Privacy Policy

Certyz is a UK careers-guidance platform for students and education organisations. References to “Certyz”, “we” and “us” in this policy mean the operator of certyz.co.uk.

For privacy enquiries, email [email protected]. You may also use our Data Request page.

The public assessment does not ask a student for their name or personal email address. It records the answers needed to produce the report, which can include:

• career interests, subjects and preferred activities;
• preferred education or training route and work region;
• current education stage, career clarity and confidence rating;
• the generated career recommendations and report;
• a random browser identifier used to recognise a repeat assessment;
• where a valid school code is used, the school, year group and optional tutor group linked to the response.

Certyz uses technical placeholder values in database fields that require a name or email. These values are not the student's real name or personal email address.

A participating school receives combined reporting rather than a list of named assessment answers. Small-group reporting should be suppressed in accordance with the aggregation rules agreed for the school's use of Certyz.

When a school or college requests access, we collect the organisation name and region, contact name, job title, work email, optional phone number, organisation type, intended cohort, preferred timing and any message supplied.

For authorised staff accounts, we process account and access information needed to authenticate the user, provide the dashboard, administer permissions and protect the service.

If you request a gated resource or toolkit, we may collect your name, email address, user type, region, selected interests, confidence response and the resource requested. The form explains what is required before submission.

We use this information to supply the requested material, operate the personal resource area and communicate about the request. Marketing messages are sent only where the applicable permission or another lawful basis exists, and include an unsubscribe option where required.

• to generate and save a student's personalised report;
• to provide anonymised or aggregated insight to participating schools;
• to respond to enquiries and arrange school access;
• to authenticate staff and secure accounts;
• to provide requested resources;
• to maintain, troubleshoot and improve Certyz;
• to understand website use when optional analytics consent has been given;
• to meet legal obligations and protect the service from misuse.

Depending on the activity, the lawful basis may be performance of a contract, legitimate interests, consent or compliance with a legal obligation. Where a school determines the purpose of student-data processing, the school may be the controller and Certyz may act as its processor under the relevant agreement.

Essential storage is used for website operation, assessment progress, reports and privacy preferences. Optional analytics do not load unless the visitor accepts them through the cookie control.

When accepted, Certyz currently uses Google Analytics and HubSpot analytics to understand website and page use. Visitors can reject analytics or reopen “Cookie preferences” at any time. Rejecting analytics does not prevent the essential parts of the website from working.

Certyz uses specialist providers to host the application and database, deliver website analytics when permitted, support communications and operate the service. These currently include Supabase, Google Analytics and HubSpot for the functions described above.

Some providers may process information outside the United Kingdom. Where this occurs, Certyz uses the contractual and legal safeguards applicable to that transfer. A current subprocessor and hosting summary can be requested from [email protected].

Access to operational data is restricted to authorised users and service components. The platform uses authentication, access controls and database row-level security where applicable. No online service can guarantee absolute security, so we also review access and respond to suspected incidents.

Certyz does not sell personal information or disclose student assessment answers to advertisers.

Information is kept only for as long as it is needed for the purpose for which it was collected, to operate an agreed school service, meet legal obligations or resolve disputes. School-specific retention and deletion arrangements are confirmed during onboarding or in the applicable data-processing agreement.

You can ask about the retention period that applies to your information or request deletion by using the Data Request page or contacting [email protected].

Depending on the circumstances, you may have rights to access, correct, erase, restrict or object to processing, and to receive certain information in a portable format. Where processing relies on consent, consent may be withdrawn at any time without affecting earlier lawful processing.

If the information was supplied through a school, you may contact either the school or Certyz. We may need to verify identity before fulfilling a request.

Please contact [email protected] first so we can investigate. You also have the right to complain to the UK Information Commissioner's Office:

Make a complaint to the ICO · Telephone 0303 123 1113.

We may update this policy as Certyz changes. The date at the top shows the latest published revision. Material changes affecting participating schools will also be communicated through the appropriate school contact or agreement.