details (such as the last four digits and card type) but not your full card number.
Technical data: basic logs, device/browser information and security events needed to run the Service reliably and safely.
3. Why we use it and our lawful basis
To provide the Service (accounts, practice, marking, explanations, lessons, study plans, readiness estimates, rewards and progress emails) — lawful basis: performance of our contract with you, together with your authorisation as the child's parent/guardian under Article 8 UK GDPR for processing the child's data.
To take payment for subscriptions — lawful basis: performance of our contract.
To keep the Service safe and working (security, fraud prevention, debugging, service improvement) — lawful basis: our legitimate interests in running a secure, reliable service, balanced against your and your child's interests, with the child's best interests as a primary consideration.
To meet legal obligations (for example tax, accounting, or responding to lawful requests) — lawful basis: legal obligation.
For optional marketing emails — lawful basis: consent, which is off by default and which you can withdraw at any time. The weekly progress digest is part of the Service (contract), not marketing, and you can turn it off in your notification settings.
4. Our commitments under the Children's Code
We treat the best interests of the child as a primary consideration. In practice that means: we collect the minimum data needed; high-privacy settings by default; no behavioural advertising and no selling of data; no public profiles or leaderboards; no "nudge" or dark-pattern techniques and no manipulative reward mechanics (rewards are fixed-price and contain no loot boxes or gambling-style elements); and AI is used to explain and encourage, never to make significant decisions about a child.
5. How we use AI
We use Microsoft Azure OpenAI to write explanations, coaching narratives and lesson drafts, and other AI providers to generate lesson images, narration and video for our content. When we call these services we send only the minimum needed — such as your child's year group, target-school standard, skill statistics and the relevant question and answer text. We do not send your child's name, date of birth, your email or other identifying details. Our AI providers act on our instructions and do not use your data to train their models. Readiness scores are always calculated by our own transparent formula, never by AI.
6. Automated processing
We analyse practice data to estimate skill mastery and a readiness band, and to suggest what to practise next. This supports — but does not replace — your decisions, and it does not produce any legal or similarly significant effect about your child. We do not carry out solely automated decision-making of that kind.
7. Who we share it with
We do not sell your or your child's data, and we never make a child's progress public. We share data only with the service providers ("processors") who help us run ElevenReady, under contracts requiring them to protect it and use it only on our instructions:
- Microsoft Azure — secure cloud hosting, database, storage and AI (Azure OpenAI, Speech, Document Intelligence).
- Stripe — payment processing (as an independent controller for the payment data it handles).
- Microsoft 365 / Graph — sending service and verification emails.
- Recraft and Runway — generating illustrations and video for our teaching content (no child personal data is sent).
We may also disclose data if required by law, to establish or defend legal claims, or to protect a child's safety.
8. Where your data is held and international transfers
We host data in the UK or European Economic Area. Where any processing involves a transfer outside the UK, we rely on appropriate safeguards — such as UK adequacy regulations or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses — so your data keeps an equivalent level of protection.
9. How we keep it secure
We use appropriate technical and organisational measures, including encryption in transit, hashing of passwords and PINs, access controls, tenant isolation so families' data is kept separate, and minimising the data sent to third parties. No system is perfectly secure, but we work to protect your and your child's data and will notify you and the ICO of a personal data breach where the law requires.
10. How long we keep it
We keep personal data only as long as we need it to provide the Service. If you delete a child's profile we delete or anonymise their learning data promptly. If you close your account we delete your personal data within a reasonable period (and in any event without undue delay), except limited records we must keep to meet a legal obligation (for example, billing records for tax purposes).
11. Your rights and controls
You can ask us to access, correct, delete or export ("port") your and your child's personal data, to restrict or object to certain processing, and to withdraw any consent you have given (without affecting processing already carried out). Many of these are available directly in your privacy settings in the app, including deleting a child profile and exporting your data. We will respond to requests within one month.
If you are unhappy with how we handle your data you can complain to the ICO at ico.org.uk (or call 0303 123 1113), though we hope you will contact us first at info@elevenready.co.uk so we can help.
12. Cookies and changes
Our use of cookies is explained in the Cookie Policy. If we make a material change to this policy we will notify you and ask you to review and accept the updated version before you continue using the Service.
See also our Terms of Service and Cookie Policy.