Privacy Policy

Last updated: 18 July 2026

This policy explains how passrpl.com ("we", "us") collects, uses and protects your personal data, and your rights under the UK GDPR and the Data Protection Act 2018. We are the data controller for the personal data described here.

Contact for any privacy matter: ghana@passrpl.com.

1. Data we collect

  • Account data - your email address, used to create and sign in to your account.
  • Payment data - your payment status and Stripe customer ID. We never see or store your full card details; these are handled directly by Stripe.
  • Study activity - quiz and mock attempts (question IDs, answers, timestamps) used to track your progress.
  • Reviews - any review or feedback you choose to submit.
  • Consulting enquiries - if you contact us about the MCS accreditation consulting service, the name, business, contact details and information you provide by email.
  • Technical data - limited server and security logs (such as request metadata) generated automatically when you use the site.

2. How we use it, and our lawful bases

  • To provide the service (accounts, study features, progress tracking, delivering consulting) - lawful basis: performance of a contract.
  • To take payment and prevent fraud - lawful basis: performance of a contract and our legitimate interests in securing payments.
  • To keep the service secure and working, and to improve it - lawful basis: our legitimate interests.
  • To send essential account and transactional emails (sign-in, receipts, service notices) - lawful basis: performance of a contract.
  • To send occasional service emails about your account and our products (such as a welcome email, study reminders, an invitation to upgrade, or a request to review a product you bought) - lawful basis: our legitimate interests in running and promoting the service to our own users. Every such email includes a way to opt out, and you can opt out at any time by replying or emailing us.
  • To keep financial records - lawful basis: compliance with a legal obligation.

We do not sell your personal data, and we do not use it for third-party advertising.

3. Who we share it with

We use a small number of trusted service providers (processors) who handle data on our behalf under contract:

  • Supabase - authentication and database (EU region).
  • Stripe - payment processing.
  • Vercel - website hosting and delivery.
  • Our email provider - sending account and transactional emails.

For the consulting service, we only share your information with the external bodies you are applying to (for example a certification body, insurer or consumer code) where you ask us to, or where it is necessary to deliver what you have engaged us for.

4. International transfers

Some providers (such as Stripe and Vercel) may process data outside the UK. Where they do, the transfer is protected by appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

5. How long we keep it

  • Account and study data - for as long as your account is active, and until you delete it.
  • Payment and financial records - retained for up to 6 years to meet tax and accounting obligations.
  • Consulting records - retained for up to 6 years after the engagement, in line with our business records.
  • Security logs - retained only for a short period, then deleted.

6. Cookies

We use strictly necessary cookies to keep you signed in and to keep the site secure; these do not require consent. With your consent, we also use the Meta (Facebook) Pixel to measure the performance of our advertising. This advertising cookie is off by default and only loads after you accept it in our cookie banner. You can decline, and you can withdraw consent at any time by clearing this site's cookies and site data in your browser, after which the banner will let you choose again.

7. Data security

Access is protected by authentication, data is transmitted over encrypted connections, and access to personal data is limited to what is needed to run the service. No system is completely secure, but we take reasonable steps to protect your information.

8. Your rights

Under UK data protection law you have the right to:

  • access the personal data we hold about you;
  • have inaccurate data corrected;
  • have your data erased;
  • restrict or object to how we use it;
  • receive your data in a portable format;
  • withdraw consent where we rely on it.

You can export your data or delete your account directly from the Account page. For any other request, email us at ghana@passrpl.com. We respond within 30 days.

9. Children

The service is intended for adults working toward professional qualifications and is not directed at children under 16.

10. Complaints

If you have a concern, please contact us first so we can help. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

11. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the "last updated" date above.