This Privacy Policy explains how IBretake ("IBretake", "we", "us", or "our"), collects, uses, shares, and protects personal data when you use ibretake.com and any related services, dashboards, forms, or communications (the "Platform").

IBretake operates an online platform that lets students submit paid IB retake search requests and lets eligible school coordinators review those requests. This Privacy Policy applies to students, parents or guardians, school representatives, and other users of the Platform.

If you have any questions about this Privacy Policy or about how we process personal data, you can contact us at:

1. Who controls your personal data

For the purposes of the General Data Protection Regulation ("GDPR"), the UK GDPR where applicable, and other applicable data protection laws, the data controller of personal data processed through the Platform is:

At this stage, IBretake has not appointed a Data Protection Officer unless and until this becomes legally required.

2. Whose data we collect

We may collect personal data relating to:

• Students seeking exam retake hosting or registration support.
• Parents or legal guardians acting on behalf of students.
• School representatives, including DP coordinators and administrative staff.
• Visitors to the Platform.
• People who contact us by email, form, or other communication channel.

3. What personal data we collect

3.1 Data we collect from Students or their parents/guardians

We may collect:

• Full name.
• Date of birth.
• Nationality.
• Email address.
• Telephone number.
• Country of residence.
• Previous IB session details.
• IBO candidate number or similar candidate identifier, where required.
• Subjects to be retaken.
• Preferred exam session, selected countries, candidate location, and radius filter.
• Search location details, including city, country, browser-provided location where enabled, and approximate latitude/longitude used to route the request to eligible coordinators.
• Passport or identity information where required for verification, school review, or placement.
• Communications with us or with schools through the Platform.
• Search request history, case number, placement status, refund status, and dashboard updates.
• Signed placement agreement status, agreement download/upload metadata, admin approval status, coordinator handoff status, and final success-screen status.
• Information needed to release final placement details by email after admin approval, including the accepting coordinator's contact details, School location, signed agreement link, selected subjects, session, case number, and accepted price.
• Billing details, invoicing information, and transaction metadata.
• IP address.
• Browser type, operating system, device identifiers, and usage data.
• Cookie and analytics data, subject to applicable consent requirements.

3.2 Data we collect from Schools and school representatives

We may collect:

• School name.
• School address and country.
• IBO school code.
• Name, role, and contact details of the DP Coordinator or other representative.
• School fee information, subject availability, deadlines, and listing content.
• Signed placement agreement files, signer name, capacity confirmation, accepted price, document upload metadata, and admin review outcome.
• Bank account or payout details for remittance.
• Company or registration details where required for legal or compliance purposes.
• Communications with us through the Platform or by email.

3.3 Payment data

Payments are processed by third-party payment service providers such as Stripe. IBretake does not store full card numbers or full payment card details on its own servers. We may receive limited payment-related information such as payment status, payment method type, transaction ID, country, amount, and chargeback or refund status.

4. How we collect personal data

We collect personal data:

• Directly from you when you create an account, fill in a form, submit a retake search request, make a payment, request a refund, or contact us.
• From schools when they provide or update coordinator, subject availability, request review, acceptance, or placement information.
• From parents or guardians acting on behalf of students.
• Automatically through cookies, server logs, and analytics tools when you use the Platform.
• From payment providers, fraud-prevention tools, hosting providers, or other service providers involved in operating the Platform.

5. Legal bases for processing

We process personal data on one or more of the following legal bases:

• Contract performance, where processing is necessary to create accounts, process retake search requests, route requests to schools, manage payments and refunds, communicate with users, and otherwise provide the Platform and related services.
• Legitimate interests, where processing is necessary for fraud prevention, platform security, service improvement, internal administration, analytics, dispute handling, enforcement of our terms, and protection of our legal rights.
• Legal obligation, where processing is necessary to comply with tax, accounting, anti-fraud, consumer-protection, or other legal obligations.
• Consent, where required by law, including for non-essential cookies, certain analytics technologies, and marketing communications.
• Establishment, exercise, or defense of legal claims, where relevant.

Where we rely on legitimate interests, we consider and balance those interests against your rights and freedoms.

6. Why we use personal data

We may use personal data for the following purposes:

• To create and manage user accounts.
• To process and review retake search requests.
• To route requests to eligible coordinators in the selected countries, search zone, and radius.
• To communicate with schools in order to review, arrange, or confirm placement opportunities.
• To generate, make available, receive, store, and review signed placement agreement PDFs.
• To allow IBretake admin to approve or decline signed coordinator documents before final placement details are released.
• To send Students final coordinator information, School location, signed agreement links, and next steps by email after admin approval.
• To lock successful applications and prevent duplicate retake search requests for the same active application flow.
• To remember the location used for a paid retake search and route later search waves by distance from that saved location.
• To process payments, refunds, and receipts.
• To make optional tutoring, revision, or related service offers after a placement is accepted, including where IBretake may receive a commission or referral fee.
• To provide customer support.
• To verify identity, eligibility, request, or placement information where necessary.
• To maintain records of search requests, communications, placements, refunds, and transactions.
• To monitor and improve the performance, functionality, and security of the Platform.
• To prevent fraud, abuse, misuse, or unauthorized access.
• To comply with legal, tax, regulatory, and accounting obligations.
• To send service-related notifications, confirmations, reminders, and policy updates.
• To send marketing communications where you have consented or where otherwise permitted by law.

7. Who we share personal data with

We may share personal data with the following categories of recipients:

• Relevant Schools, to the extent necessary to assess, arrange, accept, or fulfill a retake search request.
• The accepting coordinator and School, after admin approval, so they can communicate with the Student about official registration, exam-day instructions, required documents, cancellation questions, and school-specific logistics.
• Payment service providers, including Stripe or similar providers, for payment processing, fraud prevention, refunds, and chargeback management.
• Tutoring or educational-service partners, but only where needed to provide an optional service requested by the Student or where lawful consent or another valid legal basis applies.
• Hosting, infrastructure, email, storage, form, or customer-support providers that help us operate the Platform.
• Analytics and cookie providers, where enabled in accordance with applicable consent rules.
• Professional advisers, including lawyers, accountants, auditors, and insurers.
• Courts, regulators, supervisory authorities, law enforcement bodies, or other public authorities where required by law or necessary to protect rights and safety.
• Potential buyers, investors, or corporate counterparties in connection with a merger, financing, acquisition, or sale of business, subject to appropriate confidentiality safeguards.

We do not sell personal data to third parties.

8. Sharing with Schools

When a Student submits a Retake Search Request or otherwise seeks placement through the Platform, IBretake shares the minimum personal data reasonably necessary with one or more eligible Schools and coordinators so they can assess availability, eligibility, registration feasibility, pricing, deadlines, and placement logistics. This may include:

• Name.
• Contact details.
• Nationality or country of residence where relevant.
• Requested exam session.
• Subjects to be retaken.
• Requested levels and related subject details.
• Selected countries, radius, and candidate location information needed to assess the request.
• Previous exam session, candidate identifiers, or candidate information where necessary.
• Messages, request status, agreement status, case number, accepted price, and payment or refund status where necessary for the placement workflow.
• Any other information reasonably required to assess eligibility or feasibility of placement.
• Signed agreement details, admin approval status, and final handoff information where necessary to confirm or complete the placement workflow.

Schools are independently responsible for their own handling of personal data once that data is shared with them in connection with a retake search, request review, acceptance, or placement process.

By submitting a Retake Search Request, the Student understands that this school-sharing step is necessary for the service to work.

After admin approval of a signed placement agreement, IBretake may send the Student the accepting coordinator's email address, School location, signed agreement link, selected subjects, session, case number, and accepted price. Communications that happen directly between the Student and the School after that handoff may be governed by the School's own privacy notices and record-keeping practices.

IBretake does not arrange travel, accommodation, visas, immigration, insurance, transport, exam cancellation requests, or other off-platform logistics. If a Student shares personal data about those matters with a School or coordinator after the handoff, that sharing is between the Student and the School unless IBretake is separately copied or asked to process it through the Platform.

9. International transfers

Because IBretake may work with schools and service providers in different countries, your personal data may be transferred outside the European Economic Area or the United Kingdom.

Where personal data is transferred outside the EEA or UK, we will seek to ensure that an appropriate safeguard applies, such as:

• An adequacy decision.
• Standard Contractual Clauses or the UK equivalent.
• Another lawful transfer mechanism recognized under applicable data protection law.

Where a Student requests placement with a School outside the EEA or UK, certain data may also be transferred internationally because the transfer is necessary to take steps at the request of the data subject prior to entering into, or for the performance of, the relevant service arrangement.

You acknowledge that schools located outside your country may receive and process your personal data where this is necessary to arrange or fulfill the requested service.

10. Cookies and similar technologies

We use cookies and similar technologies on the Platform.

10.1 Strictly necessary cookies

Some cookies are necessary for the operation of the Platform, including cookies used for login sessions, security, fraud prevention, load balancing, and payment functionality. These cookies may be used without consent where permitted by law.

10.2 Analytics cookies

We may use analytics tools, such as Google Analytics or an equivalent provider, to understand how users interact with the Platform and to improve performance and usability. Where required by law, these analytics cookies will only be used after you provide valid consent.

10.3 Marketing cookies

If we use marketing or retargeting cookies, they will be deployed only where required consent has been obtained.

10.4 Managing cookies

You can manage cookies through our cookie banner, cookie settings tool, or your browser settings. Blocking some cookies may affect the functionality of the Platform.

A separate Cookie Policy may supplement this section.

11. Data retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, including for legal, tax, accounting, fraud-prevention, and dispute-resolution purposes.

As a general rule:

• Active account data is retained while the account remains active and for a reasonable period thereafter.
• Search request, placement, refund, and transaction records may be retained for up to 5 years, or longer where required by applicable law or necessary for legal claims.
• Payment-related records and invoices may be retained for up to 5 years, or longer where required by applicable accounting or tax law.
• Inactive accounts may be deleted or anonymized after 2 years of inactivity, unless retention is required for legal, compliance, or dispute-related reasons.
• Marketing data is retained until consent is withdrawn or the user objects, subject to limited suppression-list retention to respect opt-out requests.
• Technical logs, security records, and analytics data are retained for periods appropriate to their purpose.

In some cases, we may anonymize data so that it can no longer be associated with an identifiable person, in which case we may retain it for statistical or analytical purposes.

12. Your rights

Subject to applicable law, you may have the following rights:

• Right of access: to obtain confirmation as to whether we process your personal data and to receive a copy of that data.
• Right to rectification: to request correction of inaccurate or incomplete personal data.
• Right to erasure: to request deletion of personal data where there is no valid legal reason for us to continue processing it.
• Right to restriction: to request that we temporarily restrict processing in certain circumstances.
• Right to data portability: to receive certain personal data in a structured, commonly used, machine-readable format and, where feasible, to have it transmitted to another controller.
• Right to object: to object to processing based on legitimate interests and to object at any time to direct marketing.
• Right to withdraw consent: where processing is based on consent, to withdraw that consent at any time without affecting the lawfulness of earlier processing.
• Right to lodge a complaint: to complain to a supervisory authority.

To exercise any of these rights, contact us at [email protected]. We may ask for information necessary to verify your identity before responding. We aim to respond within one month of receiving a valid request, although this period may be extended where permitted by law.

13. Marketing communications

We may send service-related communications where necessary for account management, search requests, placements, payments, refunds, support, or legal notices.

We will only send marketing communications by email or similar electronic means where permitted by law and, where required, where you have provided consent. You can unsubscribe from marketing communications at any time by using the unsubscribe link or contacting us at [email protected].

14. Data security

We take appropriate technical and organizational measures designed to protect personal data against unauthorized access, disclosure, alteration, loss, or destruction.

These measures may include:

• HTTPS/SSL encryption.
• Access controls and role-based permissions.
• Secure hosting and infrastructure practices.
• Monitoring, logging, and security review procedures.
• Contractual safeguards with service providers.
• Minimization of access to personal data to authorized personnel only.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If we become aware of a personal data breach, we will act in accordance with applicable law, including notifying the relevant supervisory authority and affected individuals where legally required.

15. Children's data

The Platform is not directed to children under the age of 13.

Students under 18 may use the Platform only with the involvement and authorization of a parent or legal guardian where required by law or by our terms. If we learn that we have collected personal data from a child under 13 without appropriate authorization where required, we will take steps to delete that data as soon as reasonably practicable.

Parents or guardians who believe that a child has provided personal data to us without proper authorization may contact us at [email protected].

16. UK users

Where the UK GDPR or UK data protection law applies, references in this Privacy Policy to GDPR rights and protections should be read accordingly.

UK users may exercise the same or substantially similar rights described above, subject to applicable UK law.

17. Complaints and supervisory authorities

If you have a concern about how we handle your personal data, we encourage you to contact us first at [email protected] so that we can try to resolve it.

You also have the right to lodge a complaint with a competent supervisory authority. In Poland, the supervisory authority is:

If you are located in another EU or EEA country, you may also have the right to complain to your local data protection authority.

If UK law applies to your data, you may also have the right to complain to the UK Information Commissioner's Office (ICO).

18. Third-party links

The Platform may contain links to third-party websites, including school websites, payment providers, or other external services. We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy notices separately.

After a successful placement, Students and Schools may communicate by email or other channels outside the Platform. IBretake is not responsible for the privacy or security of those off-platform communications unless they are sent to IBretake or otherwise processed by us.

19. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect legal, technical, operational, or business developments.

If we make a material change, we may notify users through the Platform, by email, or by another reasonable method. The "Last updated" date at the top of this Privacy Policy indicates when it was most recently revised.

20. Contact us

If you have any questions about this Privacy Policy or want to exercise your rights, contact: