Privacy Policy
Last updated: April 2026
What We Collect
We collect your name, email address and payment information when you register or purchase. We also collect usage data (pages visited, quiz scores) to improve the platform.
How We Use It
Your data is used to provide the service, send transactional emails (receipts, password resets) and improve our content. We do not sell your data to third parties.
Legal Basis for Processing (UK GDPR Article 6)
| Processing activity | Legal basis |
|---|---|
| Creating and managing your account | Contract (Art. 6(1)(b)) |
| Processing payments | Contract (Art. 6(1)(b)) |
| Sending receipts and transactional emails | Contract (Art. 6(1)(b)) |
| Analytics and platform improvement | Consent (Art. 6(1)(a)) |
| Complying with legal obligations | Legal obligation (Art. 6(1)(c)) |
Cookies
We use cookies for authentication and analytics (Google Analytics 4, with your consent). You can manage cookie preferences via the banner that appears on your first visit.
Your Rights (UK GDPR)
You have the right to access, rectify or delete your personal data. To exercise these rights, email support@passnova.co.uk.
Data Retention
| Data type | Retention period |
|---|---|
| Account data (name, email) | Until account deleted, then purged within 30 days |
| Purchase and payment records | 6 years (UK tax law requirement) |
| Course progress and quiz scores | Until account deleted |
| Analytics data (GA4) | 14 months (GA4 default, consent required) |
| Support correspondence | 2 years from last contact |
Children's Data
The Kids Zone section of PassNova is intended for use by children aged 5–11 under parental supervision. We do not knowingly collect personal data directly from children under 13 without parental consent. Kids Zone courses do not require account registration — they are freely accessible. If you believe a child has provided personal data without parental consent, please contact us at support@passnova.co.uk and we will delete it promptly. A full children’s data policy (covering AADC compliance, parental access rights, and data minimisation) is in development.
International Data Transfers
Some of our third-party processors are based in the United States. When your personal data is transferred to these processors, it is protected by appropriate safeguards under UK GDPR Article 46, specifically Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner’s Office (the UK Addendum to the EU SCCs). The processors and their transfer mechanisms are:
- Stripe, Inc. (USA) — payment processing — covered by Stripe’s Data Processing Agreement incorporating UK SCCs
- Google LLC (USA) — Google Analytics 4 — covered by Google’s Data Processing Agreement incorporating UK SCCs; consent required before activation
- Anthropic, PBC (USA) — AI tutoring feature (Nova) — only conversational content submitted to the AI tutor is processed; covered by Anthropic’s Data Processing Agreement
- Netlify, Inc. (USA) — platform hosting — covered by Netlify’s Data Processing Agreement incorporating UK SCCs
You may request a copy of the relevant Standard Contractual Clauses by emailing support@passnova.co.uk.
Third Parties
- Stripe — payment processing (USA)
- Cloud database provider — database hosting
- Netlify — platform hosting (USA)
- Google Analytics — usage analytics (consent required) (USA)
- Anthropic — AI tutoring feature (Nova) (USA)
Contact & Data Controller
Data controller: JDS Vanguard Holdings Ltd (Company No. 16392512). Email: support@passnova.co.uk.
Registered in England & Wales · Registered office: 150 Sycamore Close, Burghfield, Reading, England, RG30 3SW
You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint if you believe your data has been handled unlawfully.