Privacy Policy

The Services are operated by Stande. We are the controller of the personal data we process about you.

If you have any question about this policy or your personal data, or you wish to exercise your rights, you can contact us by email:

This policy applies to personal data we process about visitors to our websites, people who book consultations, students who use our classes and tools, and parents or guardians who set up or manage accounts on behalf of a student.

Our Services may contain links to third party websites and services that are not operated by us. This policy does not apply to those services, and we are not responsible for their privacy practices.

Information you give us

• Account details: your name, email address, password and any profile information you provide when you register.
• Consultation enquiries: your name, the contact details you choose to give us (an email address or phone number) and any information you include in your message.
• Payment information: where you purchase a paid service, billing details processed by our payment providers. We do not store full card details.
• Communications: the content of messages and correspondence you send to us.

Information created through your use of the Services

• Learning data: the answers and work you submit, practice attempts, marks, feedback, grades and progress recorded as you use our tools and classes.
• Usage and technical data: device and browser type, IP address, approximate location, pages viewed, dates and times of access, the site that referred you and information collected through cookies and similar technologies.

Information from third parties

• Sign in providers: if you choose to sign in with Google, we receive basic account information such as your name, email address and a profile identifier.
• Service providers: information from the providers who help us operate the Services, as described below.

We use your personal data for the following purposes, relying on the legal bases set out below (under the UK GDPR, EU GDPR, Malaysia's Personal Data Protection Act 2010 and other applicable laws):

• To provide the Services (contract): to create and manage your account, deliver classes and tools, mark work and give feedback, respond to consultation requests and process payments.
• With your consent: to send marketing communications, to use non essential cookies, and, where a student is a child, to process data on the basis of parental or guardian consent. You can withdraw consent at any time.
• For our legitimate interests: to operate, secure, improve and understand use of the Services, to prevent fraud and misuse and to communicate with you about the Services, balanced against your rights and interests.
• To comply with legal obligations: to meet our legal, tax, accounting and regulatory duties and to respond to lawful requests.

Our Services are used by students preparing for school and college examinations, many of whom are under 18. We are committed to protecting the personal data of young people.

If you are under 18, you may use the Services only with the involvement, supervision and consent of a parent or guardian who agrees to our terms on your behalf. If you are under the minimum age of digital consent in your country (which is 13 in the United Kingdom and may be up to 16 in the European Union, and for whom a parent or guardian should consent in Malaysia and elsewhere), a parent or guardian must set up and manage the account and provide any consent required for us to process your personal data.

We do not knowingly collect personal data from a child without the appropriate consent. If you believe a child has provided us with personal data without the necessary consent, please contact us and we will take reasonable steps to delete it.

A parent or guardian may exercise a child's privacy rights on their behalf, and may contact us to access, correct or delete the child's data.

Some features assess or give feedback on student work. To do this, content you submit (such as your answers to questions) may be processed by trusted third party artificial intelligence and machine learning providers acting as our processors. This helps us mark work and provide feedback more quickly.

This processing may involve transferring content to providers located outside your country, as described in the International data transfers section. Where such terms are available to us, we use these providers on the basis that your content is not used to train their general models.

Automated marks and feedback are provided to support learning and teaching. We do not use solely automated decision making that produces legal or similarly significant effects about you. Any feedback generated in this way is a study aid and is not an official examination result or grade.

We use strictly necessary cookies and similar technologies to operate the Services, for example to keep you signed in and to keep the Services secure. With your consent, we may also use analytics or performance cookies to understand how the Services are used so we can improve them.

You can control cookies through your browser settings and, where we provide them, through our cookie controls. Blocking some cookies may affect how the Services work.

We share personal data with service providers who process it on our behalf under contract, and only for the purposes described in this policy. These include providers of:

• cloud hosting, infrastructure and database services that run our websites and app;
• email delivery, which we currently provide through Zoho;
• authentication, including sign in with Google where you choose to use it;
• artificial intelligence and marking services, as described above;
• payment processing, where you purchase a paid service; and
• analytics that help us understand and improve the Services.

We may also share personal data with our professional advisers (such as lawyers and accountants), with authorities and regulators where required by law, and with a buyer or successor in the event of a sale, merger or reorganisation of the business.

We do not sell your personal data. A current list of our main service providers is available on request.

We operate internationally and use service providers in different countries, so your personal data may be transferred to and processed in countries outside your own, including outside the United Kingdom, the European Economic Area and Malaysia. Data protection laws in those countries may differ from those where you live.

Where we transfer personal data internationally, we put appropriate safeguards in place, such as the UK International Data Transfer Agreement or Addendum, the European Commission's Standard Contractual Clauses, or reliance on a country that is recognised as providing an adequate level of protection. You can contact us for more information about these safeguards.

We keep personal data only for as long as necessary for the purposes set out in this policy, including to provide the Services, to comply with our legal, tax and accounting obligations, to resolve disputes and to enforce our agreements.

Account and learning data are kept while your account is active and for a reasonable period afterwards. Consultation enquiries are kept for a limited period so we can respond and for our records. When personal data is no longer needed, we delete it or make it anonymous.

We use appropriate technical and organisational measures to protect personal data, such as encryption of data in transit, access controls and the hashing of passwords. No method of transmission or storage is completely secure, so while we work hard to protect your data we cannot guarantee absolute security.

Depending on where you live, you have rights over your personal data. These may include the right to access your data, to have it corrected, to have it deleted, to restrict or object to processing, to data portability, to withdraw consent, and to opt out of marketing.

• United Kingdom and European Union (GDPR): the rights listed above, including the right to lodge a complaint with a supervisory authority.
• Malaysia (PDPA 2010): the right to access and correct your personal data, to withdraw consent, and to limit processing for direct marketing.
• California (CCPA and CPRA): the right to know, delete and correct your personal information, to opt out of any sale or sharing (we do not sell personal data) and not to be discriminated against for exercising your rights.

To exercise any of your rights, contact us at admin@stande.co. We may need to verify your identity first. We will respond within the time required by applicable law.

If you have a concern about how we handle your personal data, we ask that you contact us first so we can try to resolve it. You also have the right to complain to a data protection authority, including:

• United Kingdom: the Information Commissioner's Office (ICO) at ico.org.uk.
• Malaysia: the Personal Data Protection Department (Jabatan Perlindungan Data Peribadi).
• European Economic Area: your local supervisory authority.

Our Services may link to or rely on third party websites and services that we do not control. Their collection and use of your data is governed by their own privacy policies, and we encourage you to read them.

We may update this policy from time to time. We will post the updated version with a new date at the top, and where changes are significant we will take reasonable steps to notify you.

If you have any questions about this Privacy Policy or your personal data, please contact Stande by email: