Privacy Policy - Security Manager Pro

📋 Overview

ClayNova Ltd ("we", "our", "us") operates Security Manager Pro. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our security management training platform.

Data Controller: ClayNova Ltd, Registered in Scotland (SC853478)

Contact: support@claynova.com

🍪 Cookie Policy

We use cookies to understand how visitors use our website. Your privacy is important to us, so we ask for your consent before setting any optional cookies.

Your Cookie Choices

Essential Cookies: Required for the website to function properly (login sessions, activation codes, security). These do not require consent.
Analytics Cookies: Optional cookies from Google Analytics that help us understand how visitors use our site. Only loaded if you accept.

You can change your cookie preferences at any time by clicking Cookie Settings (this will return you to the homepage to set new preferences).

Cookies We Use

Cookie Name	Purpose	Duration	Type
`smp_cookie_consent`	Stores your cookie preference decision	1 year	Essential
`smp_session_token`	Keeps you logged in securely	Session	Essential
`smp_newsletter_discount`	Remembers if you earned a discount code	Persistent	Functional
`_ga, _gid, _gat`	Google Analytics - tracks anonymous usage patterns	2 years / 24 hours / 1 minute	Analytics (Optional)

            Legal Basis: We process analytics cookies based on your explicit consent 
            (UK PECR Regulation 6(1)). Essential cookies are processed under legitimate interest 
            for service delivery (GDPR Article 6(1)(f)).
        

How to Manage Cookies

You can control cookies in three ways:

Our Cookie Banner: Accept or decline when you first visit our site
Cookie Settings Link: Available in the footer of every page
Browser Settings: Most browsers allow you to refuse or delete cookies

Note: Blocking essential cookies will prevent you from logging in and using the exam simulator.

📊 Information We Collect

Account Information

When you purchase and activate Security Manager Pro, we collect:

Email address: For account creation, access code delivery, and support
Password: Hashed and securely stored (we cannot see your plain-text password)
Purchase information: Transaction ID, purchase date, licence status
Access code: Unique activation code linked to your purchase

Usage Data

When you use the exam simulator, we collect:

Questions answered and performance metrics
Competency-based scores and progress tracking
Study session durations and timestamps
Browser and device type (for compatibility purposes only)

Analytics Data (Only if You Consent)

If you accept cookies, we collect anonymous analytics via Google Analytics:

Page views and navigation patterns
Time spent on different sections
Geographic region (country-level only)
Referral sources

Note: Analytics data is anonymized and cannot identify you personally.

🔒 How We Use Your Information

We use your information for the following purposes:

Service Delivery (Legal Basis: Contract Performance - GDPR Art. 6(1)(b))

Deliver your access code and activate your account
Provide access to exam questions and adaptive testing
Track your progress and performance across domains
Generate personalized analytics and recommendations

Communication (Legal Basis: Contract Performance & Legitimate Interest)

Send transactional emails (access codes, password resets, licence expiry)
Provide customer support responses
Send exam tips if you subscribe to our newsletter (consent-based)

Product Improvement (Legal Basis: Legitimate Interest - GDPR Art. 6(1)(f))

Analyze aggregate usage patterns to improve question quality
Identify technical issues and optimize performance
Develop new features based on user behavior

Fraud Prevention (Legal Basis: Legitimate Interest)

Detect and prevent unauthorized account access
Monitor for suspicious activation patterns
Protect against payment fraud

🔐 Data Security

We implement industry-standard security measures to protect your data:

Encryption: All data transmitted over HTTPS/TLS encryption
Password Security: Passwords hashed with bcrypt (industry standard)
Multi-Factor Authentication: Optional 2FA for enhanced account security
Access Controls: Strict internal access policies and audit logs
Regular Updates: Security patches applied promptly

            Important: No method of transmission over the internet is 100% secure. 
            While we strive to protect your data, we cannot guarantee absolute security.
        

🤝 Data Sharing

We do not sell your personal data. We only share data with:

Service Providers

Stripe: Payment processing (they handle card details, not us)
Microsoft Azure: Cloud hosting and database services
Postmark: Transactional email delivery (access codes, notifications)
Google Analytics: Anonymous usage analytics (only if you consent)

All service providers are GDPR-compliant and bound by data processing agreements.

Legal Requirements

We may disclose your information if required by law, court order, or to protect our legal rights and safety.

🌍 International Data Transfers

Your data is primarily stored in Microsoft Azure data centers within the UK/EU. Some service providers (e.g., Google Analytics) may transfer data to the United States under appropriate safeguards (Standard Contractual Clauses).

⏱️ Data Retention

Active Accounts: Data retained while your licence is active
Expired Licences: Account data retained for 2 years, then anonymized
Newsletter Subscribers: Retained until you unsubscribe
Analytics Data: Google Analytics retention set to 14 months
Support Tickets: Retained for 3 years for legal compliance

✅ Your Rights (GDPR & UK GDPR)

You have the following rights regarding your personal data:

Right to Access (Art. 15)

Request a copy of all personal data we hold about you.

Right to Rectification (Art. 16)

Correct inaccurate or incomplete data (you can update email/password in-app).

Right to Erasure / "Right to be Forgotten" (Art. 17)

Request deletion of your account and associated data. Note: We may retain transaction records for legal/tax purposes (6 years under UK law).

Right to Restriction of Processing (Art. 18)

Request we stop processing your data while disputes are resolved.

Right to Data Portability (Art. 20)

Receive your data in a machine-readable format (JSON export available).

Right to Object (Art. 21)

Object to processing based on legitimate interests (e.g., direct marketing).

Right to Withdraw Consent

Withdraw cookie consent or newsletter consent at any time (doesn't affect lawfulness of processing before withdrawal).

            To Exercise Your Rights: Email support@claynova.com with 
            "Data Rights Request" in the subject line. We'll respond within 30 days.
        

👶 Children's Privacy

Security Manager Pro is intended for professional adults preparing for certification exams. We do not knowingly collect data from anyone under 16 years of age. If you believe a child has provided us with personal data, contact us immediately.

🔔 Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last Updated" date. Material changes will be communicated via email to active users.

Your continued use of Security Manager Pro after changes indicates acceptance of the updated policy.

📧 Contact & Complaints

Data Controller: ClayNova Ltd

Email: support@claynova.com

Registered Address: Scotland (SC853478)

Right to Complain

If you believe we've mishandled your data, you have the right to lodge a complaint with:

Information Commissioner's Office (ICO)
Website: ico.org.uk
Telephone: 0303 123 1113