Testwise Reporting Service - Privacy policy & cookies

Last updated: November 2023

At GL Education Group Limited (“we”, “us”) we value the privacy of all our customers and users. We recognise that when you choose to provide us with information, you trust us to act in a responsible manner. We believe this information should only be used to help us provide you with a better service. We will only collect and use Personal Data in ways that are described in this privacy notice (“Notice”), and always in compliance with our obligations and your rights under applicable privacy law.


This Notice applies to your use of our website and the services available at (TRS). Our website may provide links to third-party sites. Since we do not control those third-party sites and have no control over how your data is collected, stored, and used by them, we advise you to review the privacy notices of such sites before providing your data to them.


About us

GL Education Group Limited is a Limited Company registered in England and Wales under company number 02603456.

Registered address: 1st Floor, Vantage London, Great West Road, Brentford, TW8 9AG

Telephone number: +44 (0)20 8996 3369

Data Protection officer: Karl Oertel

Email address:

In this Notice, reference to Data Protection Legislation means the Data Protection Act 2018, the General Data Protection Regulation (“the GDPR”), and the Privacy and Electronic Communications Regulations 2003.

We operate this website and its services for the benefit of schools, Local Education Authorities (LEAs) or similar organisations (each an “Education Institution”).

This Notice (together with our Terms of Use and any other documents referred to in it) sets out the basis on which any Personal Data we collect will be processed by us.

We have broken down the Notice below to cover the following different types of individuals whose Personal Data we collect and process:

Administrative User(“you”, “your”) - someone who uses TRS for or on behalf of an Education Institution e.g., a member of staff of the school.

Student User – a student who takes a paper-based test, the results of which can be accessed by Administrative Users on TRS.


What is Personal Data?

‘Personal Data’ is defined by the GDPR as: “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.

In simpler terms, Personal Data is any information about you that enables you to be identified. For example, this could be your name or contact details.


Data Controller/Data Processor

Our products are predominantly used by Education Institutions.

For the purposes of the Data Protection Legislation:


What Personal Data do we collect and how?

Administrative Users:

You may give us Personal Data when registering for or logging into TRS, using the services available via TRS, or by corresponding with us by phone, e-mail or otherwise in relation to your use of TRS and your account. Such Personal Data includes (but is not limited to) your name, address, e-mail address and phone number.

What is our lawful basis for using your Personal Data?

In respect of each of the purposes for which we use your Personal Data (described in the next section), the GDPR requires us to ensure that we have a ‘lawful basis’ for that use. Most commonly, we will rely on one of the following lawful bases:

How do we use this Personal Data?

We use Personal Data held about Administrative Users in the following ways:




Account creation and service delivery

To create and manage your account on our service and deliver our service to you.

Contractual Necessity.

Fraud prevention

To keep our service and associated systems operational and secure.

Legitimate Interest. We have a legitimate interest in ensuring the ongoing security of our service and associated systems.

Analytics and service improvement

To understand how our users use our service and improve it using that data.

Legitimate Interest. We have a legitimate interest in monitoring the use of our service in order to improve it over time.

Legal compliance

To comply with our legal and regulatory obligations (for example, by ensuring that you are allowed to use our Service).

Compliance with law.


To send you information about our products and services from time to time.



Student Users

The Personal Data of Student Users is provided to us (via the TRS system) by the relevant Education Institution (usually by an Administrative User). Personal Data relating to the Student User includes (but is not limited to), name, address, date of birth, unique pupil number.

An Administrative User may choose to upload further Personal Data relating to Student Users onto the TRS system in order to filter the results of assessments according to inputted criteria. Such Personal Data includes gender, ethnicity, socio-economic information (for example, whether or not qualifying for free school meals) school and year group.

We collect Personal Data of Student Users directly from them when they log in to take a test (name, date of birth and unique pupil number).

The TRS system collects and stores the results of the tests taken by each Student User.

The Personal Data of Student Users is processed by us on behalf of the relevant Education Institution in order to:


Personal Data collected automatically.

With regard to each visit to TRS, we may automatically collect the following information:



We use cookies to distinguish individual Users of TRS. This helps us to provide you with a good experience. A cookie is a small file of letters and numbers that we store on your browser, computer, or device.


Do we share Personal Data?

The table below describes who we share your Personal Data with, and why we share it.



Our affiliates

GL Assessment is part of the Renaissance Learning group of companies. Other companies within our corporate group may help us provide our service to you.

Our service providers

Our service providers provide us with data hosting, IT, infrastructure, payments processing and other services that allow us to provide our service to you.

Our advisers

Our lawyers, bankers, auditors, insurers, and other advisers may need to access your Personal Data when providing their services to us.

Public authorities

Public authorities may require us to report our data processing activities in certain circumstances, which may involve disclosing some of your Personal Data.

Potential acquirers

We may disclose or transfer your Personal Data in the context of actual or prospective corporate events (for example the sale, transfer or merger of all or part of our business, assets, or equity interests). For example, we may need to share certain Personal Data with prospective counterparties and their advisers.


Anonymised data

We may use information relating to Student Users and schools in anonymised format to produce reports that we produce and share with third parties. These reports would, for example, be comparable reports about the type of organisation (for example, type of school, % of students with different languages) and their performance. No Student User or school would be identifiable in such reports.


Where do we store User Personal Data?

Personal Data that we collect from Users will not be stored at a destination outside the United Kingdom or the European Economic Area (“Europe”).

Nevertheless, your personal data may sometimes need to be shared with a third-party recipient located outside of Europe or may otherwise need to be accessed outside of Europe. For example, some of our affiliates, partners and external third-party suppliers are based outside Europe, so their processing of your personal data might involve transferring your personal data outside Europe.

Where we share your personal data with third parties who are based outside Europe, we try to ensure a similar degree of protection is afforded to it by making sure one of the following mechanisms is implemented:

Should you wish to find out more about these controls and safeguards, please contact us.


How to help us keep Personal Data secure

Where we have given you (or where you have chosen) a password which enables access to certain parts of TRS, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

In addition, we have put in place appropriate security measures to prevent your Personal Data from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. We limit access to your Personal Data to those employees and other staff who have a business need to have such access. All such people are subject to a contractual duty of confidentiality.

We have put in place procedures to deal with any actual or suspected Personal Data breach. In the event of any such breach, we have systems in place to work with applicable regulators. In addition, in certain circumstances (including where we are legally required to do so), we may notify you of breaches affecting your Personal Data.


How long do we keep Personal Data?

We keep Personal Data for as long as we need to for the purposes for which it was collected or (if longer) for any period for which we are required to keep Personal Data to comply with our legal and regulatory requirements.

To determine the appropriate retention period for your Personal Data, we consider the amount, nature and sensitivity of the relevant data, the potential risk of harm from unauthorised use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal requirements.


What are your rights?

Under the Data Protection Legislation, where we are acting as the data controller of your Personal Data, you have the following rights:

If you want to exercise any of the rights described above, please contact us.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your Personal Data. This is a security measure to ensure that your Personal Data is not disclosed to any person who has no right to receive it.

Typically, you will not have to pay a fee to exercise your rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. We may also refuse to comply with your request in limited circumstances.

We try to respond to all legitimate requests within a month. It may take us longer than a month if your request is particularly complex or you have made a number of requests; in this case, we will notify you and keep you updated.

Please note that applicable law may require or permit us to decline your request. If we decline your request, we will tell you why, subject to legal restrictions.



If you would like to make a complaint regarding this Notice or our practices in relation to your Personal Data, please contact us. We will reply to your complaint as soon as we can.

If you feel that your complaint has not been adequately resolved, please note that applicable privacy law gives you the right to contact your local data protection supervisory authority.


Changes to this Notice

We may change this Notice from time to time. This may be necessary, for example, if the law changes or if we change our business practices in a way that affects how we collect or use your Personal Data.

Any changes will be made available on our website.


Contact details

Questions, comments, and requests regarding this Notice are welcomed and should be addressed to