How EBA collects, uses, protects and manages personal information.
Last updated: June 26, 2026
This document provides general organisational information. Mandatory rights under applicable law continue to apply.
01
Scope and our commitment
This policy applies to personal information collected through EBA websites, enrollment and examination forms, volunteer and donation services, communications, installed web applications and related educational activities. EBA applies internationally recognised principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, security and accountability. Where local law provides stronger protection, that law should be followed.
Depending on the service, we may collect identity and contact details, date of birth, education history, school or centre information, examination requests, accessibility needs, payment evidence, communications, complaint records, device and browser data, IP address, cookie preferences and consent records. We request only information reasonably necessary to provide, protect, improve or administer the relevant service.
Personal information is used to process applications, deliver education and examinations, verify identity and eligibility, communicate with users, protect learners and staff, prevent fraud and misuse, satisfy accounting and governance duties, improve accessibility and service quality, and comply with legal obligations. Processing may rely on consent, performance of a requested service, legitimate organisational interests, safeguarding needs or compliance with law. Consent may be withdrawn where consent is the applicable basis.
EBA takes additional care when handling information about children and vulnerable learners. Information should be age-appropriate, limited to educational and safeguarding needs, and accessed only by authorised persons. Where required, consent or involvement of a parent, guardian or responsible institution will be requested. A child's safety and best interests take priority when a safeguarding concern requires appropriate disclosure.
Information is not sold. It may be shared with authorised education partners, examination or accreditation bodies, payment and technology providers, professional advisers, regulators or public authorities when necessary and lawful. Service providers must use information only for agreed purposes and apply suitable confidentiality and security controls. International transfers should use appropriate contractual, organisational or legal safeguards.
EBA uses proportionate technical and organisational measures such as access controls, authentication, encryption where appropriate, backups, staff confidentiality and monitoring. Information is retained only for as long as needed for the stated purpose, safeguarding, certification, finance, dispute resolution or legal requirements, then securely deleted or anonymised. Suspected data incidents are assessed, contained, documented and reported to affected persons or authorities where legally required.
Subject to applicable law, individuals may request access, correction, deletion, restriction, objection, portability or withdrawal of consent, and may complain about how information is handled. Identity may be verified before a request is completed. Some information may need to be retained where required by law, safeguarding, examination integrity or the establishment, exercise or defence of legal claims.
Essential cookies support security, language, sessions and core site functions. Preference, analytics or marketing technologies should be used only in accordance with the choices shown in the cookie consent interface and applicable law. Users can change browser settings or update consent preferences, although disabling essential technologies may prevent parts of the service from working.
Privacy questions and rights requests may be submitted through the EBA contact or complaint channels. Please describe the request clearly and avoid sending unnecessary sensitive information. EBA will acknowledge and respond within a reasonable period and within any deadline required by applicable law. This policy may be updated when services, technology or legal requirements change.
