Privacy Policy

1. Who is responsible for your information

LW SQE 26 is run by David FitzGerald as an individual. David FitzGerald is the data controller and is registered with the Information Commissioner's Office under registration number CSN3051856.

For privacy questions or requests, email davidfitzgerald1579@gmail.com.

2. Information the site uses

The site deliberately collects less information than is typical for an online service. It uses:

• your Gmail address, Google account identifier and display name when you sign in;
• whether your address was approved directly or through an invitation, plus access, revocation and invitation timestamps;
• secure session records, stored using one-way token hashes, with creation, activity and expiry times; and
• daily aggregate totals for successful sign-ins, homepage views, timeline views and planner downloads. These totals have no member identifier attached, and the owner's activity is excluded.

The application does not store IP addresses, device details, browser user-agent strings or person-level browsing histories. Hosting and network providers may process technical connection information in their own operational logs to deliver and secure the service.

3. How information is obtained

Information comes from Google when you choose Google sign-in, from the administrator when an address is approved, from you when an invitation code is redeemed, and from your basic use of the portal.

4. Why information is used

The information is used to:

• confirm that only approved Gmail accounts can enter;
• operate invitation codes, sessions and immediate access revocation;
• protect the portal and its private study resources; and
• understand overall use through anonymous aggregate totals.

The lawful basis is legitimate interests: the practical need to run a secure, invitation-only educational resource hub and understand whether its core resources are being used. The data collected is kept to the minimum needed for those purposes. There is no advertising, sale of personal data, profiling or automated decision-making.

5. Cookies and Google sign-in

After a successful sign-in, the site places one strictly necessary, secure session cookie in your browser. It is HTTP-only, uses SameSite=Lax and expires after no more than 12 hours, with an idle limit of two hours. It is needed to keep private pages and downloads protected.

The sign-in page loads Google Identity Services. Google may process information under its own Privacy Policy (opens in a new tab). LW SQE 26 does not use advertising or optional analytics cookies.

6. Who information is shared with

Personal information is not sold. It is made available only to the administrator where needed to manage access, and to service providers that host, secure or authenticate the site, including the hosting and database provider and Google for sign-in. They process information to provide those services.

7. International processing

Google and the hosting provider may process information outside the United Kingdom. Such processing must rely on an applicable adequacy regulation or another lawful safeguard, such as approved contractual clauses, where required. Contact the controller if you would like more information about the safeguards relevant to your data.

8. How long information is kept

• Session access expires after no more than 12 hours and can be ended sooner by signing out or revocation.
• Member and access records are kept while access is active and afterwards only while reasonably needed for security, administration or handling a request.
• Invitation records are kept only while needed to prevent reuse and review how access was granted.
• Daily aggregate usage totals contain no member identifier and may be retained to understand the service over time.

Records are deleted or anonymised when they are no longer needed for these purposes.

9. Your data protection rights

Depending on the circumstances, you may ask for access to your personal data, correction, deletion, restriction, portability, or object to its use. You may also ask for your portal access and account record to be removed. There is normally no fee, and a response is normally provided within one month.

You can also complain to the Information Commissioner's Office (opens in a new tab). Please consider contacting the controller first so there is an opportunity to resolve the concern.

10. Changes to this notice

This notice will be updated if the site starts using information in a materially different way. The current version and its update date will remain available at this address.