Privacy Policy — R02 Past Papers

Privacy Policy

Last updated: 6 June 2026

This Privacy Policy explains how R02 Past Papers (“we”, “us”, or “our”) collects, uses, and protects personal data when you use www.r02pastpapers.co.uk and related services (the “Service”). We are the data controller for personal data described below.

1. Who we are

Service name: R02 Past Papers
Website: www.r02pastpapers.co.uk
Contact: contact@r02pastpapers.co.uk

2. Personal data we collect

Depending on how you use the Service, we may collect:

  • Account data — email address and a hashed password when you register.
  • Usage and progress data — test attempts, scores, topics selected, and timestamps.
  • Purchase data — whether full access was purchased, payment status, and Stripe checkout or transaction identifiers. We do not receive or store full payment card numbers.
  • Technical data — IP address, browser type, device information, and server logs generated when you use the Service.
  • Communications — information you send when you contact us by email.

You may use some sample content without creating an account. In that case we collect only limited technical data necessary to deliver the page.

3. How we use your data

We use personal data to:

  • create and manage your account;
  • provide practice tests, save progress, and grant access to paid features;
  • process payments and maintain purchase records;
  • operate, secure, and improve the Service;
  • respond to enquiries and support requests;
  • comply with legal obligations and enforce our terms.

4. Legal bases (UK GDPR)

We process personal data on the following bases:

  • Contract — to provide the Service you sign up for, including paid access.
  • Legitimate interests — to secure the Service, prevent abuse, and improve functionality, balanced against your rights.
  • Legal obligation — where we must retain records for tax, accounting, or regulatory purposes.
  • Consent — where required for optional activities not covered above. You may withdraw consent at any time.

5. Payment processing

Payments are handled by Stripe. When you checkout, Stripe collects payment and billing information according to its own privacy policy. We receive limited information from Stripe (such as payment status and transaction references) needed to activate and support your purchase.

6. Cookies and similar technologies

We use essential cookies and session mechanisms to keep you signed in and to operate the Service securely. These are necessary for core functionality and do not require consent under UK privacy rules. We do not use third-party advertising cookies on the Service.

You can control cookies through your browser settings. Disabling essential cookies may prevent login and other features from working.

7. Third-party service providers

We use trusted providers who process data on our behalf, including:

  • Hosting infrastructure — to run the website and store application data.
  • Stripe — payment processing.
  • OpenAI — to generate practice questions when you start a test (question topics and reference material may be sent to generate content; we do not intentionally send your account email as part of that request).

These providers are permitted to process data only as needed to deliver their services to us and are subject to contractual confidentiality and security obligations where applicable.

8. International transfers

Some providers may process data outside the United Kingdom. Where this occurs, we rely on appropriate safeguards such as adequacy regulations, standard contractual clauses, or equivalent mechanisms recognised under UK data protection law.

9. Data retention

We keep personal data only for as long as necessary for the purposes described above. Account and progress data are retained while your account is active. Purchase records may be kept longer where required for accounting, tax, or legal purposes. You may request deletion of your account subject to any retention we are legally required to maintain.

10. Security

We use reasonable technical and organisational measures to protect personal data, including encrypted connections (HTTPS), hashed passwords, and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Your rights

Under UK data protection law, you may have the right to:

  • access the personal data we hold about you;
  • request correction of inaccurate data;
  • request erasure in certain circumstances;
  • restrict or object to processing in certain circumstances;
  • request data portability where applicable;
  • withdraw consent where processing is based on consent;
  • lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

To exercise your rights, email contact@r02pastpapers.co.uk. We may need to verify your identity before responding.

12. Children

The Service is not intended for users under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date will change when we do. Material changes will be posted on this page. We encourage you to review this policy periodically.

14. Contact

Privacy enquiries: contact@r02pastpapers.co.uk