Privacy Policy

What We Collect

We collect your name, email address and payment information when you register or purchase. We also collect usage data (pages visited, quiz scores) to improve the platform.

How We Use It

Your data is used to provide the service, send transactional emails (receipts, password resets) and improve our content. We do not sell your data to third parties.

If you choose to join our newsletter — by ticking the box when you register, or by confirming a link we email you after you sign up on our newsletter page — we will email you exam tips, new courses and free resources, roughly twice a month. This is optional, we record when and how you opted in, and every issue carries an unsubscribe link that takes effect immediately. Unsubscribing from the newsletter does not affect account emails such as password resets and receipts.

Legal Basis for Processing (UK GDPR Article 6)

Processing activity	Legal basis
Creating and managing your account	Contract (Art. 6(1)(b))
Processing payments	Contract (Art. 6(1)(b))
Sending receipts and transactional emails	Contract (Art. 6(1)(b))
Sending the newsletter	Consent (Art. 6(1)(a)) — withdraw at any time via the unsubscribe link
Analytics and platform improvement	Consent (Art. 6(1)(a))
Complying with legal obligations	Legal obligation (Art. 6(1)(c))

Cookies

We use cookies for authentication and analytics (Google Analytics 4 and our own Vanguard Analytics heatmaps and session recordings, both only with your consent). Vanguard Analytics never records what you type into forms, hides your name and email wherever they appear on a recorded page (such as the site header and certificates) and anonymises your IP address. Neither tool runs on Kids Zone pages or on pages that show account details (sign-in, registration, password reset, email verification, your account and dashboard, team and admin pages); see our Cookie Policy. You can manage cookie preferences via the banner that appears on your first visit.

Your Rights (UK GDPR)

You have the right to access, rectify or delete your personal data. You can delete your account yourself at any time from your account page (“Delete my account”): it takes effect immediately and cancels any subscription. To exercise any of these rights, you can also email support@passnova.co.uk.

Data Retention

Data type	Retention period
Account data (name, email)	Until account deleted, then purged within 30 days
Purchase and payment records	6 years (UK tax law requirement)
Course progress and quiz scores	Until account deleted
Analytics data (GA4)	14 months (GA4 default, consent required)
Heatmap and session-recording data (Vanguard Analytics)	90 days, then deleted automatically (consent required)
Support correspondence	2 years from last contact

Children's Data

The Kids Zone section of PassNova is intended for use by children aged 5–11 under parental supervision. We do not knowingly collect personal data directly from children under 13 without parental consent. Kids Zone courses do not require account registration — they are freely accessible. If you believe a child has provided personal data without parental consent, please contact us at support@passnova.co.uk and we will delete it promptly. A full children’s data policy (covering AADC compliance, parental access rights, and data minimisation) is in development.

International Data Transfers

Some of our third-party processors are based in the United States. When your personal data is transferred to these processors, it is protected by appropriate safeguards under UK GDPR Article 46, specifically Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner’s Office (the UK Addendum to the EU SCCs). The processors and their transfer mechanisms are:

• Stripe, Inc. (USA) — payment processing — covered by Stripe’s Data Processing Agreement incorporating UK SCCs
• Google LLC (USA) — Google Analytics 4 — covered by Google’s Data Processing Agreement incorporating UK SCCs; consent required before activation
• Anthropic, PBC (USA) — AI tutoring feature (Nova) — only the messages, and any photos, you send to the AI tutor, and any writing you send for marking, are processed; photos and marked writing are not stored by PassNova; covered by Anthropic’s Data Processing Agreement
• Netlify, Inc. (USA) — platform hosting — covered by Netlify’s Data Processing Agreement incorporating UK SCCs

You may request a copy of the relevant Standard Contractual Clauses by emailing support@passnova.co.uk.

Third Parties

• Stripe — payment processing (USA)
• Cloud database provider — database hosting
• Netlify — platform hosting (USA)
• Resend — email delivery for account emails and the newsletter (USA; mail is sent from EU servers)
• Google Analytics — usage analytics (consent required) (USA)
• IONOS — hosts the server for Vanguard Analytics, our own heatmap and session-recording tool (consent required)
• Anthropic — AI tutoring feature (Nova) (USA)

Information for People in the United States

This section is for people in the United States and its territories. It adds to the rest of this policy and describes what we collected about you in the last 12 months, and the rights US state privacy laws give you.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. Google Analytics runs without its advertising features. We do not ask for sensitive personal information such as health details, precise location or government ID; please do not put any in messages to the AI tutor.

Your rights. If you live in a US state with a privacy law, you can ask us to tell you what personal information we hold about you and give you a copy, to correct it, or to delete it, and you can ask us not to sell or share it (we do neither). You can delete your account yourself at any time from your account page. To make any request, email support@passnova.co.uk from the address on your account, so we can check it is you. We reply within 45 days, and may extend that once by a further 45 days if we tell you why. You can use an authorised agent. We will not treat you differently for using these rights. If we decline a request, you can appeal by replying to our answer, and we will respond within 60 days; if you are still not satisfied you may contact your state attorney general.

Global Privacy Control. If your browser sends a Global Privacy Control signal, we treat it as a request not to be tracked: Google Analytics and Vanguard Analytics do not load, and no cookie banner is shown. This applies even if you accepted analytics earlier.

Records of US purchases. For US purchases we keep a record of your agreement to the renewal terms (the time, the version of the terms and your billing address) for at least three years, and the tax records the law requires. We may keep these after you delete your account where the law requires or allows it.

Age. PassNova accounts and Premium are for people aged 13 and over. If you are in the United States and think a child under 13 has given us personal information, email us and we will delete it.

Where your information is processed. PassNova is run from the United Kingdom, so information about people in the United States is sent to and handled in the UK, the United States and, for email delivery, the EU, by the providers listed in this policy.

Contact & Data Controller

Data controller: JDS Vanguard Holdings Ltd (Company No. 16392512). Email: support@passnova.co.uk.

Registered in England & Wales · Registered office: 150 Sycamore Close, Burghfield, Reading, England, RG30 3SW

You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint if you believe your data has been handled unlawfully.