Privacy Policy

This Privacy Policy explains how Westbridge Institute ("we", "us", "our") collects, uses, stores and protects your personal data when you use our website at wbridge.uk, take the online English test and order a CEFR certificate. We are committed to handling your information responsibly and in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Westbridge Institute is the data controller responsible for the personal data processed through this website. If you have any questions about this policy or about how we use your data, you can contact us using the details at the end of this page.

2. Information we collect

We only collect the data we need to provide the test, issue your certificate and verify it on request. This includes:

• Identity and contact data - the full name and email address you enter when requesting your certificate.
• Assessment data - your test answers, your score and the CEFR level awarded.
• Certificate data - the unique certificate ID, the level recorded on it and the date of issue.
• Payment data - payments are processed securely by Stripe. We do not see or store your full card number; we receive only a confirmation that payment succeeded and a transaction reference.
• Technical data - basic information such as your IP address, browser type and pages visited, collected through server logs and cookies (see our Cookie Policy).

3. How we use your information

We use your personal data to:

• score your test and determine your CEFR level;
• generate, deliver and store your personalised certificate;
• process your payment and provide proof of purchase;
• allow third parties to verify the authenticity of a certificate by its ID;
• respond to your enquiries and provide customer support;
• maintain the security and integrity of our service and meet our legal obligations.

4. Legal basis for processing

We process your data on the following bases: performance of a contract (to deliver the test and certificate you paid for), legitimate interests (to secure our service and verify certificates), consent (for non-essential cookies) and legal obligation (to keep records required by law).

5. Certificate verification

To support the value of our certificates, a limited set of details - the holder's name, certificate ID, CEFR level and date of issue - can be displayed on our verification page when someone enters a valid certificate ID. By ordering a certificate you understand that these details may be shown for verification purposes.

6. Sharing your information

We do not sell your personal data. We share it only with trusted providers who help us run the service, including Stripe for payment processing and our email delivery provider for sending your certificate. These providers are bound by their own data protection obligations. We may also disclose data where required by law.

7. Data retention

We keep certificate records for as long as necessary to support verification and to meet our legal and accounting obligations. Test answers that do not result in a purchased certificate are kept only for a short period and then deleted.

8. Data security

We use appropriate technical and organisational measures to protect your data, including encryption in transit (HTTPS), restricted access to stored certificates and secure handling of payment data by Stripe. No method of transmission over the internet is completely secure, but we work to protect your information at all times.

9. Your rights

Under UK data protection law you have the right to access, correct, delete or restrict the processing of your personal data, to object to processing and to request data portability. To exercise any of these rights, contact us using the details below. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

10. Changes to this policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with a revised "last updated" date.