Last updated 23 October 2026
The short version. Ebor Labs holds very little information about anyone. This website sets no cookies and runs no analytics. If you email, that email is held in a mailbox.
Most of the personal data Ebor Labs touches belongs to its clients' candidates, and Ebor Labs handles it on their instructions rather than for its own purposes. If you sat an assessment, the organisation that trained you is the one to ask first.
Ebor Labs Ltd builds assessment, certification and data-readiness software. It is a company registered in England and Wales under number 17500836.
| Controller | Ebor Labs Ltd |
|---|---|
| Address | Unit 13, Freeland Park Wareham Road Lytchett Matravers Poole, Dorset BH16 6FA |
| Contact | hello@eborlabs.com |
| ICO registration | ZC274576 |
Data protection law distinguishes between deciding what happens to personal data and simply handling it for somebody else. Ebor Labs does both, in different contexts, and the distinction changes who you should contact.
If you email an enquiry, ask for a quote, or become a client contact, Ebor Labs is the controller of that information. In practice this is your name, your email address, your employer, and whatever you chose to write.
It is held because there is a legitimate interest in answering you and in keeping a record of business correspondence. It is not sold, not shared for marketing, and not used to profile anyone.
If you work for a training company, Ebor Labs may email you about Ebor Exam at a work address your company publishes or that you gave us. We keep your name, work email, company and a note of what was sent and said, because we have a legitimate interest in telling businesses about our service. We keep this for two years after we last contacted you. If you ask us to stop, we stop at once and remove your name and email address. We keep a one-way code made from your address, so that it is never emailed again, and for two years we also keep your company's name, the dates you replied or asked us to stop, and how many emails we sent you on the day you asked. You can object at any time using the link in any of our emails, or by writing to hello@eborlabs.com.
When a training provider or employer uses the assessment platform, they decide what is collected and why. They are the controller. Ebor Labs provides and maintains the platform on their instructions, which makes it a processor.
If you sat an assessment and want to see, correct or delete your record, contact the organisation that ran your training. They can do it directly. Ebor Labs will help them, but will not act on their data without them.
That extra-time point is deliberately narrow. Where a candidate is granted extra time, the platform records that it was authorised and by whom, with a short note. That note is not meant to hold a diagnosis or medical detail, and the platform refuses a note that looks like one.
If your training provider gives you a certificate of attendance, the platform also holds the certificate - your name, the course, the day and its reference, which anyone you show it to can check - and, if they give one, the email address they send it to. If your training provider switches it on, you are also emailed once when your certificate is due for renewal.
Photo and ID check. If your training provider asks for it, you take a photo of yourself and of your photo ID before you start. A trainer compares them by eye; no software matches faces. The photos are seen only by your training provider's trainers and are deleted after 30 days; the trainer's decision is kept with your result.
Observed assessments. If you are assessed by observation, the platform also holds an assessor's observations and comments, with your result.
The platform records the number of times the candidate switches away from the assessment tab. It records the count and nothing else — not the time of each, and no camera, microphone, screen contents, keystrokes, list of other applications, location or device fingerprinting. The count is kept alongside the candidate's result but held separately from it — which is what makes removing it after 12 months possible at all, since a submitted result cannot be altered. It is kept for 12 months and then removed, while the result itself is kept for as long as the employing organisation requires. It is shown to the trainers of that organisation, and to the candidate on their own result, never to another candidate; and it leaves the organisation that ran the assessment only inside the same record as the candidate's result — the training record their employer receives — and goes nowhere else. It is personal data under the UK GDPR, because it is attached to an identified candidate; it is not special category data. The platform takes no action on it by itself: no automatic flagging, voiding, labelling or score adjustment. Any decision is made by a named person and recorded as theirs.
Ebor Labs uses a small number of suppliers to run the platform. These are its sub-processors, and they are named here because a client's compliance team will reasonably want to know. Supabase, Netlify, Resend, Anthropic and Cloudflare are United States companies, and Microsoft's parent company is too. Records are stored in the United Kingdom, but their staff can reach the systems they sit on in order to support them, which counts as a transfer under UK data protection law. Each transfer relies on the supplier's certification under the UK Extension to the EU–US Data Privacy Framework or, where a supplier is not certified, on the UK's standard contract terms for international transfers.
| Supplier | What it does | Where |
|---|---|---|
| Supabase | Database — every candidate record | London, United Kingdom |
| Netlify | Hosting, and the servers that handle every request | London, United Kingdom; pages delivered worldwide |
| Resend | Certificates, invitations, verification codes, reminders | Sends from Ireland; a record of each email is kept in the United States |
| Microsoft 365 | Business mailbox | United Kingdom and European Union |
| Anthropic | The study assistant, question drafting and the help bot, only when used: the question typed, or the course notes a trainer chooses; never a name, email, answer key or result | United States |
Not sub-processors: Cloudflare (our domain name records; it holds no records), Stripe (takes our clients' payments, as a separate company), and Microsoft and Google when someone chooses to sign in with them.
Candidate records are stored in the United Kingdom, and the servers that process each request to the platform run in the United Kingdom as well. Emails are sent from Ireland, and our email provider keeps a record of each one in the United States. Where a candidate signs in with a Microsoft or Google account, that provider shares their name and email address with the platform and nothing further.
Trainers and administrators can sign in with a Google or Microsoft account instead of a password. The platform asks the provider only to confirm who you are, and receives your name and email address. It uses them to match you to your platform account or, if you have none, to record a request for access that Ebor Labs reviews. Candidates can confirm their email address the same way before an assessment; that confirmation is kept for one day and then removed. The platform never receives your password and cannot see your emails, files or contacts. Nothing received from Google or Microsoft is sold, shared or used for advertising, and Ebor Exam's use of information from Google follows the Google API Services User Data Policy, including its Limited Use requirements.
When you sign up by card, Ebor Labs keeps your name, work email and your organisation's name, to run your account and to contact you about it. The card itself is taken by Stripe, which processes the payment as a separate company under its own privacy policy (stripe.com/gb/privacy); Stripe also receives your email. We keep your details for as long as your organisation has an account, and for six years after for our accounts. Ask exam@eborlabs.com to see or correct them.
If your training provider switches on the study assistant, a question you type into it is sent to the service that writes the answer. Your name and your email address are not sent with it, and no record is kept of who asked what — only the question itself, so your trainer can see what the group found difficult. You never have to use it, and nothing you ask it affects your result. To keep the cost of the study assistant in check, we also keep the internet address a question came from, and how many questions it asked, for one day. This is not linked to the question.
A trainer can ask the AI to draft questions from course notes they choose, and can ask the help bot how to use the platform. The chosen notes, or the question typed, are sent to Anthropic to write the drafts or the answer. Nothing about a candidate is sent. Drafts are checked by a trainer and approved by a second trainer before they are used.
The data-readiness tools at einvoicecheck.eborlabs.com run entirely inside your own browser. Files you open there are never sent anywhere, are not uploaded, and are not visible to Ebor Labs. Closing the tab ends it. This is a property of how the tools are built, not a policy that could change quietly.
If you submit an enquiry form on that site, the details you type are sent to Ebor Labs. That is a separate act from using the tools.
Nothing on the platform is deleted without two people approving it, except in an organisation of one person that Ebor Labs has exempted, where a deletion waits 24 hours first. Every deletion is recorded.
This website sets no cookies, loads no tracking pixels, and runs no analytics. Nobody is counting your visit.
The assessment platform sets no cookies for tracking and runs no analytics. It keeps a few small items in your browser, each needed for something you are doing:
None of them is used to track anyone across other websites.
The fonts on this site and on the assessment platform are served from Ebor Labs' own sites, as are the tools the platform uses to make PDFs and QR codes. Loading a page does not contact Google or any other third party, and the platform tells your browser to refuse anything from elsewhere.
Under UK data protection law you may ask to see the personal data held about you, to have it corrected, to have it deleted where there is no legal reason to keep it, to restrict or object to how it is used, and to receive it in a portable form.
For anything Ebor Labs decides, write to hello@eborlabs.com and you will get an answer within one month. For anything on a client's platform, ask the organisation that trained you — they hold the decision.
If you are unhappy with the response, you can complain to the Information Commissioner's Office at ico.org.uk, or by telephone on 0303 123 1113. You are welcome to raise it here first, but you do not have to.
Many candidates are in the United Arab Emirates while the platform is run from the United Kingdom. Records are held in London, which means UK data protection law applies to how they are kept. Clients in the UAE remain subject to their own local requirements, and the written agreement between Ebor Labs and each client sets out who is responsible for what.
If this notice changes in a way that affects you, the date at the top changes with it. Clients are told directly rather than being expected to check.
