Privacy Notice

1. Who we are

CM Marine Limited ("CM Marine", "we", "us") operates the CM Marine Part A exam preparation service. CM Marine Limited is the data controller for the personal data described in this notice and decides how and why that data is processed. You can contact us about privacy at hello@cm-marine.uk.

2. Personal data we collect

• Account data — name (if provided), email address and login credentials (passwords are stored only as salted hashes by our authentication provider).
• Learning data — questions attempted, answers selected, mock exam scores and progress history.
• Subscription data — your subscription status, plan, renewal dates and the customer reference issued by our payments provider. We do not receive or store your card details.
• Support data — messages and attachments you send us.
• Technical data — IP address, device and browser information, and basic usage/telemetry logs.

3. Why we use it, and our legal basis

• Creating and administering your account, and providing the service — performance of a contract.
• Recording your progress and exam results so you can track improvement — performance of a contract.
• Managing subscriptions, access rights and invoicing — performance of a contract and legal obligation.
• Security, fraud prevention and abuse monitoring — legitimate interests in keeping the service safe.
• Improving question quality and the product — legitimate interests in developing our service.
• Responding to support requests — performance of a contract and legitimate interests.
• Optional marketing emails about CM Marine training — consent, which you can withdraw at any time.

4. Who we share data with

• Service providers / subprocessors — hosting, database, authentication and email delivery providers who process data on our instructions.
• Merchant of Record — Paddle.com Market Limited acts as our reseller and Merchant of Record for the sale of subscriptions, and handles payments, subscription management, tax compliance, invoicing and refunds.
• Professional advisers — legal, accounting and audit advisers where necessary.
• Authorities — where we are required to disclose by law or to establish or defend legal claims.

We do not sell your personal data.

5. International transfers

Some of our providers process data outside the UK and EEA. Where that happens we rely on UK/EU adequacy decisions or on standard contractual clauses together with the UK International Data Transfer Addendum, plus appropriate technical safeguards.

6. How long we keep it

Account and learning data is kept while your account is active and for up to 12 months after closure, so you can reactivate without losing progress. Records relating to purchases are kept for up to 7 years to meet tax and accounting obligations. Support correspondence is kept for up to 3 years. After these periods data is deleted or anonymised.

7. Your rights

Under UK GDPR you have the right to access your data, have inaccurate data corrected, request erasure, restrict or object to processing, request portability, and withdraw consent where processing is based on consent. Email hello@cm-marine.uk and we will respond within one month. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk).

8. Security

We use appropriate technical and organisational measures, including encryption in transit, row-level access controls on our database, hashed credentials and restricted administrative access. No system is completely secure, but we review our controls regularly.

9. Cookies

We use strictly necessary cookies and similar local storage to keep you signed in and to secure the service. Our payments provider may set cookies needed to complete a checkout. We do not use advertising cookies. You can clear or block cookies in your browser, though sign-in will not work without the essential ones.

10. Changes

We may update this notice from time to time. Material changes will be notified by email or in the app before they take effect.