Privacy Policy
This Privacy Policy explains how PRIME LEARNING HUB LTD ("we", "us", "our"), the operator of theoryprac.com and theoryprac.co.uk ("the Platform"), collects, uses, stores, and protects your personal data. We are committed to full compliance with UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).
We are the sole data controller for all personal data processed through the Platform. Contact our Data Protection Officer (DPO) at [email protected] with any questions.
1. Data We Collect
We collect only the data necessary to provide and improve our Services:
| Category | Examples | Source |
|---|---|---|
| Identity data | Name, email address, optional phone number | Registration form |
| Payment data | Card number, expiry date, CVV (processed by Stripe/PayPal; not stored by us) | Checkout |
| Account data | Test scores, progress levels, session timestamps | Platform activity |
| Technical data | IP address, browser type, operating system, device type | Automatic (cookies/logs) |
| Analytics data | Page visits, time on site, general usage patterns | Google Analytics 4 (only with your consent) |
| Correspondence | Emails, live chat transcripts, support tickets | Direct contact |
We do not purchase or receive personal data from third-party sources. We do not collect sensitive personal data (e.g., health, ethnicity, religion) unless you choose to share it voluntarily in correspondence.
2. How We Use Your Data
Your data is used solely for the following purposes:
- Delivering the Services, including practice tests, mock exams, and hazard perception tools.
- Processing payments for subscriptions and the Pass Guarantee Plan.
- Tracking your progress and personalising your study experience.
- Providing customer support and responding to your enquiries.
- Analysing platform performance and improving user experience.
- Sending service notifications (e.g., subscription renewals) — not marketing, unless you have opted in.
- Complying with our legal obligations (e.g., fraud prevention, tax records).
3. Legal Basis for Processing
| Legal Basis | Examples |
|---|---|
| Contract | Providing the Services you have paid for (e.g., delivering content, processing payment) |
| Consent | Marketing cookies and promotional communications — you may withdraw consent at any time |
| Legal obligation | Retaining financial records for 6 years under HMRC requirements |
| Legitimate interest | Improving platform performance and security; fraud prevention |
4. Payment Data
Payments are processed by PCI-DSS-compliant third-party providers (Stripe and/or PayPal) using 256-bit AES encryption and tokenisation. We do not store full payment card details on our servers.
Payment data is deleted or anonymised upon completion of the transaction, except where required by law (e.g., 6-year retention for UK tax compliance).
5. Cookies
| Type | Purpose | Control | Retention |
|---|---|---|---|
| Essential | Login, session management, security, shopping basket | Always active — required for the platform to function | Session |
| Analytics | Page visits, time on site, general usage patterns (Google Analytics 4) | Only set if you click "Accept All" — can be withdrawn at any time at theoryprac.com/cookiepolicy | Up to 26 months |
| Live chat | Remembers your chat session (Tawk.to) | Only set if you accept optional cookies and open the chat on the Contact page | Up to 1 year |
You will be asked to manage your cookie preferences via a clear banner on your first visit. You may update your preferences at any time at theoryprac.com/cookiepolicy or via your browser settings. No non-essential cookies — including Google Analytics — are set before you give consent.
What Google Analytics collects: pages you visit, how long you stay, the general type of device and browser you use, and an approximate location derived from your IP address. Your full IP address is anonymised before it is stored. Google Analytics does not collect your name, email address, or any theory test answers or results. This data is processed by Google under Google's own privacy policy, and helps us understand which parts of the platform are useful and where visitors run into difficulty — it is not used to identify you personally.
6. Data Retention
| Data Type | Retention Period |
|---|---|
| Account data | Until your account is closed, then anonymised within 24 months |
| Payment records | 6 years (UK tax law) |
| Analytics data | 26 months, then automatically anonymised |
| Support correspondence | 3 years from last contact |
| Correspondence re. guarantee | 5 years from claim resolution |
If you request deletion of your data, we will action this within 30 days, except where retention is required by law.
7. Sharing Your Data
We do not sell your data. We share data only with:
- Service providers: Google Analytics (analytics, only with your consent); Tawk.to (live chat); email delivery providers; payment processors once checkout is enabled — all under GDPR-compliant Data Processing Agreements (DPAs) where applicable.
- Legal authorities: where required by law (e.g., court order, HMRC request).
- With your consent: for any other specific purpose you have authorised.
International transfers (e.g., to Google Analytics in the US) are made under Standard Contractual Clauses (SCCs) approved by the UK ICO. See theoryprac.com/cookiepolicy for the current list of third-party services and the data they process.
8. Your Rights Under UK GDPR
| Right | What it means |
|---|---|
| Access | Request a copy of all data we hold about you |
| Rectification | Correct inaccurate or incomplete data |
| Erasure | Request deletion of your data ("right to be forgotten") |
| Restriction | Limit how we use your data in certain circumstances |
| Portability | Receive your data in a structured, machine-readable format |
| Object | Object to processing based on legitimate interests or for direct marketing |
| Withdraw consent | Withdraw consent for marketing or non-essential cookies at any time |
To exercise any of these rights, contact our DPO at [email protected]. Requests will be processed within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
9. Data Security
- SSL/TLS (256-bit AES) encryption for all data in transit.
- Encrypted, access-controlled servers hosted in the UK and EU, compliant with UK GDPR.
- Encrypted daily backups stored in secure, geographically separate locations.
- Role-based access controls, audited quarterly.
- Continuous monitoring with intrusion detection systems.
In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the ICO within 72 hours of becoming aware of it.
10. Children's Privacy
The Platform is not intended for users under the age of 16. We do not knowingly collect data from children under 16. If we become aware that we have inadvertently collected such data without verified parental consent, we will delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Where changes are material, we will notify you by email and update the "Last updated" date at the top of this document. Your continued use of the Platform after the change takes effect constitutes acceptance of the updated Policy.
12. Contact Us
- Data Protection Officer: [email protected]
- General enquiries: [email protected]
- Telephone: 07828 959 535 (Monday–Friday, 9 AM–5 PM UK time)