Last updated: 19 March 2026
Evalent Ltd (“Evalent”, “we”, “us”) is committed to protecting your personal data. This policy explains what we collect, why we collect it, and your rights under UK GDPR and EU GDPR.
Evalent Ltd is the data controller for school administrator and assessor data. For assessment data relating to student applicants (who may be minors), the school is the data controller and Evalent acts as data processor.
Payment data is controlled by Paddle.com, who acts as Merchant of Record for all transactions. Paddle's privacy policy is available at paddle.com/legal/privacy.
School administrators: name, work email address, role, school name and country, collected when you create an account.
Student applicants: first name, last name, email address, grade applied for, curriculum, and assessment responses (MCQ answers and extended writing). This data is provided by the school when registering students.
Usage data: log data, IP addresses, browser type, and pages visited, collected automatically via our hosting infrastructure.
Payment data: we do not store card details. All payment information is handled by Paddle as Merchant of Record.
Contract performance: we process admin and assessor data to provide the platform services you have contracted for.
Legitimate interest: we process usage data to maintain platform security and improve our services.
Legal obligation: we may process data where required by applicable law.
Assessment data relating to student applicants is processed on behalf of the school. We process this data only as instructed by the school (data controller) and do not use it for any other purpose. Student data is retained for the period specified in your school's data retention configuration and deleted on request. Schools are responsible for obtaining any necessary consents from parents or guardians before registering student applicants.
We share data only with the following categories of third party, each bound by appropriate data processing agreements:
We do not sell personal data to any third party.
Some of our sub-processors operate outside the UK and EEA. Where this is the case, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the UK ICO and European Commission.
School admin account data is retained for the duration of your subscription plus 12 months. Assessment data is retained according to your school's configured retention period. You may request deletion at any time by contacting hello@evalent.io.
Under UK GDPR and EU GDPR you have the right to: access your personal data; correct inaccurate data; request erasure; restrict or object to processing; and data portability. To exercise any right, contact us at hello@evalent.io. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.
See our Cookie Policy for details of the cookies we use.
Data protection queries: hello@evalent.io