Updated October 1st 2025

Grade Gorilla Privacy Policy

Grade Gorilla is committed to protecting your personal information and respecting data protection laws, including the General Data Protection Regulation (GDPR) in the UK and Europe, and the Personal Data (Privacy) Ordinance (PDPO) in Hong Kong. This policy explains how we handle your data.

What Information Do We Collect?

For students using the site without an account, Grade Gorilla collects:

• Student names and school name

• Test information such as the test taken and the score

• Information related to the browser or device used to access our websites (through Google Analytics)

For students using the site with an account, Grade Gorilla also collects:

• Email addresses and encrypted passwords

For schools with an account, Grade Gorilla collects:

• School name and school passwords

• Teachers' names and email addresses

• Class descriptions

How Do We Process This Information?

Grade Gorilla uses the information to:

• Display scores and test data by request on the site by students and teachers

• Analyse scores for formative assessment by schools

• Review our website processes and development

• Contact you with information about changes to services

What Is the Purpose for This Processing?

The purpose for processing data on the site is to improve our website and the services we provide. In addition, we are fulfilling our contractual relationship where requests are made to display and process this data.

What Is Our Legal Ground for Doing This?

The legal ground for processing data is our legitimate interest in developing and managing our site. In addition, our legal ground is fulfilling our contractual relationship where a data processing request is made on the site by the data controller.

Intellectual Property Rights and Data Roles

Website users such as students and schools own all intellectual property rights in our stored data. Grade Gorilla owns all intellectual property rights in the website pages.

Schools and individuals act as the data controllers, and Grade Gorilla acts as the data processor. As controllers, website users can request a copy of all data, or have it deleted.

Cookies

Grade Gorilla uses session cookies to allow users to stay logged in during a browsing session. These are essential for the quizzes, logins, and other functionality — without them the site will not run. We do not use persistent login cookies; users must enter their password each time they log in.

Data Sharing and Processors

Grade Gorilla does not sell or rent your personal data to any third party. Your data may be transferred to the following classes of processors, solely to provide services on our behalf:

• Hosting provider (InMotion Hosting): for storage of website and database data. Servers are located in the EU (Amsterdam).

• Analytics provider (Google Analytics): receives anonymised usage data only (e.g., pages visited, device type, approximate location). It does not receive directly identifiable personal information such as names or email addresses.

All processors are contractually bound and may not use your personal data for their own purposes.

If a Google login is used, only names and email addresses are shared with Grade Gorilla and used for account checks on login.

Security Measures We Take

• All communications between Grade Gorilla users and the servers are encrypted using standard SSL secure encryption.

• A web application firewall (ModSecurity, provided through our cPanel hosting environment) protects against common web attacks such as SQL injection and cross-site scripting before they reach the application.

• Database access is strictly limited to a single sole authorised administrator of Grade Gorilla (the site owner).

• User accounts implement a login failure lockout mechanism: after multiple consecutive incorrect password attempts, the account is temporarily locked.

• New account passwords must meet minimum strength requirements (including length and complexity).

• Our servers are managed 24 hours a day and have an industry-standard level of security.

• Any information collected from citizens of the EU (or UK) must reside in servers located in EU jurisdictions or in countries with a similar scope and rigour in their protection laws. Our server is located within the EU (Amsterdam).

Data Retention

Quiz data (student name, school name, and test scores) is retained for 3 years from the date of collection. This covers KS3 and GCSE assessment cycles.

Student account data (email address, encrypted password, and account details) is retained for as long as the account remains active. If there has been no login activity for 24 consecutive months, the account is deleted.

If you believe your data should be deleted sooner, you may contact us using the details below.

Your Rights

You may contact us to exercise the following rights:

• Right of access: obtain a copy of the personal data we hold about you

• Right to rectification: request correction of inaccurate data

• Right to erasure: request deletion of your personal data

• Right to object: object to certain processing based on "legitimate interests" (where GDPR applies)

If you are located in the EU or UK, you also have the right to lodge a complaint with your local data protection authority.

Additional Information

Our site is run by practising teachers for use by teachers and students. Profits are meagre, and we charge schools for a premium account so that we do not make a loss. We do spend money on ensuring that all student data is protected to the standard expected by reputable schools.

We will notify all subscribers and account holders of any important changes to the way we process data and any subsequent changes to this policy.

Our company is based in Hong Kong and run by registered teachers from the UK.

Contact Us

If you wish to request, update or delete your personal information, please contact us at info@gradegorilla.com.