Privacy Policy — Prism Maths Challenge

Summary

We do not receive, process or hold card details. Payment is made by bank transfer against an invoice, and we receive only the remittance details that the transfer itself generates.
We do not sell personal data, disclose it for advertising, or share it with data brokers.
No permanent record of results, rankings or certificates is retained. Information relating to a round is deleted within 60 days of publication of the results, subject to the exceptions at clause 12.
Recordings of Home Division sittings are used solely to verify the integrity of the sitting, are not published and are not disclosed to an entrant's school. They are deleted 30 days after publication of the results.
Recordings are not subjected to facial recognition, biometric analysis or any other automated analysis, and are not used to train any machine learning system.
No profiling of an entrant is carried out, and no advertising or tracking technology is directed at an entrant.
The website sets no cookies and carries no advertising or profiling technology. It counts visits using a privacy-preserving analytics service that stores nothing on the visitor's device, retains no IP address in retrievable form, and identifies no visitor and follows none between sites.
We do not request health data or any other special category of personal data at any stage.

This summary is provided for convenience and is not part of the policy. Clauses 1 to 20 govern.

1. The controller

1.1 Personal data processed in connection with the Prism Maths Challenge ("Prism", "the Challenge", "we", "us", "our") is controlled by Mina Lee, trading as Prism Maths Challenge.

1.2 Enquiries, requests and complaints concerning personal data are addressed to hello@prismmaths.org.

2. Scope

2.1 This policy governs the collection, use, disclosure, storage and deletion of personal data in connection with registration for the Challenge, the sitting of a paper, marking, results, the submission of problems, correspondence, the approaching of schools, and use of the website at prismmaths.org.

2.2 This policy forms part of the Terms and Conditions of Entry ("the Terms") under clause 2.3(a) of the Terms. In respect of personal data, this policy takes precedence over the Terms.

2.3 Terms defined in the Terms carry the same meaning here, including "entrant", "registrant", "Responsible Adult", "coordinator", "invigilator", "round" and "credentials".

2.4 A reference to a numbered clause is a reference to a clause of this policy, unless the reference states "of the Terms". The two documents number their clauses independently and several numbers appear in both.

2.5 This policy applies to the personal data of every person named in clause 4, whether or not that person is a party to the contract formed under the Terms.

3. Roles

3.1 On an individual entry, we determine the purposes and means of processing and are the controller.

3.2 On a school entry, the school determines which of its students are entered and what data concerning them is submitted to us, and is responsible for the lawful basis on which it does so. We are the controller of that data once submitted, and process it for the purposes at clause 5.

3.3 The providers listed at clause 10.3 process personal data on our instructions, except:

(a) each provider in respect of the account, billing and service data it generates for its own purposes under its own terms; and
(b) a bank or financial institution handling a transfer under clause 6.3 of the Terms.

4. Data we collect

4.1 Individual registration. The entrant's name, date of birth, grade, school name, territory and email address. The Responsible Adult's name and email address, where the entrant is under 18. Any consent given under clause 9.3. A record of the consents given at registration and of the confirmation given under clause 5.3 of the Terms.

4.2 School registration. The coordinator's name, role, school email address and telephone number. The school's name, territory and invoicing details. The roster: each entrant's name and grade. A date of birth is not collected on a school entry, no division available on a school entry being restricted by age.

4.3 Payment. Payment is made by international bank transfer against an invoice. We receive the remittance details generated by the transfer, comprising the remitting account name, the remitting institution, the sum, the currency, the date and the reference quoted, together with the invoicing contact details supplied on the registration form. We do not receive, process or hold card details. Where card payment is introduced under clause 6.3 of the Terms, card details will be given by the registrant directly to an independent payment provider and we will receive from it only a record of the transaction reference, sum, currency, date and the billing name and territory.

4.4 The sitting. The participation code issued, login and session timestamps, the answers submitted, the score derived from them, the entrant's IP address, and the activity logs generated by the exam platform.

4.5 Home Division. The video and audio recording of the sitting, the display name used to join, connection metadata generated by the video platform, and any note made by the invigilator.

4.6 Correspondence and enquiries. Messages sent to us and our replies, including any query under clause 12.5 of the Terms, challenge under clause 12.6 of the Terms, complaint under clause 26 of the Terms, and any enquiry made by a person who does not go on to register.

4.7 Submitted problems. Material submitted under clause 14 of the Terms; the author's name; the author's contact address; the consent of the Responsible Adult where the author is under 18; and the attribution elected under clause 9.5, including any pseudonym chosen for publication.

4.8 The website. Server request logs generated by the provider hosting the website, comprising IP address, timestamp, page requested and browser identification. The font provider named at clause 10.3 receives the same categories of data in respect of the request made for a typeface, and generates its own logs, which we do not receive. The analytics provider named at clause 10.3 receives the page requested, the referring page, and the country, browser, operating system and device type derived from the request; clause 15.6 applies to that transfer.

4.9 Marketing. The email address of a person who has opted in, the date and record of that opt-in, and the record of any subsequent unsubscription.

4.10 School outreach. The name, role and institutional contact details of a member of staff at a school we approach, together with the school's name and territory and a record of the correspondence. Such data is obtained from the school's own published material or from a publicly available directory, or is given to us by that person.

4.11 Persons engaged to deliver a round. The name, contact address and, where a fee is paid, the payment details of an invigilator, question setter or other person engaged by us, processed for the purpose of that engagement only.

4.12 Aggregate data. Statistics derived from the data at clause 4.4, comprising score distributions, question-level performance and participation by grade, region or curriculum. Clause 9.6 applies.

4.13 We do not request health data, ethnicity, religion or any other special or sensitive category of personal data, and none is required at any stage. No accommodation is offered in respect of a sitting and no supporting medical information is required or accepted. Where such information is volunteered to us, it is deleted and is not acted upon.

4.14 We do not collect personal data concerning any person other than a person described in clauses 4.1 to 4.11. Where personal data concerning any other person reaches us, it is not used and is deleted.

4.15 Source. Data at clause 4.1 is obtained from the registrant. Data at clause 4.2 is obtained from the school and not from the entrant; the school is required under clause 9.3(c) of the Terms to inform its students, before the sitting, that the entry has been made, and this policy is published for that purpose. Data at clauses 4.4, 4.5 and 4.8 is generated in the course of the sitting or of use of the website. Data at clause 4.10 is obtained as stated in that clause.

5. Purposes and legal bases

5.1 Personal data is processed for the following purposes and on the following bases:

| Purpose | Data | Basis |

| --- | --- | --- |

| Accepting a registration, verifying eligibility and forming the contract | 4.1, 4.2 | Performance of a contract, or steps taken at the registrant's request before entering into one |

| Taking payment, issuing an invoice or receipt, and reconciling a transaction | 4.3 | Performance of a contract |

| Issuing credentials and practice materials, and assigning an exam window | 4.1, 4.2 | Performance of a contract |

| Administering the sitting | 4.4 | Performance of a contract |

| Recording and invigilating a Home Division sitting | 4.5 | Consent, given under clause 10.6 of the Terms |

| Marking, ranking, issuing score reports and issuing certificates | 4.1, 4.2, 4.4 | Performance of a contract |

| Answering a query under clause 12.5 of the Terms or a challenge under clause 12.6 of the Terms | 4.4, 4.6 | Performance of a contract |

| Publishing a ranking or list of results by candidate number, grade, division and score | 4.1, 4.2, 4.4 | Our legitimate interest in publishing the outcome of the competition |

| Including an entrant's name in a published ranking or list of results | 4.1, 4.2 | Consent, given under clause 9.3 |

| Considering a submitted problem, publishing it, and attributing it in the manner elected | 4.7 | Consent |

| Verifying the integrity of a sitting and investigating a suspected breach of clause 8 of the Terms | 4.4, 4.5, 4.6 | Our legitimate interest in the integrity of the competition |

| Giving effect to an exclusion or the withdrawal of an award | 4.1, 4.2 | Our legitimate interest in enforcing the Terms |

| Corresponding with a registrant, entrant, Responsible Adult, coordinator or enquirer | 4.1, 4.2, 4.6 | Performance of a contract; our legitimate interest in answering an enquiry made to us |

| Operating and securing the website and the exam platform | 4.4, 4.8 | Our legitimate interest in the operation and security of the website and the platform |

| Sending marketing correspondence | 4.9 | Consent |

| Approaching a school to offer the Challenge, and corresponding with it | 4.10 | Our legitimate interest in offering the Challenge to schools; consent where the law applicable to the recipient requires it |

| Engaging a person to deliver a round | 4.11 | Performance of a contract with that person |

| Producing anonymised aggregate statistics | 4.4 | Our legitimate interest in reporting on and improving the Challenge |

| Retaining transaction, contract and complaint records required by law | 4.1, 4.2, 4.3, 4.6 | Legal obligation |

| Establishing, exercising or defending a legal claim | Any | Our legitimate interest in the conduct of a claim |

| Complying with any other legal obligation | Any | Legal obligation |

5.2 Where processing rests on consent, consent may be withdrawn at any time under clause 14. Withdrawal does not affect processing carried out before withdrawal. Clauses 7.6 and 9.5 state the effect of withdrawal in two particular cases.

5.3 Personal data is not used for any purpose incompatible with those stated above. It is not used to train any machine learning system.

5.4 Where the law applicable to a person does not recognise legitimate interest as a basis for processing, the processing stated in the table at clause 5.1 as resting on that basis rests instead on consent, obtained at registration or, in the case of clause 4.10, at the first approach. Where consent is not given, the processing is not carried out in respect of that person. This clause does not apply to the verification of the integrity of a sitting, to the giving of effect to an exclusion or withdrawal, or to the operation and security of the website and the exam platform, each of which is a condition of participation.

6. Children

6.1 An individual registration is not accepted for an entrant under 14. Entrants under 14 are eligible for the School Division only, in which the school registers on their behalf.

6.2 Where the entrant is under 18, the registration must name a Responsible Adult, who is the registrant and the party to the contract. The entry is not accepted until that person has confirmed it.

6.3 An entrant under 18 may give their own email address for the correspondence specified at clause 5.4 of the Terms. Confirmation of entry, the invoice, cancellation and refund correspondence, and any matter arising under clause 10 or clause 19 of the Terms are sent to the Responsible Adult.

6.4 Consent to the recording of a Home Division sitting is given by the Responsible Adult where the entrant is under 18, and cannot be given by the entrant.

6.5 A submission under clause 14 of the Terms by an author under 18 requires the consent of the Responsible Adult, including consent to the attribution elected under clause 9.5.

6.6 No marketing correspondence is sent to an entrant under 18. An opt-in under clause 4.9 is not accepted from a person under 18.

6.7 No profiling of an entrant is carried out. No behavioural advertising, tracking, recommender system or engagement-optimising technique is directed at an entrant, and none operates on the website.

6.8 On a school entry, the obligation to inform parents and students that the entry has been made rests with the school under clause 9.3(c) of the Terms.

6.9 A right under clause 14 may be exercised on behalf of an entrant under 18 by the Responsible Adult, or on a school entry through the coordinator.

6.10 No identity document is required or collected. The grade and date of birth given at registration are those declared by the registrant, who is responsible for their accuracy under clause 4.5 of the Terms.

7. Home Division recordings

7.1 Sittings in the Home Division are recorded. School Division sittings are not filmed, streamed or recorded by us, and no software is installed on school devices.

7.2 A recording is used solely to verify the integrity of the sitting. It is not published, used in marketing, disclosed to the entrant's school, or transferred to any third party, save where disclosure is required by law.

7.3 A recording is accessible only to us and to the invigilators appointed by us, and only for the purpose at clause 7.2. It is held in access-restricted storage with the provider at clause 10.3 that generates it.

7.4 Recordings are not subjected to facial recognition, biometric analysis, identity matching, emotion or attention scoring, gaze tracking, or any other automated analysis, and are not used to train any machine learning system. An invigilator observes the sitting; no software makes a judgement about an entrant.

7.5 The entrant should select a plain background and remove from view anything they do not wish an invigilator to see. The registrant is responsible for ensuring that other members of the household do not appear on camera during the sitting, or within audio range during the checks at clause 10.5 of the Terms.

7.6 Consent to recording may be withdrawn at any time before the sitting, on the terms at clause 10.12 of the Terms. Withdrawal after the sitting has taken place does not permit deletion of a recording forming part of an open investigation, which is retained under clause 12.5(a).

7.7 Recordings are deleted 30 days after publication of the results for that round.

8. Automated decision-making

8.1 Papers are marked against a fixed answer key and rankings are derived arithmetically from the marks. No inference is drawn about an entrant beyond the score obtained and the rank and tier that follow from it.

8.2 A determination of malpractice is made by a person. It is not made by automated statistical or pattern analysis of an entrant's responses, and no such analysis is carried out.

8.3 No decision producing a legal or similarly significant effect is taken about an entrant by automated means alone.

8.4 A score, and the rank and tier derived from it, may be reviewed by a person on request under clause 12.5 of the Terms.

9. Publication, attribution and anonymity

9.1 We may publish a ranking or list of results for a round, on the website and in materials issued to participating schools, under clause 15 of the Terms.

9.2 A published listing comprises candidate number, grade, division and score. It does not include an entrant's name unless consent has been given under clause 9.3.

9.3 A registrant may consent, at registration or at any time before publication, that the entrant's name be included in a published listing. Consent given under this clause is given under clause 15.2 of the Terms, may be withdrawn at any time before publication, and does not affect eligibility for any award, ranking or certificate.

9.4 Published material may be indexed, cached, copied or archived by search engines and other parties. We do not control such copies. Consent given or withdrawn under clause 9.3 takes effect only if given or withdrawn before publication.

9.5 Attribution of a submitted problem. Where a problem submitted under clause 14 of the Terms is published, the author elects one of the following, at submission:

(a) publication under the author's name;
(b) publication under a pseudonym chosen by the author; or
(c) publication without attribution.

The election may be varied by written notice at any time before publication. A pseudonym is treated as personal data and is subject to this policy, and must not identify a third party. Where (c) is elected, the author's identity is not published; it remains known to us and is retained under clause 12.5(c), including for the purpose of clause 13.1(d) of the Terms. Withdrawal of consent after publication operates prospectively: the material is removed from any listing we control at the next revision, and clause 9.4 applies to copies we do not control.

9.6 Aggregate statistics. We may publish anonymised aggregate statistics, including score distributions, question-level performance and participation by grade, region or curriculum. Aggregate statistics are produced so that no individual entrant is identifiable, and a figure is suppressed or combined where the number of entrants would permit identification. Once produced, they are not personal data and are not subject to clause 12. Consent under clause 9.3 does not extend to aggregate statistics.

9.7 An entrant's name, image or likeness is not used in advertising or promotional material without separate written consent, given by the Responsible Adult where the entrant is under 18 and by the entrant where the entrant is 18 or over. Clause 15.4 of the Terms applies.

10. Disclosure

10.1 We do not sell personal data. We do not disclose personal data for advertising, and do not share it with data brokers.

10.2 Personal data is disclosed to:

(a) the providers listed at clause 10.3, to the extent required to deliver the Challenge;
(b) the coordinator, in respect of a school entry, credentials, score reports and certificates being issued to that person under clause 9.6 of the Terms;
(c) the Responsible Adult, in respect of the correspondence specified at clause 5.4 of the Terms;
(d) the public, by publication under clause 9;
(e) the school, in respect of a finding of malpractice concerning a student entered by that school, under clause 19.3 of the Terms; and
(f) a court, regulator, public authority or professional adviser, where disclosure is required by law or is necessary for the establishment, exercise or defence of a legal claim.

10.3 The following providers process personal data in connection with the Challenge:

| Provider | Function | Data |

| --- | --- | --- |

| ClassMarker | Exam platform | 4.1, 4.4 |

| Zoom Communications | Home Division invigilation and recording | 4.5 |

| Zoho | Email correspondence and mailing list | 4.1, 4.2, 4.6, 4.9, 4.10 |

| Google (Google Fonts) | Delivery of the typefaces used by the website | 4.8 |

| Plausible Analytics | Measurement of website audience | 4.8 |

10.4 Each provider is engaged under its own terms and processes personal data on our instructions, save as stated at clause 3.3. The list at clause 10.3 is amended as providers change, and the amended list is published under clause 18.

10.5 The typefaces used by the website are loaded from the font provider named at clause 10.3, and the measurement script described at clause 15.6 is loaded from the analytics provider named at that clause. No other script, image or resource is loaded from a third-party content delivery network.

10.6 A disclosure under clause 10.2(e) is confined to the fact and substance of the finding. The recording of a sitting itself is not disclosed to a school, save as provided at clause 7.2.

10.7 Where the Challenge is transferred under clause 28.3 of the Terms, personal data is transferred with it, and notice is given.

11. International transfers

11.1 The providers at clause 10.3 operate internationally. Personal data is transferred to and processed in the countries stated at clause 11.3. Clause 11.4 applies to payment.

11.2 Transfers are made under the contractual terms of each provider, which incorporate standard data protection clauses or an equivalent transfer mechanism where one is required.

11.3 The following particulars are given in respect of each transfer:

| --- | --- | --- | --- | --- |

Each transfer is made over an encrypted connection, at the time the data is submitted, generated or sent. The corporate name and contact address of each recipient are stated in that recipient's own privacy documentation and are available from us on request.

11.4 Payment is made by bank transfer initiated by the registrant through their own bank. The particulars of that transfer are generated by the banks handling it and are not transferred to them by us. No payment page operated by a third party is presently used. Where card payment is introduced under clause 6.3 of the Terms, the details entered on the provider's page will be given by the registrant directly to that provider, which will process them as an independent controller under its own privacy policy; they will not be transferred to it by us, and we will receive from it only the record described at clause 4.3.

11.5 A transfer at clause 11.3 is made because it is necessary for the conclusion or performance of the contract with the registrant, save in respect of the mailing list, for which the transfer rests on the consent given at opt-in. A person who does not wish their personal data to be transferred may decline to register; the Challenge cannot be delivered without the transfers stated. Refusal has no other consequence.

11.6 Where the law applicable to a person requires separate consent to a transfer for a purpose not within clause 11.5, that consent is obtained separately and may be withdrawn under clause 14.

11.7 A provider is required not to transfer personal data onward except as necessary to perform its function, and on terms no less protective than those at clause 11.2.

12. Retention and deletion

12.1 We do not maintain a permanent register of entrants, results, rankings or certificates. Information relating to a round is deleted on the timetable in this clause. The exceptions at clauses 12.5 to 12.9 are exhaustive.

12.2 All information relating to a round, including entrant names, dates of birth, grades, schools, contact addresses, answers, scores, rankings and certificates, is deleted within 60 days of publication of the results for that round.

12.3 Recordings of Home Division sittings are deleted 30 days after publication of the results for that round.

12.4 Correspondence is deleted on the timetable at clause 12.2, save where it concerns a matter within clause 12.5(a) of this policy, a query under clause 12.5 of the Terms, a challenge under clause 12.6 of the Terms, or a complaint under clause 26 of the Terms, in which case clause 12.6 applies.

12.5 Operational exceptions. Clauses 12.2, 12.3 and 12.4 do not apply to:

(a) information forming part of an open investigation under clause 19 of the Terms, which is retained until that investigation and any representations under clause 19.2 of the Terms are concluded, and is then deleted, save as provided at limb (d);
(b) material published under clause 9, which may remain publicly available;
(c) a problem submitted under clause 14 of the Terms, the author's name, any pseudonym elected under clause 9.5, and the author's contact address, retained for so long as the problem may be used;
(d) a record of a person excluded under clause 6.8, 8.7 or 19 of the Terms, and of any award withheld, withdrawn or reclaimed under clause 13.4 of the Terms, limited to the details necessary to give effect to the exclusion or the withdrawal, and retained for so long as it has effect;
(e) the email address of a person who has opted in to marketing, retained until that person unsubscribes, and thereafter a record of the unsubscription sufficient to ensure that no further marketing correspondence is sent to that address; and
(f) the data at clause 4.10, retained for so long as the school is a prospective or actual participant, and thereafter a record sufficient to ensure that no further approach is made to a person who has asked not to be approached.

12.6 Records required by law. Where the law applicable to us requires a record of a transaction to be kept for a stated period, that record is kept for that period and for no other purpose. The periods are five years for records of a contract and of payment, three years for records of a complaint, and six months for records of advertising. A record retained under this clause comprises the registrant's name and contact address, the entry reference, the sum, the currency and the date, and, where applicable, the substance of the complaint. It does not include an entrant's answers, score, ranking, certificate or recording. It is held separately from operational records, is used only to comply with that law, and is deleted at the end of the period.

12.7 Records required to be kept under applicable tax or accounting law are retained for the period that law requires and for no other purpose.

12.8 Where a claim has been made or is reasonably in prospect, the data relevant to it is retained until the claim is concluded or the applicable limitation period expires, and is then deleted.

12.9 Aggregate statistics produced under clause 9.6 are not personal data and are not subject to this clause.

12.10 Method. Deletion is effected by erasure of the record from the systems on which it is held. Copies held in routine backups are overwritten in the ordinary backup cycle. Personal data is held electronically only.

12.11 Data held by a provider at clause 10.3 is deleted from that provider's systems on the same timetable, subject to the retention period stated in that provider's own terms.

12.12 Where the Challenge is discontinued under clause 25 of the Terms, personal data is deleted on the timetable at clauses 12.2 and 12.3, save as provided at clauses 12.5 to 12.8 and save where the Challenge is transferred under clause 10.7.

13. Security

13.1 Access to personal data is confined to us and to persons engaged to deliver a particular round, and only to the extent their function requires.

13.2 Accounts holding personal data are protected by unique passwords and, where the provider supports it, two-factor authentication. Recordings are held in access-restricted storage. Devices on which personal data is held are encrypted. Data in transit is transmitted over encrypted connections.

13.3 Persons engaged to deliver a round, including invigilators, are bound to confidentiality and are instructed not to retain personal data after the round. Question setters do not receive the personal data of entrants.

13.4 Where a breach of personal data occurs which is likely to result in a risk to the persons affected, we shall notify them and the relevant supervisory authority without undue delay and in any event within the period required by applicable law. A record of each breach, its cause, its effect and the action taken is kept for the period the applicable law requires.

14. Your rights

14.1 Subject to the law applicable to the person making the request, that person may:

(a) request confirmation of whether we hold their personal data and a copy of it;
(b) request correction of inaccurate or incomplete data;
(c) request deletion of their data;
(d) request that processing be restricted;
(e) object to processing carried out on the basis of our legitimate interests;
(f) request their data in a portable form;
(g) withdraw a consent previously given, including consent to recording, consent to attribution under clause 9.5 and consent to marketing;
(h) give or withdraw consent under clause 9.3, at any time before publication; and
(i) request that a decision be reviewed by a person, under clause 8.4.

14.2 Requests are made to hello@prismmaths.org. We may require sufficient information to verify that the request is made by the person to whom the data relates or by a person entitled to act on their behalf. Information supplied for verification is used for no other purpose and is deleted once the request is concluded.

14.3 A request is answered within 10 days. Where a request is complex or numerous, the period may be extended once by a further 10 days, and where it is extended the ground is stated.

14.4 A request concerning a school entry is answered by us in respect of the data we hold, we being the controller of that data under clause 3.2. Data held by the school in its own records is a matter for the school. We may notify the school that a request has been made.

14.5 A request for deletion made before the results of a round are published, if given effect, ends the entry. No refund arises except as provided at clause 7 of the Terms.

14.6 A right may be refused, in whole or in part, where the law permits refusal, including where compliance would disclose the personal data of another entrant or would prevent compliance with a retention obligation at clause 12.6 or 12.7. Reasons are given.

14.7 No person is treated less favourably for exercising a right under this clause, and no charge is made for a request.

15. The website and cookies

15.1 The website sets no cookies, uses no local or session storage, and carries no advertising, profiling or cross-site tracking technology. It loads its typefaces from the font provider named at clause 10.3; clause 15.4 applies to that request. It measures its audience by the means described at clause 15.6, and by no other means.

15.2 The website is served by a third-party hosting provider, which generates the server logs described at clause 4.8 for the purposes of delivery and security. Those logs are retained for the period stated in that provider's own terms.

15.3 Registration forms, enquiry forms, the exam platform and the video platform are supplied by the providers at clause 10.3 and operate under their own terms, which may include the setting of cookies necessary to their operation. Such a service is reached by following a link or by an instruction issued to the entrant; none is embedded in a page of the website.

15.4 Loading a page of the website causes the browser to request typefaces from the font provider named at clause 10.3. That request discloses to the provider the IP address, timestamp and browser identification of the visitor, and is made whether or not the visitor registers. The provider sets no cookie in the course of it. The transfer rests on our legitimate interest in serving the website in its intended typography, and clause 19.2 applies to it.

15.5 The website links to sites we do not control. Those sites process personal data under their own policies.

15.6 Audience measurement. Loading a page of the website causes the browser to request a measurement script from the analytics provider named at clause 10.3, and to send that provider a record of the page visited. That record comprises the page requested, the referring page, and the country, browser, operating system and device type derived from the request. The provider sets no cookie, stores nothing on the visitor's device, assigns no persistent identifier, and does not retain an IP address in retrievable form. No visitor is identified, and no visitor is followed between sites or between visits. The processing rests on our legitimate interest in knowing which pages of the website are used, and clause 19.2 applies to it.

16. Marketing and outreach

16.1 Marketing correspondence is sent only to a person who has opted in, and carries an unsubscribe facility in every message. An unsubscription takes effect without delay.

16.2 No marketing correspondence is sent to an entrant under 18, and no opt-in is accepted from a person under 18.

16.3 Correspondence concerning an entry already made — confirmation, credentials, results, and matters arising under the Terms — is not marketing and is sent whether or not a person has opted in.

16.4 Outreach to schools. We may approach a school, through a member of its staff at that person's institutional address, to describe the Challenge and invite the school to participate. Such correspondence identifies us, states how the address was obtained, and states how to decline further approach. A person who declines is not approached again, and clause 12.5(f) applies.

16.5 No personal data is disclosed to any person for that person's own marketing purposes.

17. Complaints

17.1 A complaint concerning the handling of personal data is to be sent to hello@prismmaths.org. It is considered as soon as reasonably practicable.

17.2 A person may also complain to the data protection authority of the territory in which they reside, where that authority has jurisdiction. Clause 19 names the authority for certain territories.

18. Changes to this policy

18.1 This policy is versioned and dated. The version in force is published on the website.

18.2 A material change is notified by email to the registrant of every entry accepted for a round not yet sat.

18.3 A change does not apply retrospectively so as to permit a use of personal data already collected which is incompatible with the purpose for which it was collected.

19. Territory-specific provisions

19.1 This policy applies to every registrant and entrant. This clause states matters required by the law of a particular territory and applies in addition to clauses 1 to 18. Where a provision of this clause conflicts with clauses 1 to 18, this clause prevails in respect of a person to whom it applies. A reference in this clause to the law of a territory is a reference to that law as it applies to our processing; where it does not apply, the provision has no effect.

19.2 European Economic Area and United Kingdom. A person may address a request under clause 14 to us. A person may complain to the supervisory authority of the Member State in which they reside or, in the United Kingdom, to the Information Commissioner's Office (ico.org.uk). Where processing rests on our legitimate interests, an assessment balancing those interests against the rights of the persons affected has been carried out and is available on request.

19.3 Hong Kong. The Personal Data (Privacy) Ordinance applies. A request for access to or correction of personal data is made under clause 14. A complaint may be made to the Office of the Privacy Commissioner for Personal Data (pcpd.org.hk).

19.4 India. The Digital Personal Data Protection Act 2023 and the rules made under it apply, on the phased timetable those rules prescribe.

(a) An entrant under 18 is a child for the purposes of that Act. Consent is given by the Responsible Adult, whose identity and status are declared and confirmed at registration under clause 5.3 of the Terms.
(b) No tracking, monitoring, profiling or behavioural advertising is directed at an entrant. Clause 6.7 applies.
(c) Clause 5.4 applies, that Act not recognising legitimate interest as a general basis for processing.
(d) The person named at clause 20 answers questions concerning the processing of personal data, and a grievance is answered within the period at clause 14.3.
(e) A complaint may be made to the Data Protection Board of India.

19.5 Malaysia. The Personal Data Protection Act 2010 applies. A version of this policy in Bahasa Malaysia is published on the website; the English text governs. Our processing does not meet the thresholds at which appointment of a data protection officer is required, and the person named at clause 20 serves as the point of contact. A complaint may be made to the Personal Data Protection Commissioner (pdp.gov.my).

19.6 Republic of Korea. The Personal Information Protection Act applies. A request under clause 14 is answered within the period at that clause. A person who considers their rights infringed may apply to the Personal Information Protection Commission (pipc.go.kr), the Personal Information Dispute Mediation Committee (kopico.go.kr), the privacy infringement report centre operated by the Korea Internet & Security Agency (privacy.kisa.or.kr, telephone 118), or the cybercrime reporting service of the National Police Agency (ecrm.police.go.kr).

19.7 Singapore. The Personal Data Protection Act 2012 applies. The person named at clause 20 is designated as the individual responsible for ensuring compliance with that Act, and clause 20 states their business contact information. A complaint may be made to the Personal Data Protection Commission (pdpc.gov.sg).

19.8 United States. An entrant under 13 may be entered only by their school, the school obtaining any consent required of a parent. We do not sell personal information, and do not share it for cross-context behavioural advertising, as those expressions are used in the law of California. We do not process personal information for targeted advertising or profiling in furtherance of a decision producing a legal or similarly significant effect.

19.9 Where a person is subject to the law of a territory not named in this clause, clauses 1 to 18 apply, together with any mandatory provision of that law.

20. Contact

Mina Lee, trading as Prism Maths Challenge

hello@prismmaths.org

schools@prismmaths.org

Mina Lee is the person responsible for the protection of personal data and for the handling of requests and complaints concerning it, and receives requests for access under clause 14.

Version 1.0. Published 16 August 2026.