CeMAP Practice Papers
← All papers

Privacy notice

This is our UK GDPR Article 13 notice — what we do with your personal data and what you can do about it. Last updated 28 July 2026.

The short version

  • •We have no user accounts and no customer database of our own.
  • •The only personal data we hold about most people is an email address, and it lives in Stripe.
  • •Your scores and revision progress stay in your own browser and never reach us.
  • •We set one cookie, it's strictly necessary, and we don't track you or run advertising.
  • •We never sell your data.

1. Who the controller is

The data controller for this site is Edward Jones, a sole trader in the United Kingdom, trading as “CeMAP Practice Papers”.

Address: Unit 171933, PO Box 7169, Poole, BH15 9EL

Data protection contact: support@cemappractice.co.uk

We are a small operation and are not required to appoint a Data Protection Officer. Data protection questions go to the address above and are handled by the operator personally.

2. What we collect, why, and our lawful basis

a) Your email address and payment record, when you buy

What: the email address you enter at Stripe checkout, the amount, date, currency, what you bought, the payment status, and Stripe's own identifiers (customer ID, payment intent ID). Stripe also collects your card details and, where needed, billing/country data for fraud checks and tax — we never see or store card numbers.

Why: to take payment, to grant your access, and — because we have no accounts — to restore your access later when you type that email on the unlock page.

Lawful basis: Article 6(1)(b) — performance of the contract you entered into with us. For the fraud-prevention and record-keeping parts, Article 6(1)(f) legitimate interests (preventing payment fraud) and Article 6(1)(c) legal obligation (tax and accounting records).

b) Your email address, if you sign up for the daily question

What: just your email address. It is stored as a customer record in Stripe with a metadata flag marking you as a daily-question subscriber. We store nothing else about you.

Why: to send you the CeMAP question of the day.

Lawful basis: Article 6(1)(a) consent, which you give by submitting the form. You can withdraw it at any time by emailing support@cemappractice.co.uk or using the unsubscribe link — withdrawing consent doesn't affect anything we did before you withdrew it.

c) The access cookie

What: one cookie containing a signed token that records what you bought. It is httpOnly (JavaScript cannot read it), sent only to this site, and it expires after 12 months. It contains no name, no email and no card data, and it is not used to profile or track you.

Why: it is the only thing that unlocks the papers you paid for. Without it the service you asked for cannot be delivered.

Lawful basis: Article 6(1)(b) performance of the contract. For the cookie rules specifically, this cookie is strictly necessary to provide a service you have explicitly requested, so it falls within the exemption in regulation 6(4) of the Privacy and Electronic Communications (EC Directive) Regulations 2003. That is why this site has no cookie banner — we don't set any cookie that needs consent.

d) Your scores and revision progress

What: your answers, scores, attempt history and mastery data are written to localStorage in your own browser.

Why: so the site can show your progress and pick weak topics for you.

This never leaves your device. It is not sent to us, not stored on any server and not visible to us at all. We could not produce it in response to a subject access request because we do not have it. It doesn't sync between devices, and clearing your browser's site data deletes it permanently. You can clear it yourself from the progress page.

e) Analytics

We use Vercel Analytics to count page views and see which pages are useful. It is cookieless: it sets no cookies, uses no device fingerprinting, does not follow you across sites and does not build a profile of you. It reports aggregate figures only — we cannot identify you from it.

Lawful basis: Article 6(1)(f) legitimate interests — understanding in aggregate how the site is used so we can improve it. Because it stores nothing on your device and produces no personal data about you, it needs no consent under PECR.

f) Emails you send us

If you email support, we hold your email address and whatever you wrote for as long as needed to deal with it and to keep a record of the outcome. Lawful basis: Article 6(1)(b) or 6(1)(f) — answering your query and keeping a record of complaints and refunds.

We do not collect special category data, we do not knowingly collect data from children, and we do not carry out any automated decision-making or profiling that produces legal or similarly significant effects on you.

3. Who we share it with

We do not sell your data and we do not share it for anyone else's marketing.

  • •Stripe — our payment provider, and effectively our customer record. Our contracting entity is Stripe Payments Europe, Limited in Ireland. Stripe acts as our processor for the customer records we create, and as an independent controller for its own payment, fraud-prevention and regulatory purposes. See Stripe's privacy policy.
  • •Vercel — hosts the site and provides the cookieless analytics. Server logs necessarily process your IP address transiently to serve pages.
  • •Our email provider — to send the daily question and to reply to support emails.
  • •Professional advisers and authorities — our accountant, or a regulator, court or law-enforcement body where we are legally required to disclose.

4. International transfers

We contract with Stripe Payments Europe, Limited in Ireland, but Stripe's group processing involves Stripe, Inc. in the United States, so your email address and payment record are transferred outside the UK.

Those transfers are protected by appropriate safeguards under Article 46 UK GDPR:

  • •the EU Standard Contractual Clauses as modified by the UK International Data Transfer Addendum (the UK Addendum to the EU SCCs), issued by the ICO; and
  • •where applicable, the UK Extension to the EU–US Data Privacy Framework, under which certified US recipients are covered by UK adequacy.

You can ask us for more detail about these safeguards by emailing support@cemappractice.co.uk.

5. How long we keep it

  • •Purchase records (in Stripe): kept for 6 years after the end of the tax year of the transaction, because HMRC requires business records to be kept that long, and because your access is restored by looking your payment up.
  • •Daily-question email address: kept until you unsubscribe or ask us to delete it, and removed within 30 days of that request. We also remove addresses that have been inactive for 24 months.
  • •Access cookie: expires 12 months after it is set, or sooner if you clear your cookies.
  • •Progress in localStorage: stays on your device until you clear it. We have no control over it and no copy of it.
  • •Support emails: kept for up to 24 months after the matter is closed, or 6 years where they relate to a refund or a dispute.
  • •Analytics: aggregate and non-identifying; retained per Vercel's retention policy.

6. Your rights

Under the UK GDPR you have the right to:

  • •be informed — this notice;
  • •access a copy of the personal data we hold about you;
  • •rectification of anything inaccurate;
  • •erasure — though we may have to keep purchase records to meet our tax obligations;
  • •restrict our processing;
  • •data portability for data you gave us that we process by consent or for a contract;
  • •object to processing based on legitimate interests, and to object to direct marketing at any time — that one is absolute;
  • •withdraw consent at any time where we rely on it.

To exercise any of these, email support@cemappractice.co.uk. We'll respond within one month, and it's free. We may need to ask a question or two to confirm you are the person the data relates to — normally, that you can receive email at the address in question.

7. Security

The site runs over HTTPS. Card data is handled entirely by Stripe on Stripe-hosted pages and never touches our systems. The access cookie is signed, httpOnly, sameSite and secure in production, so it cannot be read by scripts or forged. We keep the personal data we hold to the minimum that makes the service work.

8. Complaining to the ICO

If you think we've mishandled your data, please tell us first at support@cemappractice.co.uk — we'd like the chance to put it right. You also have the right to complain to the UK supervisory authority at any time:

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
ico.org.uk/make-a-complaint

9. Changes to this notice

If we change how we handle personal data we will update this page and change the “last updated” date. Where a change is significant and we hold your email address, we will tell you directly.