Privacy Policy
Last updated: 7 November 2026
This policy explains what personal data SMSTS Mock Test collects, why, who else handles it and what your rights are under UK data protection law (the UK GDPR and the Data Protection Act 2018). It covers smstsmocktest.co.uk and the account, mock and payment features that run on it.
SMSTS Mock Test is an independent practice site. We are not CITB, our mocks contain no real CITB questions, and we never receive data from CITB or from your training provider.
1. Who we are
SMSTS Mock Test ("we", "us"), 104 Cunnery Rd, Manchester, United Kingdom, is the controller of the personal data described here. Email: [email protected].
2. What we collect and when
2.1 When you practise without an account
- A random practice ID. When you start a mock, your browser keeps a random code. It is sent to our account service with each attempt so we can count your free mocks. It is not your name and does not identify you on its own.
- Your mock activity: which mock or drill you started, the questions served, the answers you gave, your score and the times you started and finished.
- Your IP address and a bot check. Anonymous mock starts pass a Cloudflare Turnstile check to stop automated abuse, which means your IP address is processed.
- A one-way device hash. When you start a mock or drill without an account, the site sends a one-way device hash to our account service to count free use per device. It is made from your screen size, time zone, graphics card and a canvas drawing, and holds no name or contact details.
2.2 When you create an account
- Your email address and a password. We send you an email to confirm your address. A confirmed address gives you more free mocks each week.
- Account records: the date you joined, whether your email is confirmed, and any plan you hold.
- Your progress: your mock and drill attempts, answers and scores, so you can review them later.
- Account emails we send you: confirmation, login and password reset emails, and receipts if you pay. We do not send marketing emails.
2.3 When you pay
Paid plans are taken through PayPal on its own secure checkout page. PayPal collects your payment details, and we never see or store your full card number. PayPal tells us the amount, date, plan, the email used and whether the payment succeeded.
2.4 When you email us
Your email address, your name if you give it, and what you write. If you report a question, we keep the report with the question so we can track the fix.
2.5 Collected automatically
- Server logs. Our hosting records each request: IP address, the page asked for, the date and time, browser type and the referring page. We use these to keep the site running and secure.
- Analytics, only if you press Accept. See section 5.
3. How we use your data and our lawful bases
| What we do | Data used | Lawful basis |
|---|---|---|
| Run mocks and drills, save your progress and show your results | Practice ID, account, mock activity | Contract |
| Count free mocks and keep the free limits fair | Practice ID, account, mock activity | Legitimate interests |
| Stop bots and abuse | IP address, device hash, Turnstile check, server logs | Legitimate interests (security) |
| Take payment and give you paid access | PayPal payment details, account | Contract |
| Keep payment and tax records | Payment records | Legal obligation |
| Answer your emails and fix reported questions | Your message and email address | Legitimate interests |
| Send account emails | Email address | Contract |
| Improve questions, for example spotting a question most people get wrong | Answer data, looked at in total | Legitimate interests |
| Measure visits with analytics | Analytics data (section 5) | Consent |
Where we rely on legitimate interests, we have weighed them against your rights, and you can object at any time (section 8).
Your mock score is worked out automatically. It is practice only and has no effect outside this site.
4. Who handles your data for us
| Provider | What it does | Data involved |
|---|---|---|
| Accounts Hub (our account service) | Logins, practice IDs, free mock counts, the mock engine, progress records, starting payments | Account, practice ID, mock activity, IP address |
| PayPal | Payments, subscriptions and receipts | Payment details, email, plan |
| Cloudflare | The Turnstile bot check | IP address, request details, browser signals for the check |
| Our hosting provider | Running the server for the website | Server logs |
| Our analytics provider, only after you press Accept | Measuring visits | Analytics data (section 5) |
PayPal and Cloudflare may also act as independent controllers for some of their own purposes, such as fraud prevention. Their privacy notices explain this.
We may share data if the law requires it, or to protect our rights or users' safety. We do not sell your data, and we do not share it for advertising. We do not pass your details to training providers.
5. Analytics
Analytics count visits and show which pages and mocks are used. Nothing from the analytics service loads until you press Accept on the cookie banner. If you press Reject, or ignore the banner, it is never loaded. Analytics do not receive your name, your email address or your individual answers.
You can change your choice at any time on our Cookie Policy page.
6. International transfers
Some of our providers may process data outside the UK. Where they do, the transfer is protected by a safeguard UK law recognises, such as UK adequacy regulations or the UK International Data Transfer Agreement.
7. How long we keep data
- Anonymous practice data: only as long as we need it to count free mocks and keep the service secure.
- Account and progress data: while your account is open. When you ask us to close it, we delete it, except records the law requires us to keep.
- Payment records: as long as UK tax law requires.
- Emails you send us: as long as we need them to deal with your message. A question report may stay with the question, with your email address removed once the matter is closed.
8. Your rights
Under UK data protection law you have the right to:
- access a copy of the data we hold about you
- correct data that is wrong
- delete your data
- restrict how we use it
- object to uses based on legitimate interests
- take your data with you (portability), for data you gave us under a contract or consent
- withdraw consent at any time, for example for analytics
To use any of these, email [email protected] from the address on your account. If you practised without an account, tell us the dates and rough times you used the site. We may ask you to confirm who you are. We reply within one month, and the request is free.
If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk.
9. Who the site is for
The site is for people preparing for the SMSTS or SMSTS-R exam, who are site managers or about to become one. If you think a child has given us data, email us and we will delete it.
10. Data stored in your browser
Some features keep data in your own browser rather than on our servers, such as your cookie choice, a mock in progress and your login. Our Cookie Policy explains each type. You can delete them at any time by clearing this site's data in your browser.
11. Security
Every page uses HTTPS, access to personal data is limited to the people who need it, and payment details go to PayPal and never reach our systems. If a breach puts your data at risk, we will tell you and the ICO as the law requires.
12. Links to other sites
We link to CITB, CSCS, HSE, legislation.gov.uk and others. Their own privacy notices apply once you leave our site.
13. Changes to this policy
When we change this policy, we update the "Last updated" date at the top. If a change affects how we use data you have already given us, we will tell account holders by email before it takes effect.
14. Contact
Email [email protected].
By using SMSTS Mock Test you acknowledge that you have read this Privacy Policy.