Privacy Policy

The data controller responsible for personal data collected through gcsepython.uk is:

We collect only the personal data necessary for the purposes described in this policy (the principle of data minimisation — UK GDPR Article 5(1)(c)).

We do not collect sensitive personal data (health data, racial or ethnic origin, political opinions, religious beliefs, biometric data). We do not collect financial information of any kind.

UK GDPR Article 6 requires us to identify a specific lawful basis for each processing activity we carry out.

We use personal data only for specific, stated purposes and will never use it for a purpose incompatible with why it was collected. We do not sell your personal data to any third party.

• Providing the service — saving and syncing learning progress, XP, and badges across devices when signed in.
• Improving the site — where analytics consent is given, understanding which topics students find difficult to improve content quality.
• Keeping the site free — where advertising consent is given, displaying Google AdSense adverts to fund hosting and development costs.
• Security — detecting and preventing fraudulent or harmful use of the service.
• Legal compliance — responding to lawful requests from regulators, courts, or law enforcement where legally required.

We do not use your data for direct marketing. We do not share data with third parties for their own marketing. We do not carry out automated decision-making with significant effects (see Section 11).

We use the following third-party services. Where they act as data processors on our behalf, we rely on Google's standard Data Processing Addendum as required by UK GDPR Article 28.

We use cookies in accordance with the Privacy and Electronic Communications Regulations 2003 (PECR). Non-essential cookies are only placed after you give freely given, specific, informed, and unambiguous consent through our cookie banner.

Minimum age: You must be at least 13 years old to create an account. If you are under 13, please use the site without an account — your progress will be saved locally on your device only.

How we meet the 15 standards of the Children's Code:

Advertising and children: The ICO has stated that behavioural advertising targeting children is incompatible with the Children's Code. We address this specifically: AdSense only loads after a user actively enables advertising cookies in the cookie banner (which is off by default). AdSense is configured to serve non-personalised ads only, meaning ads are targeted at page content, not individual user profiles.

Parental or guardian concerns: If a parent or guardian believes their child has created an account without appropriate consent, contact hello@gcsepython.uk and we will delete the account and all associated data within 5 working days.

Data processed by Google services (Firebase, Analytics, AdSense, Fonts) may be transferred to and stored on servers in the United States and other countries outside the UK.

Google LLC participates in the UK–US Data Bridge (approved by the UK Secretary of State on 12 October 2023), which provides an appropriate safeguard for such transfers as required by UK GDPR Article 46. You can review Google's transfer commitments in their Privacy Policy and Data Processing Addendum.

We retain personal data only for as long as necessary for the purpose for which it was collected (UK GDPR Article 5(1)(e)).

Under UK GDPR Chapter III, you have the following rights. Rights may be limited in specific circumstances, for example where we have a competing legal obligation to retain data.

To exercise any right, email hello@gcsepython.uk with the subject line "Data Rights Request". We will respond within one calendar month (UK GDPR Article 12(3)), and may ask you to verify your identity. No charge applies unless a request is manifestly unfounded or excessive.

We do not carry out automated decision-making that produces legal or similarly significant effects on individuals (UK GDPR Article 22). We do not create profiles of users for advertising, credit, employment, insurance, or any other significant purpose.

The site automatically calculates XP totals and awards badges based on your learning activity. This is an integral feature of the revision tool and has no legal or significant real-world effect on you.

We implement appropriate technical and organisational measures to protect personal data (UK GDPR Article 32), including:

• All data is transmitted over HTTPS/TLS — connections are encrypted in transit.
• Authentication and data storage are handled by Firebase (Google Cloud), which is ISO 27001 certified, SOC 2 Type II compliant, and independently audited.
• We do not store passwords — authentication is handled entirely through Google's OAuth 2.0 system.
• Access to production systems and the Firebase console is restricted to the data controller only.

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and notify affected individuals without undue delay where required by UK GDPR Article 34.

If you discover a potential security vulnerability, please report it to hello@gcsepython.uk.

We may update this policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For material changes that affect how we process your personal data or reduce your rights, we will notify registered users by email at least 14 days before the change takes effect.

Where a material change requires fresh consent, we will seek that explicitly rather than relying on existing consent or continued use of the site. Previous versions of this policy are available on request by emailing hello@gcsepython.uk.