Privacy Notice

Who is responsible for the data?

Pathway Eleven is a UK-based online 11 plus preparation service and is the controller of the personal data described in this notice. The controller’s legal identity is Mohammad Waqas, trading as Pathway Eleven, a sole trader established in the United Kingdom. The parent or carer creates and manages the family account. A child does not need an email address or a public profile.

Privacy questions, and any request to see, correct or delete data, go to info@pathwayeleven.co.uk.

Information we collect

Parent or carer information

• Email address, name, account identifiers and security information.
• Notification choices and records showing whether essential or requested emails were delivered.
• Support, privacy or safeguarding messages you send to us.
• If you reached us from one of our adverts and consented to advertising measurement on the marketing website, the campaign labels and the advert click identifier carried with that visit.

Child preparation information

• First name, age and school year.
• Optional exam date and target grammar school.
• Assessment, revision, guided-learning and mock-test answers, timings and progress.
• Skills requiring more support, teaching steps used, repair activities and questions reported as unclear.

Technical information

• Authentication, security and synchronisation records, including timestamps and information needed to keep the service reliable.
• A private offline copy of family progress stored on devices used to access the service.

We do not ask for a child’s email address, home address, precise location, photograph or school attendance record.

Why we use the information

• To create and secure the family account.
• To provide personalised preparation, save work and synchronise progress across devices.
• To show parents progress reports and practical next steps.
• To send account security messages and parent-selected study notifications.
• To detect faults, misuse and unclear or incorrect learning content.
• To meet legal, safeguarding and record-keeping responsibilities.
• Where an adult has consented on the marketing website, to measure which adverts and pages actually reach families who need this service.

We rely on performing our agreement with the parent or carer for the core service, and on legitimate interests for proportionate security, reliability and product improvement. Where consent is the appropriate basis, it can be withdrawn by contacting us. We consider the child’s best interests when designing and operating the service.

Who processes the information?

We use carefully selected providers to operate Pathway Eleven:

• Cloudflare for website hosting, delivery and security.
• Supabase for parent authentication, the private database and server functions.
• Resend for transactional parent emails.
• Stripe for subscription payments and card processing.
• Meta Platforms Ireland and Google Ireland, on the public marketing website only, and only if an adult has given consent, to measure advertising and website performance. They receive nothing at all about a child.

These providers process information under their own security and contractual safeguards. If information is processed outside the UK, we require an appropriate lawful transfer mechanism. We may also disclose information when legally required or where necessary to protect a child or another person from serious harm.

Cookies and the marketing website

Our public marketing website, pathwayeleven.co.uk, is where families first find us. It is the only part of Pathway Eleven that can use advertising or analytics cookies, and nothing is set until an adult chooses it. On a first visit a banner asks for that choice; rejecting is exactly as easy as accepting, and if the banner is closed without a choice, nothing is loaded.

Only two purposes are ever offered, and each has its own switch:

• Website analytics (Google Analytics 4). Measures which marketing pages parents read, so the site can be improved. Google Signals and advertising personalisation are switched off.
• Advertising measurement (Meta Pixel and the Meta Conversions API). Lets us see which advert brought a family here, so the advertising budget is spent on what genuinely helps families.

If you consent to advertising measurement, we send Meta and Google a message when a trial starts, a payment is made and at six other moments. The next section lists every field in those messages. Some of it, including your IP address and your browser user agent, is sent in the clear. None of it is about a child.

Before you choose, on the pages our adverts point at. On the three pages an advert of ours can send you to (/start/, /start/west-midlands/ and /get-started/), our server tells Meta that the page was viewed, with the page address, your IP address and your browser type, before you have made any choice, so that we can measure whether the advert worked; no cookie is set for this, nothing is stored by us, and nothing about a child is sent.

Our lawful basis for these cookies, and for the advertising measurement that follows from them, is your consent (Privacy and Electronic Communications Regulations regulation 6, and UK GDPR Article 6(1)(a)). You can withdraw consent at any time by selecting Cookie choices in the footer of any marketing page and choosing Reject all, or by clearing cookies in your browser. Withdrawing stops any further use straight away, though it cannot undo processing already carried out. Essential website functions never rely on these cookies and continue to work whatever you choose.

Consent does not last for ever. A recorded choice expires six months after it was made, at which point the banner asks again. A stored choice we cannot date is treated as no choice at all, and nothing loads until you answer.

The postcode tool. On Which grammar schools can my child apply to, a postcode you type is sent to the postcodes.io lookup service when you press the button, so that it can return the Ordnance Survey coordinates for it, and it is not stored by us or carried in any analytics event. It is not written into the address bar either, so it cannot be carried into anything else you do on the page. Until 9 September 2026 it was: the tool put the postcode in the address bar so a result could be shared as a link, and if you also asked for a free download or joined the newsletter from that page, the page address that was recorded with your enquiry included it. We checked every stored page address on 9 September 2026 and none carried a postcode; the tool had been live for one day. The stored addresses were cut back to the page address alone regardless, and the site now refuses to store any page address that carries a query string.

What we send to Meta, in full

If you consent to advertising measurement, our servers send Meta a message when certain things happen on this website or in the parent account. This section lists everything those messages can contain. It is deliberately complete rather than summarised, because an earlier version of this notice described three fields when the system was sending ten.

Nothing in any of it is about a child. Not a name, an age, a school year, an exam date, a target school, or any answer, score or timing from the app.

Who you are, as Meta receives it

Five of these ten are sent as a one-way SHA-256 hash, which Meta uses to match a record it already holds. Five are sent in the clear, which means exactly that: they are readable by Meta as ordinary text. Meta requires the second group unhashed; hashing them would stop the matching working, so the honest answer is that they are not protected by hashing at all.

What happened, as Meta receives it

Each message also carries the event name, the time it happened, a unique event identifier used to stop the same thing being counted twice, whether it came from a person on the website or from an automatic renewal, and the marketing-site address the event is attributed to. No app address is ever used.

The eight events, and what sets each one off

Google Analytics receives far less: a client identifier and a trial-start or purchase event with its value. No name, no email address and no account identifier reach Google.

If you have not granted advertising measurement, none of this is sent, with the single exception described above: not the events, not the identifiers, and not the IP address, except in the page-view message sent from the three advert pages. Withdrawing the grant stops it from that moment: the record held against your account is updated, the identifiers stored with it are blanked, and any Meta tag already running in the page you are on is told to stop.

The free downloads and the emails that follow

Three items on this website are free downloads, given in exchange for an email address: the practice papers, the Year 5 term planner and the 11 plus vocabulary list. Asking for one puts the address on our marketing list.

We store the address, the first name you give with it, a one-way salted hash of the address, the campaign labels and advert click identifiers carried with the visit where advertising consent was given, and a salted one-way hash of the IP address the request came from. The IP hash exists to stop one machine harvesting every download and for nothing else; the raw address itself is not stored.

Nothing is sent until you confirm the address by opening a link we email you. After that you receive the download, then a short sequence: on day 3, on day 10, and then once a month until month 6. Every one of those messages carries a one-click unsubscribe link, and the same link is offered by Gmail and Outlook in their own interface. Unsubscribing stops the sequence immediately and permanently. Our lawful basis for these is your consent, which you may withdraw at any time.

Messages sent through the contact form are kept as sent, with the same salted IP hash, so that we can answer you and can tell one enquiry from a flood of them.

Counting visits without identifying anyone

Both the marketing website and the app’s sign-up page send a single anonymous beacon when a page is opened. It records only which of a handful of pages was viewed and a coarse label for where the visit came from: organic, a WhatsApp link, or other. There is no identifier of any kind: no cookie, no account, no address, no IP. What is stored is a daily counter per page and source, and it cannot be traced back to a person or a device. It runs whatever you choose on the consent banner, because there is nothing about you in it.

Faults and error reports

When something goes wrong in the app or on this website, the browser sends us a report so the fault can be fixed. It contains the error message, the technical stack trace, the address of the page it happened on, the version of the software, a salted one-way hash of the IP address, and, if you were signed in, the account identifier. Addresses and tokens are stripped from the text before it is sent. These reports are deleted after 30 days.

This is strictly necessary to operate a reliable service and is not gated on the consent banner. No third-party service is involved: the reports go to our own servers.

Cookies and storage, item by item

This is every cookie and every stored item the two sites use. “Marketing site” means pathwayeleven.co.uk; “app” means app.pathwayeleven.co.uk, the origin a child uses.

Only pe_consent is ever set without a choice, and it exists only to record the choice itself. The five vendor cookies are set only after the matching purpose is granted, and choosing Reject all deletes the ones this site can reach. The app sets no cookies at all.

None of these is an advertising or analytics tracker, none is shared with anyone, and all of them are removed from a device by signing out and clearing site data in the browser.

How long we keep it

Every class of data has a stated period and a mechanism that enforces it. Nothing is kept “until we get round to it”.

Limited copies may remain briefly in our providers’ encrypted backups, which age out on their own schedules, and in records we are required to keep for legal, security or fraud-prevention reasons.

Deleting the account

You can delete the whole account yourself, from inside the app. Open Parent area → Settings & data, find Delete the account, type the word DELETE and enter your parent PIN.

There is a seven-day cooling-off period. Nothing is deleted immediately. We email the parent address with the date the deletion will happen and a single link that stops it, and the deletion cannot proceed until that email has been sent. Until the date arrives you can stop it either from that link or from the same panel in the app, and everything continues exactly as before.

On the date, we permanently delete the parent account and its sign-in credentials, every child’s preparation record, results, reports and session evidence, the parent email preferences and delivery history, the billing records held here, the referral and cancellation records, the marketing attribution and conversion records, and any entry for your address on the marketing list and in the contact-form messages. Question-quality reports stay, with the account identifier removed. This cannot be undone and we hold no copy we could restore from afterwards.

Any marketing attribution record and the conversion record made from it are deleted together with the account, through the same deletion.

An active subscription is cancelled at the same time, so nothing is charged after that date. The current paid month runs to its end.

We also ask Meta, Resend, Stripe and Google to delete what they hold, using the identifiers we sent them. What each of those companies then retains is governed by their own terms and by the law that applies to them, and we cannot guarantee it on their behalf.

If you would rather clear a child’s learning record without closing the account, Erase family record in the same panel does that and leaves the account and subscription in place.

If you cannot sign in, or have forgotten the parent PIN, you can still request full account deletion by emailing info@pathwayeleven.co.uk from the parent account address. We confirm identity, then run the same deletion by hand.

We review retention as the service develops and will update this notice before materially changing how long children’s information is kept.

Your choices and rights

Depending on the circumstances, you may ask us to provide a copy of personal data, correct it, erase it, restrict or object to its use, or transfer information you supplied. You can also change parent email preferences inside the account.

Erasure needs no email at all: it is a control in the parent area, described in Deleting the account above. For everything else, email info@pathwayeleven.co.uk from the parent account address. We may need to confirm identity before acting, and we answer within one month. You may also complain to the Information Commissioner’s Office.

Security and family devices

Family records are separated by authenticated account controls. The parent area has an additional PIN, and data is encrypted in transit. Because an offline copy can remain on a device, parents should sign out on shared devices and protect the device with a passcode. No online service can promise absolute security, but suspected incidents are investigated and affected families will be notified where required.

Changes to this notice

We will update the date on this page when the notice changes. If a change materially affects how a child’s data is used, we will give the parent or carer a clear notice and request a new acknowledgement where appropriate.