Privacy Notice (UK GDPR & DPA 2018)
Last updated: 3 September 2026
1. Who We Are & Scope
FRCR Physics Ltd is the data controller for personal data used to operate FRCR Physics. We process personal data under the UK GDPR and Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. This notice covers the public website, registered question-bank service, surveys, support portal, email service, community/leaderboard features, purchases and administration of access.
2. Personal Data We Process
We may process:
• Identity/contact data: name, registered email address and account identifiers.
• Account/access data: access tier, purchase/access dates, exam date and profile settings.
• Study data: question IDs attempted, selected answers, correctness, timestamps, flags/review state, mock scores, mastery/subject statistics, streaks, badges, score projections and reported exam outcomes.
• Survey/feedback data: pre-use and post-exam answers, including reported exam score/pass outcome, survey-reward entitlement and optional free-text feedback. Free-text fields that an administrator marks as testimonial fields may be copied into a separate publication-review record while the original response is preserved.
• Community data: opt-in status, chosen nickname/avatar and leaderboard/community statistics.
• Email data: reminder preferences/timezone, email queue/delivery state, unsubscribe state, bounces and complaints.
• Support data: support-ticket content, in-portal support replies, the latest unread support notification, related transactional-email delivery records and account-deletion status attached to existing tickets. A failed/rejected cooling-off refund may automatically create a billing support ticket linked to your account so the refund/access error can be resolved.
• Billing/contract data: Paddle customer/transaction/price identifiers, purchase status, private survey-reward entitlement, immediate-digital-access acknowledgement, checkout IP/user-agent evidence and first post-purchase question access. We do not receive or store full card details.
• Technical/security data: session identifiers, browser/device information, timestamps, IP address where needed for security/contract evidence, application logs and anti-abuse signals used by Firebase App Check / reCAPTCHA Enterprise.
3. Why We Use Personal Data & Lawful Bases
We use personal data where necessary to perform our contract with you (account access, study tracking, adaptive practice, mocks, progress analytics and purchased access); to comply with legal obligations (including tax/accounting and data-protection obligations); for legitimate interests such as service security, support, fraud/payment-dispute handling, product improvement, question-quality monitoring and non-significant learning analytics; and, where required, on the basis of consent (for example configurable study reminder emails and any non-essential storage that requires consent). We keep an immediate-digital-access acknowledgement and first-use timestamp to evidence when digital content was supplied and to administer statutory cancellation/refund rights.
4. Profiling, Predictions & Adaptive Learning
The service uses automated calculations to prioritise revision questions, identify weaker subjects, calculate mastery, recommend review, award badges and estimate an exam score/readiness range. These outputs are educational recommendations and do not make legal or similarly significant decisions about you. They may be inaccurate and do not determine your eligibility to sit or pass an RCR examination.
5. Service Providers, Merchant of Record & International Processing
We do not sell or rent personal data to third-party marketers. We use service providers needed to operate the platform, including Google Firebase/Google Cloud for authentication, hosting, database/storage and server workloads; Firebase App Check with reCAPTCHA Enterprise for automated abuse protection; Amazon SES for email delivery; and Paddle as Merchant of Record/payment platform. reCAPTCHA Enterprise may process browser/device, network and interaction signals (including IP address and related technical identifiers) to assess whether traffic is genuine or abusive, subject to Google's applicable terms and privacy information. Some processing may occur outside the UK depending on the configured cloud service and provider infrastructure. Where UK personal data is transferred internationally, we rely on the provider's applicable transfer mechanism and contractual safeguards. Paddle separately processes buyer/payment data under its own privacy notice and buyer terms.
6. Retention & Deletion
We keep identifiable personal data only for as long as it is needed for the stated purpose. Active study/profile data is normally retained while the account is active and then deleted/anonymised in accordance with our retention schedule and account-deletion process. Purchase, tax, contract, fraud/chargeback and associated evidence may normally be retained for up to seven years where needed for accounting, legal-claims or regulatory purposes; a longer period is used only where a specific legal obligation, dispute or preservation requirement justifies it. Support records may be retained after account deletion where necessary to preserve the correspondence/audit record; the ticket is flagged to show that the requester account has been deleted. Temporary rendered email images are replaced by the latest user-specific images, while reusable equation assets may be retained as non-user-specific cached application assets.
7. Surveys, Feedback & Testimonials
Survey completion rewards are provided for completing an eligible survey and are not conditional on positive feedback. Optional free-text survey fields may be designated as testimonial fields. We may select feedback for publication on the FRCR Physics website or in marketing materials. If published, the user is identified only by initials and country. We may edit published feedback for length or clarity, but we will not change its meaning. The original submitted response is retained with the survey record and the publication-review copy keeps the original wording.
8. Your Data Protection Rights
Depending on the circumstances, you may have rights of access, rectification, erasure, restriction, objection and data portability, and the right to complain to the Information Commissioner's Office (ICO). To make a data-protection request, raise a Support Centre ticket and identify the right you wish to exercise. We may ask for information reasonably needed to verify identity. A subject-access response will provide your personal information and supplementary information, but does not entitle you to proprietary question-bank wording, explanations or other users' data. We aim to acknowledge data-protection complaints and rights requests promptly and no later than 30 days after receipt; valid rights requests are normally completed within one month, subject to lawful extensions or exemptions.