Privacy policy

1Interpretation and controller

1.1This policy sets out the basis upon which personal data is processed in connection with the Site. Expressions defined in the legal notices shall bear the same meaning in this policy. The expressions "personal data", "processing", "controller", "processor" and "data subject" shall bear the meanings ascribed to them by the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018 (together, "Data Protection Legislation").

1.2For the purposes of Data Protection Legislation the Operator is the controller in respect of all personal data processed in connection with the Site.

1.3This policy is to be read together with the legal notices. In the event of any inconsistency between this policy and the legal notices in respect of the processing of personal data, this policy shall prevail.

2Categories of personal data

2.1Account data. Where a User registers by means of Google authentication, the Operator obtains from Google, and thereafter retains, the User's name, email address and profile picture as held on the User's Google account. No further data is obtained from that account. The Operator does not at any time receive, process or retain the User's password.

2.2Ratings. Where a User submits a rating in respect of a paper, the Operator retains that rating against the User's account identifier. Individual ratings are not published and are processed solely for the purpose of computing aggregate figures.

2.3Activity data. During any period in which a User is authenticated, the Operator records the time of the User's most recent use of the Site and, for the purpose of the Site's live features, whether the User is at that time connected. Upon the creation of an account the Operator records the referring website, the page upon which the User first arrived, and the general category of device employed.

2.4Practice data. Results, recorded errors, preferences and settings are held within the local storage of the User's own browser. Such data is not transmitted to, and is not accessible by, the Operator.

2.5Technical data. The Operator's hosting provider processes IP addresses and request logs in the ordinary course of delivering and securing the Site.

2.6The Operator does not process any special category of personal data within the meaning of Article 9 of the UK GDPR, and does not knowingly process the personal data of any person under the age of thirteen.

3Purposes and lawful bases of processing

3.1Personal data shall be processed only for the purposes, and upon the lawful bases, set out below:

1. for the establishment and operation of the User's account, the maintenance of the User's authenticated session, and the presentation to the User of the User's own ratings and results: the performance of a contract to which the User is party (Article 6(1)(b));
2. for the computation and display of aggregate figures, including the number of Users using the Site at any given time and aggregate ratings, in a form from which no individual is identifiable: the legitimate interests of the Operator in the provision and operation of the Site (Article 6(1)(f));
3. for the analysis, in aggregate, of the means by which Users arrive at the Site: the legitimate interests of the Operator in the maintenance and improvement of the Site (Article 6(1)(f));
4. for the transmission of occasional email concerning the Site to registered Users: the legitimate interests of the Operator in communicating with Users concerning the service (Article 6(1)(f)), subject to the User's right to object at any time by means of the unsubscribe facility contained in every such email;
5. for the security of the Site and the prevention of abuse: the legitimate interests of the Operator in the protection of the Site (Article 6(1)(f)); and
6. for compliance with any legal obligation to which the Operator is subject, including obligations arising in the handling of notices under clause 7 of the legal notices: compliance with a legal obligation (Article 6(1)(c)).

3.2Personal data shall not be sold. No advertising is served upon the Site and no cross-site tracking is undertaken. Personal data shall not be disclosed to any third party for the purposes of that third party's marketing.

3.3Personal data shall not be processed for any purpose incompatible with those set out in clause 3.1 without the User first being informed of that purpose and, where required, the User's consent being obtained.

4Recipients and transfers

4.1Personal data is processed on behalf of the Operator by the following processors, each of which processes such data in accordance with its own terms and privacy policy and under a written contract complying with Article 28 of the UK GDPR:

• Google LLC (Firebase) — authentication and the storage of account data, ratings and activity data;
• Cloudflare, Inc. — hosting, content delivery and security;
• Google LLC (Google Fonts) — the delivery of typefaces upon certain pages.

4.2Certain of the processors identified in clause 4.1 process personal data in territories outside the United Kingdom. Any such transfer is effected pursuant to the International Data Transfer Agreement, the International Data Transfer Addendum to the European Commission's standard contractual clauses, an adequacy regulation made under section 17A of the Data Protection Act 2018, or such other transfer mechanism as is recognised under Data Protection Legislation.

4.3Personal data may be disclosed where such disclosure is required by law, by order of a court of competent jurisdiction, or in connection with the establishment, exercise or defence of legal claims, including the handling of notices under clause 7 of the legal notices.

4.4Save as provided in this clause 4, personal data is not disclosed to any third party.

5Cookies and local storage

5.1The Site sets no cookie for the purpose of advertising or of tracking the User across other websites.

5.2Authentication relies upon such cookies and tokens as are required by Google's authentication service. Such cookies are strictly necessary for the provision of a service expressly requested by the User, and are accordingly exempt from the requirement of consent under regulation 6(4) of the Privacy and Electronic Communications (EC Directive) Regulations 2003.

5.3All other data held within the browser, including results, theme and preferences, is held within the browser's local storage, and may be deleted by the User at any time by means of the browser's own settings or of the reset facility provided upon the Site.

6Retention and erasure

6.1Account data, ratings and activity data shall be retained for so long as the User's account subsists, and thereafter for such period as is necessary for the establishment, exercise or defence of legal claims.

6.2A User may at any time require the erasure of the User's account, and of all personal data held in connection therewith, by written request to [email protected] sent from the email address associated with the account. Such a request shall be given effect within one month of receipt.

6.3Practice data held within the User's browser is within the sole control of the User and may be deleted by the User at any time.

7Rights of the data subject

7.1Subject to the conditions and exemptions provided for by Data Protection Legislation, a User is entitled:

1. to be informed of the processing of the User's personal data (Articles 13 and 14);
2. to obtain confirmation as to whether personal data concerning the User is being processed and, where it is, access to that data and to a copy thereof (Article 15);
3. to obtain the rectification of inaccurate personal data (Article 16);
4. to obtain the erasure of personal data (Article 17);
5. to obtain the restriction of processing (Article 18);
6. to receive the personal data which the User has provided in a structured, commonly used and machine-readable format, and to transmit that data to another controller (Article 20);
7. to object at any time to processing carried out upon the basis of legitimate interests, and to object at any time and without condition to processing for the purposes of direct marketing (Article 21); and
8. to withdraw consent, where processing is founded upon consent, at any time and without affecting the lawfulness of processing carried out prior to such withdrawal (Article 7(3)).

7.2Any request in exercise of the foregoing rights shall be made in writing to [email protected]. The Operator shall respond without undue delay and in any event within one month of receipt, save that such period may be extended by a further two months where the complexity or number of requests so requires, in which event the User shall be informed of the extension and the reasons therefor within one month of receipt.

7.3The Operator may require such information as is reasonably necessary to confirm the identity of the person making a request before giving effect to it.

7.4Without prejudice to any other remedy available to the User, a User who considers that the processing of the User's personal data infringes Data Protection Legislation is entitled to lodge a complaint with the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, or at ico.org.uk.

8Amendment

8.1The Operator may amend this policy from time to time. Any amendment shall be published upon this page, and the date of the most recent amendment shall appear at its head. Where an amendment materially affects the manner in which personal data is processed, the Operator shall take reasonable steps to bring the amendment to the attention of Users.