Privacy
Last updated: 11.10.2026
In short
cpcpass.eu has no advertising and no third-party analytics such as Google Analytics. We count visits ourselves, without cookies. Fonts, images and scripts are stored on our own server, and nothing is loaded from third-party services. The free test works without an account, and then your study progress is saved only in your browser.
You only get an account when you buy full access or sign in with your email address. We then store your email address, your order and your study progress, and your browser gets a sign-in cookie that the site needs to work. Stripe handles the payment, and we never see your card details.
Who is responsible
PaweĆ Kandybowicz, Kandyb Studio, Ć»ytnia 16, lok. 8, 01-014 Warszawa, Poland. Email: support@kandyb-studio.eu. Youâll find more details in the legal notice.
Which law applies
We are based in Poland, so the EU General Data Protection Regulation (GDPR) applies to us. If you are in the UK, the UK GDPR and the Data Protection Act 2018 protect you as well. The articles we refer to below have the same numbers in the GDPR and the UK GDPR.
When you visit the website
When you open a page, your browser sends our server the data it technically needs: your IP address, the date and time, the address you requested, the amount of data transferred, the status code, the page you came from and your browserâs identifier. Without this data the server canât deliver the page.
In the access log we only store your IP address in shortened form. For IPv4 the last block is dropped, for IPv6 everything after the first three blocks. After that, the address can no longer be traced to a connection. In individual cases the error log may contain the full IP address. We delete both logs automatically after 14 days, and we only look at them to spot faults and attacks.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is running the website securely and reliably.
How we count visits
We count visits ourselves, without cookies or third-party tools. For each page you open, and for your first answer in a test, your browser sends us a short note: the page address, the language edition and where you came to cpcpass.eu from. For the source we keep only the domain name of the previous page (for example google.com) and the campaign tags in the link (utm_ parameters). If an ad link carries a Google or Facebook click ID, we only note that it was there, never the ID itself.
To tell one person from ten, the server makes a one-way hash from your IP address (shortened as in the logs), your browserâs identifier and its language. The key for that hash is generated fresh every day and deleted after two days, so hashes from different days canât be linked. We donât store the IP address or the browser identifier themselves. The notes are deleted after 90 days, and all we look at are totals: how many people visited on a given day, how many started a test, how many went on to pay and where they came from.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is knowing how many people use the site and which sources, including our own ads, bring them here.
Hosting
The website runs on a server of OVH SAS, 2 rue Kellermann, 59100 Roubaix, France, in a data centre in France. OVH processes the data listed above on our behalf under a data processing agreement in line with Art. 28 GDPR. The database of accounts, orders and progress described below is on the same server.
Your progress in the browser
The site stores your answers in the test and the questions you save in your browserâs local storage (localStorage). As long as you arenât signed in, this data is not sent to us, and we can neither see it nor restore it. You can delete it under âStudy by topicâ with âDelete progressâ, or in your browser settings. It isnât a cookie.
Your browser also remembers the language you last chose, under the key cpcpass.lang, so cpcpass.eu can take you straight to that version next time. âDelete progressâ leaves this setting in place. To remove it, clear the site data for cpcpass.eu in your browser.
We donât need your consent for this, because storing the data is strictly necessary to provide the service you asked for: a test that remembers your progress. In the UK this exemption is in paragraph 4 of Schedule A1 to the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), and in the EU in Art. 5(3) of the ePrivacy Directive 2002/58/EC.
Your account and signing in
You create an account when you buy full access or sign in on the âMy accountâ page. We then store your email address, when the account was created and when you last signed in. To sign in, we email you a six-digit code. Our database only holds a cryptographic hash of it. The code is valid for 15 minutes, and we delete it no later than an hour after it expires. Sign-in sessions work the same way: we store only a hash, not the identifier in your cookie.
The legal basis is Art. 6(1)(b) GDPR, because without this data we canât run your account or give you the access you bought. We keep the account data for as long as the account exists. If an account has no purchase and nobody has signed in to it for 12 months, we delete it automatically, together with its progress and sign-in sessions. We never delete an account automatically if a purchase was made through it. To delete it, email support@kandyb-studio.eu. We then delete your email address, your sessions and the progress saved to the account. Order records stay for as long as tax law requires (see below).
Cookies and browser storage
We use only two cookies, and both are needed for signing in and buying:
- cpcpass_s keeps you signed in. Itâs only set after you sign in or buy, and it expires after 180 days or when you sign out.
- cpcpass_co links the browser you start the payment in with your order, so youâre signed in straight away when you come back from Stripe. It is only used during payment and expires after 24 hours.
When youâre signed in, your browser also keeps the accountâs email address and the progress last matched with your account in local storage (the key cpcpass.sync.v1 plus the language code). That way an answer you deleted on one device doesnât come back from another.
After we send you a sign-in code, your browser keeps the email address in session storage for 15 minutes (key cpcpass.pending), so the code box is still there if you reload the page. Itâs removed when you sign in or close the tab.
We donât need your consent for these cookies and this storage, because they are strictly necessary to provide the service you asked for: signing in, buying and studying with an account. In the UK the exemption is in paragraph 4 of Schedule A1 to PECR. In the EU it comes from Art. 5(3) of the ePrivacy Directive 2002/58/EC, which Poland implements in Art. 399(3)(2) of its Electronic Communications Law of 12 July 2024. We donât use advertising or analytics cookies. Stripeâs own rules apply on Stripeâs payment page.
For the visit count your browser keeps the source described above in session storage (key cpcpass.src): campaign tags, the previous pageâs domain and the first page you opened. That way the source isnât lost as you move between pages, and it goes with your order if you buy. The entry contains nothing that identifies you and disappears when you close the tab.
Buying through Stripe
When you buy, you go to Stripeâs payment page and enter your email address, payment details and billing address there. Stripe uses the address to work out which countryâs VAT applies. Payments are handled by Stripe Payments Europe, Limited, Ireland. We never see or store your card details. From Stripe we receive your email address, the country of your billing address, the amount and the VAT included in it, the currency, the payment status and the paymentâs reference.
In the UK edition the purchase is sold through Link, Stripeâs merchant of record service. Link then receives the details you enter on the payment page and uses them as an independent controller: to take the payment, work out and pay the VAT, send you the receipt and invoice, prevent fraud and answer payment questions. Linkâs privacy policy applies to that. You can ask Link to delete the data from your purchase and your Link account. Stripe then also removes it from the payment records in our Stripe account, while we keep our own order record as described below.
We keep an order record: the order number, language edition, country, amount and the VAT included in it, currency, status, Stripe payment reference, dates, the version of the terms of sale, and the version and time of your consent to immediate access. The legal basis is Art. 6(1)(b) GDPR (performing the contract) and Art. 6(1)(c) GDPR, because tax law requires us to keep records of sales. We also keep the record of your consent so that, in a dispute, we can show your right to cancel ended lawfully (Art. 6(1)(f) GDPR).
With the order we also store where you came from, for example âGoogle adâ or âsearch engineâ. We add the same source, together with the campaign tag, the previous pageâs domain and the first page you opened (without parameters), to the payment in Stripe, so we can see which ads lead to purchases (Art. 6(1)(f) GDPR).
On the purchase page you can tick âEmail me one reminder if I donât finish payingâ. We then store the email address you enter (or your account address if youâre signed in) with the order and pass it to Stripe, so itâs already filled in on the payment page. The payment page is valid for 4 hours. If the payment isnât finished in that time, we send one reminder with a link that lets you go back to it for 30 days. There are no further reminders, and none at all if access has been bought in the meantime or a new payment has been started for that address. The legal basis is your request, that is, steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR). We delete the reminder address from the order after 31 days.
If you withdraw from the contract using the function on your account page, we record the content of your statement, the order number, the language, and the date and time we received it. We email you an acknowledgement, and our customer service gets a notification with the order details so they can check the withdrawal and issue the refund in Stripe. The legal basis is Art. 6(1)(c) GDPR, because consumer law requires us to acknowledge receipt, and Art. 6(1)(b) GDPR (unwinding the contract). We keep the record for as long as the order record, so that in a dispute we can show when your statement reached us (Art. 6(1)(f) GDPR).
For the payment itself, Stripe acts on our behalf under a data processing agreement. Stripe processes some data as an independent controller, for example to prevent fraud and to meet its obligations under payment services and anti-money laundering law. Stripe is responsible for that, and Stripeâs privacy policy applies. Stripe may transfer data to the USA. Stripe, LLC takes part in the EU-U.S. Data Privacy Framework and its UK Extension, which are covered by adequacy decisions under Art. 45 GDPR and the UK GDPR.
Emails with codes and confirmations
We send sign-in codes, purchase confirmations, acknowledgements of withdrawal and payment reminders you asked for through the mail server of Prociv Sp. z o.o. (Domenomania.pl), ul. Czerniawska 2A/27, 50-576 WrocĆaw, Poland. Prociv processes your email address and the content of the message on our behalf (Art. 28 GDPR). The legal basis is Art. 6(1)(b) GDPR.
Progress saved to your account
When youâre signed in, we save your study progress to your account, separately for each edition: which questions youâve answered, how you did, and which questions youâve saved. That lets you carry on studying on another device. The legal basis is Art. 6(1)(b) GDPR. Your progress is deleted along with the account.
Protection against misuse
To stop people guessing codes or flooding someoneâs inbox with emails, we count sign-in attempts and started payments. For this we store only cryptographic hashes of the IP address and the email address with the time of the attempt, and we delete them after 24 hours. The legal basis is Art. 6(1)(f) GDPR, and our legitimate interest is keeping accounts secure.
How long we keep order records
We keep order records, including the record of your consent and any withdrawal statements, for five years from the end of the year in which the tax on the sale became due (Art. 86 § 1 in conjunction with Art. 70 § 1 of the Polish Tax Ordinance, Ordynacja podatkowa).
We make a backup of the database every day on our server and delete it after 14 days. So data deleted from an account disappears from the backups no later than that.
If you email us
If you send us an email, for example using the error report link below a question, we process your email address and the content of your message so we can reply and check the question. The legal basis is Art. 6(1)(f) GDPR. We delete the message once the matter is dealt with, unless a legal obligation requires us to keep it.
Links to the App Store and Google Play
The store buttons are plain links. Only when you tap one does the Apple or Google page open, and from then on their privacy policies apply. Purchases in the app are handled only by Apple or Google. The app has its own privacy policy.
Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing (Art. 21). To use any of them, write to us at support@kandyb-studio.eu.
You can also complain to a data protection authority. In the UK thatâs the Information Commissionerâs Office (ICO), which you can reach through ico.org.uk. In the EU, the authority responsible for us is the President of the Personal Data Protection Office in Poland (Prezes UrzÄdu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa. If you live in another EU country, you can also go to the authority there.
Your right to object
We process the server logs, your emails, the protection against misuse, the record of your consent when you buy and the record of withdrawal statements on the basis of our legitimate interests (Art. 6(1)(f) GDPR). You can object to this at any time on grounds relating to your particular situation (Art. 21(1) GDPR). We will then stop processing the data unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims. A short email to support@kandyb-studio.eu is enough.
Changes
If anything changes on the website that matters for data protection, we update this page and the date at the top.