Privacy policy
Effective date: 23 October 2026.
Who holds your data
Sava Labs Ltd, which runs Simply Pass, is the "controller" of your data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Its full details are in our terms. Write to [email protected] about anything on this page.
What we collect
- Your email address. We need it to send the code that signs you in, your receipt, and an answer when you write to us.
- Your answers, your scores and your progress by topic. This makes your results page.
- Your purchase: the amount, the date, and your access window. Our payment provider holds the payment details. We never see or keep your card number.
- The country of your card and the country of your internet connection when you paid. We use them only to check that the pass is for someone who takes the test in this country.
- Technical records: the pages you asked for, the time, your internet address, your browser type and the errors the site met. We keep these to run the site and find faults.
- How you use the site, but only if you say yes in the cookie banner (see below).
Your email is all we need to run your account. We never ask for your name, your postal address, your phone number, your date of birth, your nationality, your immigration status or your test booking, and you can leave them out of messages to support too. If you send them, we use them only to answer you.
If you claim our pass guarantee, you send us your test result, which may show your name. We use it only to check your claim. We keep a note of the claim and delete the result itself once we have answered.
Why we use it, and our legal basis
| What we do | Legal basis under UK GDPR |
|---|---|
| Sign you in, give you the access you paid for, show your results, send your receipt, answer your messages | Contract: we need it to do what you bought |
| Keep purchase records for tax and accounts | Legal duty |
| Fix faults, stop fraud and abuse, keep the site safe | Legitimate interests: running a safe service |
| Measure how the site is used (analytics services) | Consent: you can say no, and take it back |
| Send marketing emails (if you ticked the box) | Consent: you can take it back at any time |
Who we share it with
We share only what each one needs to do its job. They act on our instructions as our processors.
| Who (by kind) | Why | What they get |
|---|---|---|
| Hosting providers in the EU | Run the site and store our data | Everything we hold, as the host |
| An email delivery provider | Delivers the sign-in code, receipt and any emails you asked for | Your email address and the text of the email |
| Our payment provider | Takes your payment, keeps the payment record | Your email address, payment details and billing country |
| Analytics services, only after you say yes in the cookie banner | Measure how the site is used | What you do on this site, and technical records |
| An adviser, auditor or authority | Only when the law makes us, or to defend a legal claim | Only what is asked for |
We do not sell your data. We do not give it to advertisers or data brokers.
Our emails to you
If you tick the box, we email you study tips and offers from Simply Pass. Every email has an unsubscribe link that works without signing in. We stop at once, and in any case within 10 working days. We keep a note that you unsubscribed so that we never write again. Emails about your sign in, your receipt and your support messages are not marketing and you do not need to agree to them. Our emails can use small tracking tools to tell us whether they arrive and are opened.
Cookies and the cookie banner
We always set the few cookies the site needs to work: the one that keeps you signed in, the one that remembers your cookie choice, and the one that remembers your language if you picked one. These are strictly necessary, so the law does not ask for your consent for them (Privacy and Electronic Communications Regulations, "PECR").
Our analytics services are off until you accept them in the cookie banner, which names them. If you refuse, they do not run and set no cookie. If you accept, they set cookies so that a second page or second visit counts as the same visitor. To change your answer, press "Cookie settings" at the bottom of any page. We set no advertising cookie. We load no advertising pixel and no social network tracker.
Where your data is kept
With hosting providers in the European Union, which UK law treats as giving adequate protection. Our email delivery provider, our payment provider and our analytics services may also handle your data in other countries outside the UK. When that happens, they use a legal safeguard the UK allows, such as UK adequacy regulations, the UK data bridge, or the UK addendum to standard contract clauses. Write to us if you would like a copy of the safeguard.
How long we keep it
Your account and your results stay while your account exists. If you have not signed in for 24 months, we delete them. We keep the record of a purchase for six years because tax and company law require it. Technical records stay for 90 days.
Your rights
Under UK data protection law you can ask us to
- give you a copy of the data we hold about you,
- correct something that is wrong,
- delete your data,
- limit or stop how we use it, including objecting to uses based on legitimate interests,
- move your data to someone else in a common format (where it applies),
- stop using data we use on the basis of your consent. You can take consent back at any time.
Write to [email protected] from the email address on your account. We answer within one month and we do not charge. If you ask us to delete your account while you have paid access left, the access goes with it, so tell us if you would like to wait. We must keep the purchase record for tax duties even after the account is gone.
Complaints
Please write to us first so we can put it right. You also have the right to complain to the UK regulator, the Information Commissioner's Office (ICO): ico.org.uk, telephone 0303 123 1113.
Children
Simply Pass is for adults who prepare for the Life in the UK test. It is not for children, and we do not knowingly collect data from a child. If you think a child gave us data, write to us and we delete it.
If a breach happens
If a breach puts your rights at high risk, we tell you by email without delay, and we report it to the ICO within 72 hours where the law requires.
Changes to this policy
We put the new policy on this page with a new date at the top. If a change matters to you, we also email you before it starts.