For pupils aged 11 and above using our Common Entrance preparation product.
Last updated: 26 May 2026
Version: 1.0
Looking for a simpler version? See our Child-Friendly Privacy Summary.
This is the privacy notice for our Common Entrance (CE 13+) preparation product (the "CE 13+ surface"). It explains how Tête-à-Tête ("we," "our," or "us") collects, uses, stores, and protects personal data when pupils, parents, and schools use this surface.
The CE 13+ surface is a distinct product from our main GCSE preparation product. It has its own admission path, its own defaults, and (because it admits pupils aged 11 and above) stricter Children's Code protections. For our GCSE product — used by learners aged 13 and above — please see our main Privacy Notice. The data controller, the list of sub-processors, and contact details are the same across both products; this notice does not repeat them.
The processing described here is documented in our Data Protection Impact Assessment (DPIA), most recently reviewed in June 2026. The DPIA is available to school data protection officers on request to privacy@tete-a-tete.ai.
This notice complies with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the ICO's Age Appropriate Design Code (Children's Code).
The CE 13+ surface is available to pupils aged 11 and above who are preparing for the ISEB Common Entrance 13+ exam in French or Spanish. Because pupils on this surface may be under 13, accounts are admitted only via one of two documented parental-consent paths described in section 3.
For pupils under 13 who reach the platform outside one of these documented consent paths, we do not knowingly collect personal data. If we become aware that such an account has been created, we will delete it.
A parent or legal guardian creates their own account on Tête-à-Tête. The parent reads a consent form summarising what data we collect about their child, the lawful basis (consent, per UK GDPR Article 8), how long we keep it, who else processes it, and how to withdraw. The parent confirms consent via a link sent to their verified email address — the "email plus" verification pattern referenced in ICO guidance. We record who consented, when, which version of the consent text was agreed, and the evidence of the email confirmation.
The parent then provisions one or more pupil accounts from their parent dashboard. For each pupil, the parent chooses a username and a simple password or PIN. We do not collect an email address or any other separate contact detail for the pupil. The parent shares those credentials with their child.
Parents with more than one CE 13+ pupil link all of them to the same parent account. Each pupil signs in as themselves; the parent dashboard shows progress and consent state across all linked pupils.
A school that has signed our School Data Processing Addendum may provision CE 13+ pupil accounts for its pupils. In that case, the school is the data controller and Tête-à-Tête is the processor. Parental consent flows through the school's existing safeguarding and data-protection stack — the consent parents already gave the school at enrolment.
The school's designated data protection officer (DPO) attests, in our admin interface, that the school has obtained parental consent for each named pupil. That per-pupil attestation is the consent evidence we hold for the school-led path. The school then distributes pupil credentials (username + password or PIN) directly to its pupils — we do not contact pupils.
Schools can withdraw individual pupils, or all pupils, at any time via the same admin interface. Withdrawal deletes the pupil's data within 30 days, as described in section 6.
CE 13+ pupil accounts use a username plus a simple password or PIN. We do not collect a pupil email address. We do not collect a pupil phone number. Pupils sign in as themselves from any device the parent or school has chosen to support — typically a school-provided device for the school-led path, or a family device for the parent-led path.
Pupils cannot reset their own password. In the parent-led path, the parent resets it from the parent dashboard. In the school-led path, the school's designated administrator resets it from the admin interface.
CE 13+ pupil accounts ship with the following defaults. These are role-level defaults that the pupil cannot toggle, and that the school cannot lift on a pupil's behalf:
These defaults are stricter than those that apply to our GCSE users.
If you are a parent or legal guardian who has registered (parent-led path) or whose consent has been attested by your child's school (school-led path), you can:
Withdrawal of consent pauses your child's access immediately. We then delete your child's personal data within 30 days of the withdrawal, including practice transcripts, scores, and any associated profile information. The consent record itself is retained as an audit artefact (showing that consent was given, then withdrawn, with dates) but contains no practice data.
The consent given by a parent or guardian — or attested by a school — is the lawful basis on which we hold and process the pupil's data until the pupil reaches the age of 13.
On the pupil's 13th birthday, UK GDPR Article 8 vests the right to consent in the pupil directly. Rights over the account transfer to the pupil automatically; the pupil receives the option to set up their own login (typically migrating from username + PIN to email + password); and the parent's dashboard becomes view-only unless the pupil chooses to retain parental oversight.
The transition is not gated on the parent confirming it. If the pupil prefers to keep parental oversight in place after 13, they can do so from their own account settings.
For pupils under 13, our lawful basis is consent per UK GDPR Article 8 — given by a parent or legal guardian in the parent-led path, or attested as obtained by the school in the school-led path.
For pupils aged 13 and above on the CE 13+ surface, the lawful basis becomes consent given by the pupil directly (Article 6(1)(a)) once the age-13 transition has completed (see section 7).
We use the same set of sub-processors for the CE 13+ product as for our GCSE product. The list — covering our cloud-hosting providers, AI inference providers, email delivery, error monitoring, and analytics — is maintained in our main Privacy Notice so that schools and parents read a single canonical list.
No new sub-processor is introduced by the CE 13+ product. No pupil data is shared with advertising networks. No pupil data is sold.
We keep CE 13+ pupil data only while the underlying consent is in force. On withdrawal — by parent, by school, or on the pupil reaching the age of 13 if they choose to delete rather than transition — we delete pupil personal data within 30 days.
Consent records (the audit log of when consent was given, by whom, and when withdrawn) are retained for 6 years as a regulatory audit artefact under UK GDPR accountability requirements. They contain no practice data.
Privacy enquiries about CE 13+ should be sent to privacy@tete-a-tete.ai. Schools using the school-led path should additionally direct their own pupils' parents to their school DPO as the primary contact, in line with the school being the data controller for those accounts.
If you're not satisfied with our response to a privacy concern, you can lodge a complaint with the Information Commissioner's Office (ICO):
Website: ico.org.uk
Phone: 0303 123 1113
Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
See also: Main Privacy Notice (GCSE) · Child-Friendly Summary · Privacy Notice for Schools · School Data Processing Addendum