Privacy
Privacy notice
What we hold about you, why, on what basis and for how long. It is a short list.
This notice explains what we hold about you, why, and what you can do about it. It is short because we hold very little: we are selling study material, not building a profile of you.
Who is responsible for your data
| Trading name | The Arch |
|---|---|
| Postal address | Not yet published — please write to us by email and we will give it to you |
| thearchdental@gmail.com — answered by a person |
What we hold
| What | Why | Lawful basis | How long |
|---|---|---|---|
| Your email address | To open your account, send your login and answer you | Performance of the contract | While you have an account, then 6 years for tax records of the sale |
| Your password | To sign you in. It is held by Google Firebase Authentication as a hash — we never see it and cannot recover it | Performance of the contract | While you have an account |
| Your progress: answers, scores, flags, bookmarks, notes, exam date | To show you where you are up to and which subjects are weakest | Performance of the contract | Until you ask us to delete it, or the account is closed |
| Which device signed in last | To enforce one account, one device at a time | Legitimate interests — preventing account sharing | While you have an account |
| Your messages to us | To answer them | Legitimate interests — replying to you | 2 years |
| Your name and mobile number, when you buy | To set your account up in your name, and so we can reach you about your purchase if an email does not get through. Both are required at checkout; neither is used for marketing you have not asked for | Performance of the contract | While you have an account, then 6 years for tax records of the sale |
| Your phone number, if you join the WhatsApp study group | To add you to the group. Joining is optional and you can leave at any time. Members of a WhatsApp group can see each other's numbers — that is how WhatsApp works, and it is worth knowing before you join | Consent — you ask to be added | Until you leave the group or ask us to remove you |
| A record of your payment | Because we have to keep it | Legal obligation — tax law | 6 years |
| Whether you accepted cookies, and if you did, what you did on the site | To see which adverts and which pages actually bring candidates to the free mock | Consent — you can withdraw it on the cookies page at any time | Up to 2 years, or until you withdraw |
What we do not do
- We set no cookies unless you have agreed to them, and if you have not, there is no advertising, analytics or third-party tracking on this site. See the cookies page for what changes if you do agree, and how to change your mind.
- We do not sell, rent or share your details with anyone for marketing.
- We do not send marketing email unless you have asked for it, and every one has an unsubscribe link.
- We never see your card details. Payment is taken on the payment provider's own page.
Who processes data for us
A small number of suppliers handle data on our instructions, under contract, and for no purpose of their own.
| Supplier | What they do | Where |
|---|---|---|
| Google Firebase (Google Cloud EMEA / Google LLC) | Sign-in and the database holding your account and progress | European Union |
| Netlify | Serves the website and runs the small functions behind the free trial | United States, under the UK extension to the EU-US Data Privacy Framework |
| The payment provider shown at checkout | Takes the payment and confirms it to us. They are a controller in their own right for the payment itself and have their own privacy notice | Shown on their checkout page |
| WhatsApp (Meta) | Carries the study group, if you choose to join it. Meta is a controller in its own right for what it does with your account and has its own privacy notice | Ireland, for users in the UK and Europe |
| Google (Google Analytics) | Counts visits and reports which pages are read. Only if you accepted | European Union, and the United States under the UK extension to the EU-US Data Privacy Framework |
| Meta | Reports which of our adverts led to a free mock or a trial request. Only if you accepted. Meta is a controller in its own right for what it does with the data and has its own privacy notice | Ireland for users in the UK and Europe, and the United States under the same framework |
Where data is handled outside the UK it is covered either by UK adequacy regulations or by the International Data Transfer Addendum to the standard contractual clauses.
Your rights
You can ask us for a copy of what we hold, to correct it, to delete it, to restrict what we do with it, to have it sent to you in a portable form, and to object to processing we do on the basis of legitimate interests. Ask by email and we will answer within one month, free.
If you think we have got it wrong, please tell us so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Security
The site is served over HTTPS only. Passwords are hashed by Firebase Authentication and are not visible to us. Access to the material is checked on the server for every request rather than hidden in the page, so an expired account cannot read it by fiddling with the browser. No system is perfect; if we ever have a breach that is likely to put you at risk we will tell you and the ICO, as the law requires.
Because course access is personal to one account, we record the country each sign-in comes from and the time of it, so we can spot a single login being shared across countries. We use this only to protect against account sharing — we do not use it to track your movements and we do not sell it.
Children
This is material for qualified dentists. It is not intended for under-18s and we do not knowingly hold data about them.