Privacy notice
For Questionnaire Respondents – Key Information
Q-BEx is an online questionnaire tool developed by the University of Leeds. It is used by professionals such as clinicians, researchers, and educators to gather information about children’s language experiences and development.
Why you have been sent this link A professional — such as your child’s teacher, therapist, or a researcher — has invited you to complete a Q-BEx questionnaire. They are responsible for how your information is used. This notice explains what happens to your data once you submit it.
What information is collected The questionnaire collects your responses. Some questions may be personalised using information you provide during the session (such as the name of family members), but this personalisation information is not stored by Q-BEx once you have finished.
Who can see your answers Only the professional who sent you the link can access your responses. The University of Leeds cannot see them. No one from Q-BEx will contact you.
How your information is stored Your responses are stored securely on a server in the UK. They are kept for up to two years and then permanently deleted. Your data is pseudonymised — meaning it is stored without your name attached — and only the professional who invited you holds the key to link it back to you if necessary.
Your rights You have the right to access, correct, or request deletion of your data. To exercise these rights, contact the professional who invited you to complete the questionnaire, as they are responsible for your data.
Cookies This website uses cookies. If you do not accept cookies, the questionnaire will not function. Please see section 7 below.
Questions or concerns If you have concerns about how this website handles data, you can contact the University of Leeds Data Protection Officer: dpo@leeds.ac.uk. If you are unhappy with the response, you can complain to the Information Commissioner’s Office at ico.org.uk.
Comprehensive policy for professional users
1. Purpose of this Notice
This notice sets out how Q-BEx complies with applicable data protection legislation, including the UK GDPR, and, where relevant, the EU GDPR.
In this notice, the following defined terms are used throughout:
- “the University” refers to the University of Leeds
- “the Questionnaire” refers to the Q-BEx questionnaire tool
- “User” refers to the professional registered to administer questionnaires via Q-BEx
- “Respondent” refers to an individual who completes a questionnaire administered by a User
The University of Leeds acts as Data Controller in respect of the technical operation, security, and maintenance of the Q-BEx platform, and in respect of the personal data of registered professional Users. Users act as Data Controller in respect of all personal data they collect and hold within Q-BEx. The University does not have access to any personal data collected by Users through the platform.
This notice should be read alongside any additional privacy information provided to you at the point of data collection. It is intended to supplement, not replace, those notices.
2. Changes to this Notice
We keep the information provided in this Notice under review. This Notice may be updated from time to time. If we make any substantial updates, we will draw these to your attention.
We will not use your personal data in any manner that is incompatible with the purpose for which the data were collected originally, unless we have obtained your consent to that additional use.
3. Anything you are not clear about
If there is anything you are unclear about, please contact our Data Protection Officer, who will be happy to answer any queries you may have concerning this Notice or the way in which we process your personal data.
The Data Protection Officer’s contact details are provided at the end of this Notice in section 10.
4. Purpose of processing
4.1 Personal data collected directly from Users
Personal data collected from professional Users will be used to notify them of updates or technical issues affecting the questionnaire, and to inform them of opportunities to contribute to its ongoing development.
When Users register with Q-BEx, the University collects their name and professional email address. The University acts as Controller of this personal data. The legal basis for this processing is the University’s legitimate interest in keeping the platform secure and operational. This data will be retained for as long as the Q-BEx platform is maintained, unless the User requests its deletion. It will not be shared with third parties except where required by law or law enforcement.
4.2 Personal data collected from Respondents
Personal data submitted by Respondents is accessible only to the User who created the questionnaire version they completed. This data is not accessible to the Q-BEx development team or to any other member of staff at the University of Leeds.
Respondent data is automatically pseudonymised within the system. A de-anonymisation key — allowing Users to re-link pseudonymised records to individual children where clinically or professionally necessary — is generated as a separate document accessible to the User only. Users are responsible for storing both the questionnaire data and the de-anonymisation key in accordance with their professional codes of conduct and the data protection legislation applicable in their jurisdiction.
Q-BEx does not retain any personal information relating to children’s family members. Such information is used solely to customise question wording during the Respondent’s session and is not stored once the session ends.
4.3 Automated collection of technical data
When you access Q-BEx, certain technical information provided by your browser — including your IP address, browser type, and the address of the page you last visited — is automatically recorded by the University. This data may be used to aid detection in the event of a security breach. The legal basis for this processing is the University’s legitimate interest in keeping the platform secure. This data is retained in a form from which you may be identifiable for as long as the University maintains Q-BEx, unless you request its deletion.
5. Third-party access
Personal data provided by Users will not routinely be shared with third parties, except where required by law or law enforcement agencies, or as otherwise notified (see Section 7).
6. Data retention
User data will be retained on a secure server in the UK indefinitely (unless Users request their deletion).
Respondent data will be stored on a secure server in the UK for a period of two years. After that it will be securely destroyed.
7. Cookie Policy
This Cookie Policy explains what cookies are and how we use them. You should read this policy to understand what cookies are, how we use them, the types of cookies we use i.e, the information we collect using cookies and how that information is used and how to control the cookie preferences. For further information on how we use, store and keep your personal data secure, please read the rest of the Privacy Policy on this page.
You can at any time change or withdraw your consent from the Cookie Declaration on our website. Learn more about who we are, how you can contact us and how we process personal data in our Privacy Policy. Your consent applies to the following domains: www.q-bex.org
7.1. What are cookies?
7.2. How do we use cookies?
Like most online services, this website uses both first-party and third-party cookies. First-party cookies are primarily used to ensure the website functions correctly and do not collect personally identifiable information.
Third-party cookies are used for the following purposes: monitoring website performance and reliability; understanding how users interact with the site; maintaining security; and improving the overall user experience. These cookies do not have access to personally identifiable data held within Q-BEx.
7.3. What types of cookies do we use?
The cookies used on this website fall into the following categories:
Strictly necessary cookies — Required for the website to function. These cannot be disabled. They include cookies that manage user sessions and security tokens.
Performance and analytics cookies — Used to collect anonymised information about how visitors use the site, such as which pages are visited most frequently. This helps us improve the website over time. (e.g. Google Analytics)
Functional cookies — Allow the website to remember choices you have made (such as your cookie consent preferences) to provide a more personalised experience.
7.4. How can I control the cookie preferences?
You can manage your cookies preferences by clicking on the “Settings” button and enabling or disabling the cookie categories on the popup according to your preferences.
Should you decide to change your preferences later through your browsing session, you can click on the “Manage consent” tab on your screen. This will display the consent notice again enabling you to change your preferences or withdraw your consent entirely.
In addition to this, different browsers provide different methods to block and delete cookies used by websites. You can change the settings of your browser to block/delete the cookies. To find out more out more on how to manage and delete cookies, visit wikipedia.org, www.allaboutcookies.org.
8. Accuracy of your data
It is important that the personal data the University holds about you is accurate and current. Please keep us informed if the personal data you have provided to us needs to be updated.
9. Your rights as a data subject
Under the GDPR, in certain circumstances, you have the right to:
- withdraw your consent to our processing of your personal data where that is the legal basis for such processing
- access any of your personal data which we hold
- have your personal data which we hold corrected if it is inaccurate
- have any of your personal data which we hold erased
- restrict the ways in which we process your personal data
- object to our processing of your personal data
- receive a copy of any of your personal data which we hold in a structured and commonly used machine-readable format
- in certain cases not be subject to a decision based solely on automated decision making
- lodge a complaint with a supervisory authority.
10. Queries and complaints
If you have any queries or concerns relating to this privacy notice or the way your data is being processed through this website then please contact the University’s Data Protection Officer, Alice Temple.
- Phone: +44 (0) 113 2431751
- Email: dpo@leeds.ac.uk
- Address: University of Leeds, 11.72 EC Stoner Building, Leeds LS2 9JT, UK.
The UK’s regulator for the Data Protection Legislation is the Information Commissioner’s Office (ICO). The University is registered as a Data Controller with the ICO.
Should you be dissatisfied with our handling of your concerns you have the right to complain to a supervisory authority. In the case of the UK this is the Information Commissioner’s Office.
Last updated: 18th of March 2026
