Privacy Policy

Zamit ("Zamit", "we", "us") provides AI-enabled, adaptive assessment and reporting services — including ZQ (the Zamit Quotient), GETS English and Zamit Jobs — to school students, higher education students and job seekers.

For most services Zamit acts as the controller (UK GDPR) and as a Data Fiduciary (India's Digital Personal Data Protection Act, 2023, "DPDP Act") of your personal data. Where a school, university, employer or partner institution commissions assessments and decides how results are used, we act as a processor / Data Processor on that organisation's instructions, and their own privacy notice applies alongside this one.

Privacy questions, requests and complaints: hello@zamit.one. The same address reaches our Data Protection contact (UK) and our Grievance Officer (India).

• Account and identity data — name, email address, phone number, password credentials, school / institution or employer, class or year of study, country and city.
• Assessment data — your responses to adaptive assessments, response timings, item-level scores, English language performance (GETS), skills and future-readiness measures, and personality-type indicators used to build your profile.
• Profile and report data — your MyZQ Report, GETS Report, job-readiness profile, career-domain and subject-stream recommendations, and recommended certifications.
• Jobs data — CV / résumé, education and work history, certifications, job preferences, salary expectations, work-authorisation and mobility preferences, and applications or matches you generate.
• Technical and usage data — device and browser information, IP address, approximate location derived from it, pages viewed and actions taken.
• Communications — messages you send us and records of support interactions.

We do not ask for special category data (UK GDPR Article 9) such as health, religion, caste or biometric data, and you should not submit it. Payment card details are handled by our payment providers, not stored by us.

• Delivering assessments, reports and job matching — performance of a contract with you, or performance of our contract with your school, institution or employer. Under the DPDP Act we rely on your consent, or on the legitimate use of providing a service you have voluntarily requested.
• Generating AI-enabled profiles and recommendations — contract performance and, where required, your consent.
• Sharing results with a school, institution or prospective employer — the instructions of that organisation where it commissioned the assessment, or your consent where you choose to share or apply.
• Service security, fraud and assessment-integrity checks — legitimate interests in keeping assessments valid and accounts secure.
• Product improvement and research — legitimate interests, using aggregated or de-identified data wherever possible.
• Marketing emails — your consent, withdrawable at any time via the unsubscribe link.
• Legal and regulatory compliance — compliance with a legal obligation.

Our assessments are adaptive: the questions you see are selected by algorithms based on your previous answers. We then use automated processing to score you, to build a profile across English, skills, personality type and readiness, and to rank subject streams, career domains and job matches.

These outputs are advisory. They are designed to inform your choices, and those of your school or an employer — not to make a final decision about you on their own. Where an employer or institution uses Zamit outputs in selection, they are responsible for applying human review to their decisions.

You can ask us to explain the factors behind a report, ask for a human review of a result you believe is wrong, and contest an outcome by writing to hello@zamit.one. We do not use your assessment responses to advertise to you.

Our school offering serves students in classes 9 to 12, who are often minors. Both the UK regime (including the ICO's Age Appropriate Design Code) and the DPDP Act give children additional protection, and the DPDP Act treats anyone under 18 as a child.

• Where a school or institution enrols students, we require that school to obtain and record verifiable parental consent, and to confirm it has authority to provide the student data it shares with us.
• Where a parent or guardian registers a child directly, we obtain verifiable parental consent before processing and before releasing reports.
• We do not carry out behavioural advertising, tracking-based advertising or targeted advertising directed at children, and we do not process children's data in ways likely to cause them detrimental effects.
• A parent, guardian or the school may access, correct or request deletion of a child's data, and may withdraw consent, by contacting us.

• Your school, institution or sponsoring organisation, where it commissioned your assessment.
• Employers and recruiters, only for roles you apply to or matches you agree to be shared.
• Assessment and certification partners that underpin our standards and certificates, such as the GETS, CIFR and QAI frameworks.
• Service providers acting under contract — cloud hosting, database and storage, email delivery, analytics, AI model providers used to generate reports, and payment processing. They may use your data only to provide the service to us.
• Professional advisers, authorities and successors, where required by law or in connection with a corporate transaction.

We do not sell your personal data.

Zamit operates between the United Kingdom and India, and uses service providers that may process data in the UK, the European Economic Area, India and the United States.

For transfers out of the UK we rely on UK adequacy regulations where they apply, or on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment. For data originating in India, transfers are made to countries not restricted by the Central Government under section 16 of the DPDP Act, and remain subject to the same contractual safeguards. You can request details of the safeguards used for a specific transfer.

• Account data — while your account is active, then up to 12 months after closure.
• Assessment responses and reports — up to 3 years from the assessment date, so results stay verifiable and progress can be compared, unless your school's contract sets a shorter period.
• Certification records — retained longer where needed to verify a certificate's authenticity.
• Jobs profiles and applications — while your profile is active, then up to 12 months after your last activity.
• Billing records — as required by tax and accounting law.

When a retention period ends, or when the purpose of processing is met and no legal obligation requires retention, we delete the data or irreversibly de-identify it.

We apply reasonable technical and organisational safeguards, including encryption in transit, access controls limited to staff who need the data, logical separation of client data, logging, backups and vendor due diligence. If a personal data breach occurs we will notify the UK Information Commissioner's Office within 72 hours where the law requires it, notify the Data Protection Board of India and affected individuals as required by the DPDP Act, and inform any school or employer acting as controller of the affected data.

Under UK GDPR and the Data Protection Act 2018 you may request access to your data, correction, erasure, restriction of processing or portability; object to processing based on legitimate interests; withdraw consent; and object to direct marketing.

Under India's DPDP Act you may request access to a summary of your data and processing, correction, completion, updating and erasure; nominate another person to exercise your rights if you die or become incapacitated; and use our grievance redressal process.

Write to hello@zamit.one. We respond within one month (UK) and within 30 days for grievances (India), and will tell you if we need longer. If we act as processor for your school or employer, we will forward your request to them.

You can complain to the UK Information Commissioner's Office at ico.org.uk, or, in India, to the Data Protection Board after using our grievance process. We would like the chance to resolve it first.

We may update this policy as our services and the law evolve. Material changes will be notified by email or an in-product notice before they take effect, and the "last updated" date above always reflects the current version.