Privacy Notice

Who is responsible for the data?

Pathway Eleven is a UK-based online 11 plus preparation service and is the controller of the personal data described in this notice. The controller’s legal identity is Mohammad Waqas, trading as Pathway Eleven, a sole trader established in the United Kingdom. The parent or carer creates and manages the family account. A child does not need an email address or a public profile.

Privacy questions, and any request to see, correct or delete data, go to info@pathwayeleven.co.uk.

Information we collect

Parent or carer information

• Email address, name, account identifiers and security information.
• Your mobile number, which you give when you set the account up and can change later in Settings. We use it to reach you about your child’s account, and, if you accept advertising measurement, it is turned into a one-way SHA-256 hash and sent to Meta alongside the hash of your email address so that an advert can be matched to a result. We never send it to Meta in the clear, and it is never a child’s number.
• Notification choices and records showing whether essential or requested emails were delivered.
• Support, privacy or safeguarding messages you send to us.
• If you reached us from one of our adverts and consented to advertising measurement on the marketing website, the campaign labels and the advert click identifier carried with that visit.

Child preparation information

• First name, age and school year.
• Optional exam date and target grammar school.
• Assessment, revision, guided-learning and mock-test answers, timings and progress.
• Skills requiring more support, teaching steps used, repair activities and questions reported as unclear.

Technical information

• Authentication, security and synchronisation records, including timestamps and information needed to keep the service reliable.
• A private offline copy of family progress stored on devices used to access the service.

We do not ask for a child’s email address, home address, precise location, photograph or school attendance record.

Why we use the information

• To create and secure the family account.
• To provide personalised preparation, save work and synchronise progress across devices.
• To show parents progress reports and practical next steps.
• To send account security messages and parent-selected study notifications.
• To detect faults, misuse and unclear or incorrect learning content.
• To meet legal, safeguarding and record-keeping responsibilities.
• Where an adult has consented on the marketing website, to measure which adverts and pages actually reach families who need this service.

We rely on performing our agreement with the parent or carer for the core service, and on legitimate interests for proportionate security, reliability and product improvement. Where consent is the appropriate basis, it can be withdrawn by contacting us. We consider the child’s best interests when designing and operating the service.

Who processes the information?

We use carefully selected providers to operate Pathway Eleven:

• Cloudflare for website hosting, delivery and security.
• Supabase for parent authentication, the private database and server functions.
• Resend for transactional parent emails.
• Stripe for subscription payments and card processing.
• Meta Platforms Ireland and Google Ireland, on the public marketing website only, and only if an adult has given consent, to measure advertising and website performance. They receive nothing at all about a child.

These providers process information under their own security and contractual safeguards. If information is processed outside the UK, we require an appropriate lawful transfer mechanism. We may also disclose information when legally required or where necessary to protect a child or another person from serious harm.

Cookies and the marketing website

Our public marketing website, pathwayeleven.co.uk, is where families first find us. It is the only part of Pathway Eleven that can use advertising or analytics cookies, and nothing is set until an adult chooses it, apart from the two advert cookies described below. On a first visit a banner asks for that choice; rejecting is exactly as easy as accepting, and if the banner is closed without a choice, nothing is loaded.

Only two purposes are ever offered in that banner, and each has its own switch:

• Website analytics (Google Analytics 4). Measures which marketing pages parents read, so the site can be improved. Google Signals and advertising personalisation are switched off.
• Advertising measurement (Meta Pixel and the Meta Conversions API). Lets us see which advert brought a family here, so the advertising budget is spent on what genuinely helps families.

Cloudflare, which hosts the site, also counts page views with a small script of its own that sets no cookie, stores nothing on the device and does not identify the visitor, and it runs whether or not analytics is accepted because it needs no consent.

If you consent to advertising measurement, we send Meta and Google a message when a trial starts, a payment is made and at six other moments. With that same consent, the Meta Pixel on our marketing pages also tells Meta which page you are reading and when you press a button that leads to signing up, including on our home page. The next section lists every field in those messages. Some of it, including your IP address and your browser user agent, is sent in the clear. None of it is about a child.

Before you choose, on the pages our adverts point at. On the three pages an advert of ours can send you to (/start/, /start/west-midlands/ and /get-started/), our server tells Meta that the page was viewed, with the page address, your IP address and your browser type, before you have made any choice, so that we can measure whether the advert worked; on those same three pages we also tell Meta when the start button is pressed, with the same information and nothing more, so that we can see which adverts lead to someone starting; nothing is stored by us, and nothing about a child is sent. Two cookies are set on those three pages before you choose, and only on those three pages. They are _fbp, a random identifier for your browser, and _fbc, which records the advert click you arrived from and is written only when the link carries one. We set them ourselves, in Meta’s format, so that the advert can be measured at all: without _fbp the message above has almost nothing to match on. Both last 90 days, both are sent with that message, and choosing Reject all on the banner deletes them and stops the message carrying them.

Our lawful basis for these cookies, and for the advertising measurement that follows from them, is your consent (Privacy and Electronic Communications Regulations regulation 6, and UK GDPR Article 6(1)(a)). You can withdraw consent at any time by selecting Cookie preferences in the footer of any marketing page and choosing Reject all, or by clearing cookies in your browser. Withdrawing stops any further use straight away, though it cannot undo processing already carried out. Essential website functions never rely on these cookies and continue to work whatever you choose.

Consent does not last for ever. A recorded choice expires six months after it was made, at which point the banner asks again. A stored choice we cannot date is treated as no choice at all, and nothing loads until you answer.

The postcode tool. On Which grammar schools can my child apply to, a postcode you type is sent to the postcodes.io lookup service when you press the button, so that it can return the Ordnance Survey coordinates for it, and it is not stored by us or carried in any analytics event. It is not written into the address bar either, so it cannot be carried into anything else you do on the page. Until 9 September 2026 it was: the tool put the postcode in the address bar so a result could be shared as a link, and if you also asked for a free download or joined the newsletter from that page, the page address that was recorded with your enquiry included it. We checked every stored page address on 9 September 2026 and none carried a postcode; the tool had been live for one day. The stored addresses were cut back to the page address alone regardless, and the site now refuses to store any page address that carries a query string.

What we send to Meta, in full

If you consent to advertising measurement, our servers send Meta a message when certain things happen on this website or in the parent account. This section lists everything those messages can contain. It is deliberately complete rather than summarised, because an earlier version of this notice described three fields when the system was sending ten. There are now eleven.

Nothing in any of it is about a child. Not a name, an age, a school year, an exam date, a target school, or any answer, score or timing from the app.

Who you are, as Meta receives it

Six of these eleven are sent as a one-way SHA-256 hash, which Meta uses to match a record it already holds. Five are sent in the clear, which means exactly that: they are readable by Meta as ordinary text. Meta requires the second group unhashed; hashing them would stop the matching working, so the honest answer is that they are not protected by hashing at all.

What happened, as Meta receives it

Each message also carries the event name, the time it happened, a unique event identifier used to stop the same thing being counted twice, whether it came from a person on the website or from an automatic renewal, and the marketing-site address the event is attributed to. No app address is ever used.

The ten events, and what sets each one off

Google Analytics receives far less: a client identifier, a purchase event with its value, and an event recording that a Starting Assessment was completed, which carries no value at all. No name, no email address and no account identifier reach Google.

If you have not granted advertising measurement, none of this is sent, with the single exception described above: not the events, not the identifiers, and not the IP address, except in the page-view message sent from the three advert pages. Withdrawing the grant stops it from that moment: the record held against your account is updated, the identifiers stored with it are blanked, and any Meta tag already running in the page you are on is told to stop.

The free downloads and the emails that follow

Three items on this website are free downloads, given in exchange for an email address: the practice papers, the Year 5 term planner and the 11 plus vocabulary list. Asking for one puts the address on our marketing list.

We store the address, the first name you give with it, a one-way salted hash of the address, the campaign labels and advert click identifiers carried with the visit where advertising consent was given, and a salted one-way hash of the IP address the request came from. The IP hash exists to stop one machine harvesting every download and for nothing else; the raw address itself is not stored.

Nothing is sent until you confirm the address by opening a link we email you. After that you receive the download, then a short sequence: on day 3, on day 10, and then once a month until month 6. Every one of those messages carries a one-click unsubscribe link, and the same link is offered by Gmail and Outlook in their own interface. Unsubscribing stops the sequence immediately and permanently. Our lawful basis for these is your consent, which you may withdraw at any time.

The same list receives our newsletter and an occasional note when a new guide is published. Those messages, like most marketing email anywhere, record whether the message was opened and which link was clicked: an image in the message and a link that passes through our email provider, Resend, on its way to our site. We store that as a date and time against a one-way hash of your address, never against the address itself, and we use it to see whether an issue was worth sending. It is not used to build a profile or to make any decision about you, blocking images in your email app stops the open being recorded, and the one-click unsubscribe in every message stops all of it.

Messages sent through the contact form are kept as sent, with the same salted IP hash, so that we can answer you and can tell one enquiry from a flood of them.

Counting visits without identifying anyone

Both the marketing website and the app’s sign-up page send a single anonymous beacon when a page is opened. It records only which of a handful of pages was viewed and a coarse label for where the visit came from: organic, a WhatsApp link, or other. There is no identifier of any kind: no cookie, no account, no address, no IP. What is stored is a daily counter per page and source, and it cannot be traced back to a person or a device. It runs whatever you choose on the consent banner, because there is nothing about you in it.

Counting new and returning visitors. So that we can tell how many different people visit and how many come back, the marketing website keeps one anonymous number in your browser’s storage, under pe_vid, with the date it was first kept. It is a random number: it is not a cookie, it is not shared with anyone, it is never sent to Meta or Google, it is never attached to your account, your email address or anything you do in the app, and it is used for nothing except counting visitors. What reaches our server is not the number itself but a one-way hash of it, which cannot be turned back into the number and is attached to nothing else about you; because the point is to tell a first visit from a return, that hash does stay the same between visits, and it is deleted after 13 months. We keep it under paragraph 5 of Schedule A1 to the Privacy and Electronic Communications Regulations, inserted by the Data (Use and Access) Act 2025 and in force since 5 February 2026, which allows storage whose only purpose is statistical information about how a site is used, with a view to improving it, provided you are told about it and can object. You can object. Open Cookie preferences in the footer, press Choose, and switch Visitor statistics off: the number is deleted from your browser at once, nothing replaces it, and your visits are then counted only by a daily one-way hash calculated on our server that is never stored in a form anyone could read back.

Faults and error reports

When something goes wrong in the app or on this website, the browser sends us a report so the fault can be fixed. It contains the error message, the technical stack trace, the address of the page it happened on, the version of the software, a salted one-way hash of the IP address, and, if you were signed in, the account identifier. Addresses and tokens are stripped from the text before it is sent. These reports are deleted after 30 days.

This is strictly necessary to operate a reliable service and is not gated on the consent banner. No third-party service is involved: the reports go to our own servers.

Cookies and storage, item by item

This is every cookie and every stored item the two sites use. “Marketing site” means pathwayeleven.co.uk; “app” means app.pathwayeleven.co.uk, the origin a child uses.

Three cookies are set without a choice: pe_consent, which exists only to record the choice itself, and _fbp and _fbc, which we set on /start/, /start/west-midlands/ and /get-started/ only, as the advertising section explains. Everything else here is set only after the matching purpose is granted, and choosing Reject all deletes every one of them that this site can reach, including those two. The app sets no cookies at all.

None of these is an advertising or analytics tracker, none is shared with anyone, and all of them are removed from a device by signing out and clearing site data in the browser.

How long we keep it

Every class of data has a stated period and a mechanism that enforces it. Nothing is kept “until we get round to it”.

Limited copies may remain briefly in our providers’ encrypted backups, which age out on their own schedules, and in records we are required to keep for legal, security or fraud-prevention reasons.

Deleting the account

You can delete the whole account yourself, from inside the app. Open Parent area → Settings & data, find Delete the account, type the word DELETE and enter your parent PIN.

There is a seven-day cooling-off period. Nothing is deleted immediately. We email the parent address with the date the deletion will happen and a single link that stops it, and the deletion cannot proceed until that email has been sent. Until the date arrives you can stop it either from that link or from the same panel in the app, and everything continues exactly as before.

On the date, we permanently delete the parent account and its sign-in credentials, every child’s preparation record, results, reports and session evidence, the parent email preferences and delivery history, the billing records held here, the referral and cancellation records, the marketing attribution and conversion records, and any entry for your address on the marketing list and in the contact-form messages. Question-quality reports stay, with the account identifier removed. This cannot be undone and we hold no copy we could restore from afterwards.

Any marketing attribution record and the conversion record made from it are deleted together with the account, through the same deletion.

An active subscription is cancelled at the same time, so nothing is charged after that date. The current paid month runs to its end.

We also ask Meta, Resend, Stripe and Google to delete what they hold, using the identifiers we sent them. What each of those companies then retains is governed by their own terms and by the law that applies to them, and we cannot guarantee it on their behalf.

If you would rather clear a child’s learning record without closing the account, Erase family record in the same panel does that and leaves the account and subscription in place.

If you cannot sign in, or have forgotten the parent PIN, you can still request full account deletion by emailing info@pathwayeleven.co.uk from the parent account address. We confirm identity, then run the same deletion by hand.

We review retention as the service develops and will update this notice before materially changing how long children’s information is kept.

Your choices and rights

Depending on the circumstances, you may ask us to provide a copy of personal data, correct it, erase it, restrict or object to its use, or transfer information you supplied. You can also change parent email preferences inside the account.

Erasure needs no email at all: it is a control in the parent area, described in Deleting the account above. For everything else, email info@pathwayeleven.co.uk from the parent account address. We may need to confirm identity before acting, and we answer within one month. You may also complain to the Information Commissioner’s Office.

Security and family devices

Family records are separated by authenticated account controls. The parent area has an additional PIN, and data is encrypted in transit. Because an offline copy can remain on a device, parents should sign out on shared devices and protect the device with a passcode. No online service can promise absolute security, but suspected incidents are investigated and affected families will be notified where required.

Changes to this notice

We will update the date on this page when the notice changes. If a change materially affects how a child’s data is used, we will give the parent or carer a clear notice and request a new acknowledgement where appropriate.