Privacy Policy

Last updated: 29 August 2026

This policy explains what personal data Lompla Ltd collects and processes through ExamDisplay (www.examdisplay.com), why we process it, and the rights you have over it. We have tried to write it in plain language, because we expect it to be read by school staff and data protection officers, not only lawyers.

Who we are

ExamDisplay is operated by Lompla Ltd, a company registered in England and Wales (company number 14087508; registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom). For any privacy matter, contact us at contact@lompla.com.

The two roles we play

Data protection law distinguishes between a controller (who decides why and how personal data is processed) and a processor (who processes it on someone else’s instructions). We act in both roles, for different data:

As a controller, for data about website visitors, school staff accounts, billing contacts, and people who contact us. This policy governs that processing.
As a processor, for student and candidate data that schools upload to run their examinations. The school remains the controller of that data, and our Data Processing Agreement governs it. We only process it on the school’s instructions and never use it for our own purposes, marketing, or advertising.

Data we collect as a controller

Staff accounts

When a member of school staff creates an account we collect a name, work email address, role, and school affiliation. We use this to provide the service, secure accounts (including multi-factor authentication), and communicate about the service. Legal basis: performance of a contract.

Billing

Payments are handled by Paddle, who act as merchant of record: Paddle is the seller for payment purposes and processes payment card details under its own privacy policy. We receive and retain subscription status, plan, and invoicing details, never card numbers. Legal basis: performance of a contract and legal obligation (accounting records).

Support and contact

If you contact us by email or through one of our forms, we process your name, email address, and the content of your message to respond. A form submission is checked for automated abuse by Cloudflare Turnstile and sent to us as one email through Resend; it is not stored in any other system. Legal basis: legitimate interest in answering enquiries.

Server logs

Our hosting provider (Cloudflare) and backend platform (Supabase) generate standard server logs, including IP addresses, for security and reliability. The application does not use third-party client-side error monitoring or session replay. Application errors remain in the browser console unless a user chooses to include diagnostic information in a support request. Legal basis for server logs: legitimate interest in keeping the service secure and working.

What we do not do

We do not run third-party advertising or sell personal data.
We do not use third-party marketing analytics or tracking cookies on this site.
We do not send marketing to student or candidate email addresses (we never collect any).

Candidate data we process for schools

Depending on the plan and features a school uses, schools may enter candidate data to run their exam operations. By default, this data stays on the school’s device; it reaches us only when a school has completed the assisted hosted-data setup. Categories can include: candidate names and exam board candidate numbers, dates of birth, class and subject enrolments, exam schedules and seating allocations, examination results, and access arrangements (for example extra time or rest breaks). Access arrangement data can reveal information about disability or health, which is special category data. We apply additional safeguards to it, described on our Security page.

For all of this data the school is the controller and we are a processor under our Data Processing Agreement. If you are a student, parent, or guardian and want to exercise data protection rights over this data, please contact your school; we assist schools with such requests.

Accountless teacher requests

A school can publish a shared form so teachers can request assessment slots without creating accounts. On the school's instructions, we process the teacher's name, work email address, selected class label, assessment title, optional class-level notes, and ranked scheduling choices. The form does not receive candidate names or numbers, enrolments, student counts, workload results, or access-arrangement data. The school is the controller and we act as its processor under the Data Processing Agreement.

What actually reaches our servers

Candidate-linked data stays on school-managed devices by default. The shared school workspace — including saved displays, rooms, layouts, cycles, sessions, scheduled exams, member accounts, and settings — still syncs securely. Candidate-linked data reaches our servers only after a school contacts us and completes an informed hosted-data setup:

Display plan: no candidate data is collected or stored on our servers. The display features work without any student personal data.
Hosted candidate data (assisted setup): candidate data uploaded by the school is stored in our EU-hosted database, protected as described on our Security page.
On-device candidate data (the default on every plan): candidate data never leaves the school’s own devices. It is stored in the browser on school-managed hardware, and our servers refuse it at the database level. This is enforced and tested, not just promised.

Who we share data with

We use a small number of service providers (sub-processors) to run ExamDisplay, each bound by a data processing agreement. The current list, including what each provider does and where it processes data, is maintained on our Sub-processors page. We may also disclose personal data where required by law, to protect our legal rights, or as part of a sale or restructuring of our business (in which case this policy would continue to apply to the transferred data).

International transfers

Our application database is hosted in the European Union (Ireland) and our error monitoring in the European Union (Germany). Where a provider processes limited data outside the UK/EEA (for example our contact form provider), the transfer is protected by an adequacy decision or by the applicable standard contractual clauses (EU SCCs and/or the UK IDTA/Addendum). Details per provider are on the Sub-processors page.

How long we keep data

Account data: for as long as the account exists. When an account or school is deleted, associated personal data is deleted within 30 days, except records we must keep for legal or accounting reasons.
Hosted candidate data: retained under the school’s instructions and deleted or returned in line with the Data Processing Agreement when the school’s subscription ends.
On-device candidate data (default): stored on the school’s devices; retention is entirely under the school’s control.
Accountless teacher requests for on-device schools: class-level request contents are erased from the private transfer mailbox as soon as an authorised coordinator imports them, and automatically after 30 days if they are not imported.
Support correspondence: kept as long as needed to handle the enquiry and for a reasonable period afterwards.
Error and log data: kept on short rolling retention windows set by the relevant provider.

Your rights

Under UK and EU data protection law you have the right to access, correct, delete, and receive a copy of your personal data, to restrict or object to our processing of it, and to withdraw consent where processing is based on consent. Signed-in users can exercise most of these rights directly from the in-app Account → Data rights page; otherwise, email us at contact@lompla.com and we will respond within one month. We will never discriminate against you for exercising your rights.

You also have the right to complain to a supervisory authority. In the UK this is the Information Commissioner’s Office (ico.org.uk); in the EU it is your national data protection authority.

Children

We do not collect information directly from children. Our website, marketing, and accounts are directed at school staff, and we do not knowingly create accounts for anyone under 18.

Where a school uses the hosted candidate-data option described above, we may store data about students who are minors, supplied to us by the school rather than collected from the student directly. As with all candidate data, we process it only as a processor on the school’s instructions, and never use it for marketing or profiling. Parents or guardians with questions about this data should contact their school in the first instance; we assist schools in responding to such requests.

Cookies

We only use cookies and similar browser storage that are necessary to run the service. We use no advertising or third-party analytics cookies. See our Cookie Policy for the details.

Changes to this policy

If we change this policy we will post the new version here and update the date at the top. For significant changes affecting registered users we will notify schools by email before the change takes effect.