Privacy Notice
Last updated 22 July 2026
1. Who we are
Invigil Ltd (“Invigil”, “we”, “us”) is a company registered in England and Wales, company number [COMPANY NUMBER], registered office 128 City Road, London EC1V 2NX.
This notice explains how we handle personal data collected through invigil.co (the “Website”). For this processing we are the controller: we decide why and how the data is used.
It does not cover the Invigil assessment platform itself. Where an institution licenses Invigil and uses it to run examinations, that institution is the controller for candidate data and we act as its processor under a separate data processing agreement.
2. What we collect, why, and for how long
We collect only what the Website needs to function and to answer enquiries. We do not build marketing profiles, and there is no tracking or advertising technology on this site.
| What | Why | Lawful basis | Kept for |
|---|---|---|---|
| Demo enquiries Name, work email, institution, job role, enquiry type and anything you write in the message box. |
To reply to you and, if it goes further, to arrange and run a demonstration. | Legitimate interests (UK GDPR Art. 6(1)(f)) - responding to someone who has asked us to get in touch. | 24 months after our last exchange, unless it becomes part of a customer record. |
| Anti-spam signals Time taken to complete the form, a short-lived signed token, and the IP address the submission came from. |
To keep the enquiry form usable and stop automated abuse. | Legitimate interests (Art. 6(1)(f)) - protecting our systems. | The token expires after one hour. Rate-limiting data is held in memory only and is not written to a database. |
| Server and security logs IP address, user agent, requested page, timestamp. |
To operate the site, investigate faults and detect abuse. | Legitimate interests (Art. 6(1)(f)) - running a secure, reliable website. | Retained by our hosting provider on a rolling short-term basis (typically no more than 30 days). |
| Display preference Your light/dark theme choice. |
So the site looks the way you left it. | Not personal data - it stays in your own browser and is never transmitted to us. See the Cookie Policy. | Until you clear your browser storage. |
We do not sell, rent or trade personal data. We do not use enquiry content, or anything else collected here, to train machine-learning models.
2a. Cookies and consent
We use one strictly necessary cookie to remember your response to the cookie banner, and no analytics or advertising cookies. The full detail is in our Cookie Policy.
3. Who we share it with
We keep the list of recipients deliberately short:
- Vercel Inc. - hosting and content delivery for the Website.
- Resend (Plus Five Five, Inc.) - delivery of the notification email generated by the enquiry form.
- Professional advisers and authorities - only where we are required to disclose by law, or need advice on a legal claim.
Each provider is engaged under a written contract that restricts them to processing data on our instructions. We do not share your details with advertisers, data brokers or resellers.
4. Transfers outside the UK
Our hosting and email providers operate internationally, so your data may be processed outside the United Kingdom. In particular, mail generated by the enquiry form is currently sent through infrastructure in the Asia-Pacific (Tokyo) region.
Where personal data leaves the UK we rely on UK adequacy regulations or on the International Data Transfer Addendum to the EU Standard Contractual Clauses, together with appropriate technical safeguards including encryption in transit. You can ask us for details of the safeguards that apply using the contact details below.
5. Your rights
Under UK data protection law you can ask us to:
- Give you a copy of the personal data we hold about you.
- Correct anything inaccurate or incomplete.
- Delete it, where we no longer have a good reason to keep it.
- Restrict what we do with it while a question about it is resolved.
- Object to processing we carry out on the basis of legitimate interests - including any use of your details to contact you. If you object to being contacted, we will stop.
- Port it to you or another controller in a common machine-readable format, where that right applies.
We do not make decisions about you by automated means alone.
To exercise any of these, email privacy@invigil.co. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.
6. Complaints
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk, helpline 0303 123 1113), the UK supervisory authority for data protection.
7. Children
This Website is aimed at staff at universities, awarding bodies and other institutions. We do not knowingly collect personal data about children through it. If you believe a child has sent us personal data, contact us and we will delete it.
8. Security
The Website is served only over HTTPS. Enquiry submissions are transmitted over an encrypted connection, and the credentials used to send notification email are held as server-side secrets that are never exposed to your browser.
9. Changes
If we change how we handle personal data we will update this page and revise the date at the top. Material changes will be made prominent.
10. Contact
Email privacy@invigil.co, or write to Invigil Ltd, 128 City Road, London EC1V 2NX.