Student Privacy Notice
This Student Privacy Notice provides information on how we collect, use and retain personal data for ICAEW students and how we manage the student journey and should be read in conjunction with the Privacy Notice.
What this Student Privacy Notice covers:
Please also refer to the Privacy Notice as this includes information relevant to you.
We collect the following types of personal data about our students, depending on the services we provide and how we interact with you:
- Date of birth or age range;
- Preferred title;
- Qualifications and other Professional Body memberships;
- Email address;
- Phone number;
- Educational establishment(s), dates of study, subjects studied and results;
- Employment information;
- Referee details (if a prospective student is applying via one of our international top-up programmes);
- ICAEW student training records;
- Results for exams you sit with us and awards you receive;
- Unique learner number (ULN) and employer's reference number; and
- Bank account details.
Special category data
- We will collect and process information about your ethnicity, health or religion if you choose to share this information and only with your consent. Please see the Special Category Data section below for further information.
- We will collect and process information relating to your criminal convictions but only for specific purposes and with your consent. Please see the Criminal Convictions section below for further information.
Student administration and management:
- to register you as a student;
- to administer and manage your student journey;
- to enable you to sign up for a student account on our website;
- to take payment or provide you with a refund;
- to provide you with advice related to your registration as a student, if requested;
- to run competitions that you might be interested in;
- to provide you with content relevant to you;
- to ensure the authenticity of any documents submitted as part of your registration or any appeal, complaint or other application;
- to respond to and deal with appeals, complaints or other similar or related matters;
- to run eligibility checks on your eligibility for qualification and/or membership;
- to deliver inclusive student services to you; and
- if you have an ICAEW training agreement with an employer or principal, to ensure that your training and progress meets the standard required by your employer.
To provide you with updates and information:
- to make you aware of changes to regulations or changes to the way rules are applied and other updates relevant to you; and
- to send you other information or updates relating to our services that you may be interested in including our student magazine and direct marketing emails. We will only send direct marketing emails and our student magazine to you with your consent. Please see the Direct Marketing section below for more information.
For feedback, research, analysis and development purposes:
- to request and collect feedback on your student journey and examination experiences to help us to assess the suitability of exam modules and/or processes;
- for research purposes and statistical analysis; and
- to help us develop and improve our services.
Exam and qualification administration and management:
- to assess your eligibility for qualifications you apply for;
- to enable you to book and sit ICAEW exams;
- to manage and administer our qualifications; and
- to communicate with you about the results of ICAEW exams you sit.
Pathways to membership scheme, reciprocal agreements, advanced credit arrangements, common content and other international routes to becoming an ICAEW student:
- to manage and administer international routes to becoming an ICAEW student;
- to assess ability of prospective referee to act as a referee for prospective international student; and
- to assess eligibility.
Monitoring equality and diversity:
- to monitor equality and diversity in relation to students.
To manage and administer our jobs portal:
- management and administration of our jobs portal, if relevant to you.
The reasons for which we process your personal data, in accordance with data protection laws, are set out below:
We collect and use some personal data because we have legitimate interests, for example, in:
- requesting, collecting and responding to feedback;
- researching and analysing the services our students want;
- understanding how our students use our services;
- developing and improving our services;
- receiving information from other entities in our group about shared students; and
- providing security over our business.
Some personal data is processed because you have given your consent. Consent can be withdrawn at any time by either logging into your online student account and amending your preferences or by contacting us at firstname.lastname@example.org.
We will use some of your personal data because it is necessary to perform our contract with you. This includes student administration and management, administering exams and qualifications and international routes to becoming a student as well as making you aware of changes to regulations or changes to the way rules are applied and other updates relevant to you.
We will process information relating to any criminal convictions for the purpose of evaluating your eligibility as a student or for qualifications you apply for but only if you provide your consent.
Certain types of personal information are more sensitive than others. Special category data includes information about your health, medical condition or religion. We will collect such special category data if you choose to provide this information to us. We will process these special categories of personal data to monitor equality and diversity and/or in order to support any special exam requirements you have and/or to consider an appeal that you make or that is made on your behalf if you consent to this.
We may use certain personal information to market to you, by sending you emails to promote our services or by sending you our student magazine by post. We will only do this where you have consented to receiving either direct marketing emails or a subscription to our student magazine.
If we send you direct marketing emails, unsubscribe instructions will be included. You can withdraw your consent and unsubscribe to receiving direct marketing from us at any time by following our email unsubscribe instructions or by emailing us at email@example.com or by logging in to your online student account and updating your marketing preferences. You may not opt-out of receiving communications regarding administrative, legal or technical messages.
You can unsubscribe from our student magazine by logging in to your online student account and updating your marketing preferences or by emailing us at firstname.lastname@example.org.
Your personal data may also be processed if it is necessary on reasonable request by a law enforcement or regulatory authority, body or agency or in the defence of legal claims. We will not delete personal data if relevant to an investigation or a dispute. It will continue to be stored until those issues are fully resolved.
Some exams may be marked using automated means. The correct answers and pass mark are determined by ICAEW. The examination mark and whether you have passed or failed an exam marked using automatic means will be automatically determined by reference to the number of correct and incorrect exam answers and the applicable pass mark. If you want to appeal an exam mark you need to go through our standard appeals process.
There are circumstances where we will share your personal data with ICAEW employees, internal boards and panels and third parties:
- ICAEW employees, boards and panels: We will share your personal data with ICAEW employees, internal boards, governance councils, assessment boards, appeal and complaints panel who will access your personal data to perform our contractual obligations (such as providing student services to you) and to deal with your requests or complaints;
- Your employer/principal: We will share your personal data with your employer/principal to meet our contractual obligations. For example if you have a training agreement with your employer/principal we will share your personal data with your employer/principal to ensure that your training and progress meets the standard required by your employer/principal and that your ACA status is represented accurately;
- Regulatory bodies: We will share your personal data with regulatory bodies that we and/or you are governed by;
- Evidence issuing authority: We will share your personal data with the issuing authority of any evidence you provide to ensure authenticity;
- Third party suppliers: We will share your personal data with our third party suppliers who require your personal data in order to provide services to us including:
- external assessment, training and examination providers (including test centres) and invigilators;
- tutors and partners in learning;
- payment providers;
- business system providers;
- companies who run competitions on our behalf;
- companies who facilitate our communication with you including marketing communications you are registered for and communicating your exam results;
- website content and hosting providers, including analytics; and
- if you have special exam requirements such as access arrangements, extra time or other assistance due to illness, disability, religion or other extenuating circumstances, we may share your personal data (where necessary, including health data) with third party suppliers engaged by us who need to know such information in order to cater for your special requirements;
- District and student societies: We will share your personal data with district societies and student societies to allow such societies to communicate with you, if you fall within their remit;
- International accountancy institutions: If you study under a Pathways programme or a similar arrangement, we may share your personal data with the institution running the programme in your country of residence:
- Publishing your exam results: We may share and publish your results and awards that you receive including publishing results online and at prize giving ceremonies. We will only do this where you have provided your consent;
- Criminal convictions: If you disclose a criminal conviction, this will be shared with ICAEW's internal professional conduct team and depending on the circumstances may also be shared with third parties such as regulators or other professional bodies; and
- Potential employers through our jobs portal: If you use our jobs portal, we may share your personal data with potential employers.
Your personal data may be transferred to other third party organisations in certain scenarios:
- If we're discussing selling or transferring part or all of our business – the information may be transferred to prospective purchasers under suitable terms as to confidentiality;
- If we are reorganised or sold, information may be transferred to a buyer who can continue to provide services to you;
- If we are required to by law, or under any regulatory code or practice we follow, or if we are asked by any public or regulatory authority – for example the Police;
- If we are defending a legal claim your information may be transferred as required in connection with defending such claim.
Your personal data may be shared if it is made anonymous and aggregated, as in such circumstances the information will cease to be personal data.
ICAEW is based in the UK and we will store your personal data in the UK. Your personal data may be transferred to countries outside of the UK. For example, your Personal Data may be shared with one of ICAEW’s overseas offices if necessary such as for exam arrangements, presentation ceremonies or to deal with queries from you or your employer.
Where personal data is transferred outside of the European Economic Area (EEA) or UK to a country which is not subject to an adequacy decision (i.e. does not have equivalent data protection laws to those applicable in the EEA or UK), it is done on the basis of model clauses (copies of the template model clauses can be found here: or, where applicable in relation to transfers to the US, privacy shield certification.
ICAEW will retain your personal data for no longer than is reasonably necessary or required by law. How long we keep personal data depends on the type of information and purpose of processing
The criteria we use to determine the retention period is as follows:
- the length of time that you have a relationship with us;
- whether there is any ongoing legal claim or dispute;
- the length of any specific retention period required by applicable law, statute or regulation;
- whether special category personal data is held in which case a shorter retention period will generally be applied; and
- what the expectation for retention was at the time the personal data was provided to us.
Some of the personal data we process is mandatory meaning that if you do not provide it to us, we will be unable to provide some or all student services to you. For example, if you don't enter the mandatory data when registering as a student with us, you will not be able to register as a student with us.
We, (ICAEW) provide online invigilation as a service via our supplier, BTL Group Limited. If we, offer you (the candidate) a test/examination through the online invigilation platform that BTL provides (powered by ProctorExam) and if you choose to take such test/examination through the platform, you agree that you are being monitored over the Internet through your computer via your webcam and microphone during your exam session. Online invigilation means that you will log on to a test platform through the internet to take your assessment and you will be monitored, sometimes in real time, during your entire assessment session so that your face, voice, desk and workspace will be captured and a recording will be made of these for the purposes of assessment security and the integrity of the assessment process. It is your responsibility to ensure that only you will be recorded during an online invigilation testing session and that no one else will be physically in the room where you are testing and that no one speaks to you during your testing sessions.
If you use the online invigilation service to take assessments, BTL may also collect and record further information about you when you take the exam which is online invigilated, such as your name, email address, captured facial photo, captured ID photo/government issued ID, physical (visible) health data/condition (by virtue of video recording), racial/ethnic origin/religious beliefs (by virtue of video recording), IP address, browser agents, browser and operating system identifiers, screenshots of your PC, your exam setting (home, office etc), all recorded video streams (computer, webcam and mobile), name of the exam you are sitting and other assessment based data that may be collected, including information about browser version, appVersion, appName, product and appCodeName, video frame size, type and library used for encoding, framerate, jitter, packet loss and bandwith.
The video and audio recordings are standard test procedures for all awarding organisations’ online invigilated tests and your video and audio recording will be used for purposes of identity verification, online observation, incident resolution such as fraud prevention, test security and for the integrity of the test and testing process.
All of the same personal data that BTL collect or receive as described above re Surpass applies for all awarding organisation’s online invigilated test. Prior to the start of your online invigilated test you may be required to take a picture of yourself. The collection of such data is optional, but necessary if you choose to use the online invigilation function. You understand that the audio and video-tapes of your testing sessions, as well as photos, will be supplied in certain circumstances to us, the awarding organisation, to assist with the test management of your test.
BTL will retain your personal data no longer than is necessary for the purposes for which it is processed. The length of time for which BTL retain information may also depend on the specific retention periods set out by us, your awarding organisation, and applicable laws.
When you use the online invigilation service, BTL use selected third party service ProctorExam that is hosted in in Germany (Frankfurt Region), to process your data on our behalf. As part of the provision of the service by BTL to us, your awarding organisation, you agree that some or all of the above personal data may be processed outside the UK and EEA. In such circumstances, and if you are based in the UK or EU, we will, as required by GDPR, ensure that your privacy rights are protected by appropriate safeguards.
Updated 21st July 2020.