Privacy notice
Last updated: 10th July 2026
What does this notice cover?
This notice describes how we, the operator of pastpapers.com (the “Site”), will make use of your personal data when you use the Site and its associated features. We are in charge of what happens to your personal data, which means we are the data controller for data protection purposes.
This notice also describes your data protection rights, including the right to object to some of the processing which we carry out. More information about your rights, and how to exercise them, is set out in the “Your choices and rights” section.
We may also provide you with additional information when we collect personal data, where we feel it would be helpful to provide relevant and timely information.
Contact us
If you have questions about this privacy notice, or wish to contact us for any reason in relation to our personal data processing, please contact our privacy team at contact@pastpapers.com.
Personal data we may collect about you
We collect and process personal data about you when you interact with us and the Site. Browsing past papers and mark schemes does not require an account; some data is only collected if you choose to create one. This includes:
| Category | Details |
|---|---|
| Account Information | Your name, email address, username and password. You provide this only if you choose to create an account so you can save your work. Browsing past papers and mark schemes does not require an account. |
| Marketing Information | Your marketing preferences, including any consents you have given us. |
| Device and Usage Information | Device Information - information related to the browser or device you use to access the Site, primarily the internet browser or mobile device you use, the website or source that linked or referred you to the Site, your IP address or device ID (or other identifier that identifies your computer or mobile device on the Internet) from which we may derive your general location, the operating system of your computer or mobile device, device screen size and other similar technical information. Usage Information - information about your visit to and interactions with the Site, including the content viewed and interacted with, the dates and times of access, and hardware, software and device event information. |
| Saved Content | Annotations, notes and saved workspaces that you create or store on the Site while signed in, together with any papers you choose to share. |
Some of this personal data (for example, Device and Usage Information) is collected using cookies and related technologies, as described in the “Cookies and similar technologies” section below.
If you choose to sign in using a third-party service (such as Google), we receive your name and email address from that service in order to create and operate your account. pastpapers.com is free to use, and we do not process your credit card or debit card information.
Cookies and similar technologies
We use a small number of strictly necessary technologies to make the Site work: keeping you signed in to your account, remembering your display preferences (such as dark mode), and remembering the cookie choice you have made. These are always active because the Site cannot function without them.
We also use optional analytics cookies (provided by PostHog, and hosted in the EU) to understand how the Site is used and to improve it. These are only set if you accept them via the cookie banner. If you decline, analytics runs without storing anything on your device and without tracking you across visits. You can change your choice at any time using the “Cookie choices” link in the footer of every page.
We use an error-monitoring service (Sentry, hosted in the EU) to detect faults with the Site. It does not set cookies or store identifiers on your device.
Please avoid saving special category or sensitive personal data (such as health data, biometric data, or data revealing racial or ethnic origin, political opinions, or religious or philosophical beliefs) in notes or annotations on the Site. If you include personal data about other people in content you save, you must ensure that you have obtained any necessary permissions or consents to do so.
How do we use this information, and what is the legal basis for this use?
We will only use your personal data for the purposes and legal bases set out below:
| Purpose | Legal Basis | Personal Data |
|---|---|---|
| To register and create an account, and to provide you with the Site and its features (including saving your annotations and workspaces). This includes sending you service related messages. | It is necessary for us to process your personal data in order to perform our contract with you, or to take steps at your request prior to entering into a contract with you. | Account Information, Saved Content, Device and Usage Information |
| To ensure the security of your account and the Site. | We have a legitimate interest in ensuring the security of our Site and data. | Account Information, Device and Usage Information |
| To manage our relationship with you. This includes providing user support, responding to your queries and investigating any complaints about the Site. | We have a legitimate interest in managing our business and providing services to our users. | Account Information, Device and Usage Information |
| To analyse your use and the effectiveness of the Site using analytics cookies. | Your consent, which we ask for via the cookie banner and which you can withdraw at any time. | Device and Usage Information |
| To monitor accounts to prevent, investigate and/or report fraud, terrorism, misrepresentation, security incidents or crime, and to ensure compliance with applicable policies and procedures, in accordance with applicable law. | We have a legal obligation. We have a legitimate interest in preventing and detecting fraud or other wrongdoing. Where it is necessary to process personal data to prevent, detect or investigate a crime, we rely on our recognised legitimate interests. | Account Information, Device and Usage Information |
| To process your personal information in connection with legal claims, compliance, regulatory, auditing, investigative and disciplinary purposes (including disclosure in connection with legal process or litigation). | We have a legitimate interest in protecting our business interests and legal rights. This is a recognised legitimate interest when we do this to prevent, detect or investigate a crime. | Account Information, Device and Usage Information |
| To send you direct marketing about the Site and our related products and services. We do not show targeted advertising and we do not sell your personal data. | Your consent, which you can withdraw at any time. | Account Information |
| To manage and operate the Site, including to keep it updated and relevant, and to develop our business. | We have a legitimate interest in operating the Site and improving its operation. | Account Information, Device and Usage Information |
| To create aggregated and statistical data about how the Site is used, which does not identify you. | We have a legitimate interest in understanding the usage and characteristics of the Site's users. | Device and Usage Information |
| To respond to requests by governments, law enforcement or regulators. | We have a legal obligation. We have a legitimate interest in cooperating with legal investigations and enquiries. | Account Information |
| To invite you to take part in and manage customer surveys, reviews and market research activities carried out by us and by other organisations on our behalf. | Your consent, which you can withdraw at any time. | Account Information |
There are instances where we have a legitimate interest to use your data. Our legitimate interest will vary depending on what we are using your data for, and we explain above what the interest is and how it relates to the processing operations that we are carrying out.
How we share your personal data
We may share your data with the following categories of recipients:
| Personal Data Category | Category of Recipient | Why? |
|---|---|---|
| All categories | Third party service providers | We engage other companies and individuals to manage or support certain aspects of our business on our behalf. Examples include hosting and maintaining the Site, analytics (only where you have consented), error monitoring, sending emails, providing customer service, and providing professional services such as auditing, consulting and legal services. |
| Account Information, Saved Content | Parents, guardians | Account Information and Saved Content may be shared with your parents or guardians upon their request (if you are under 18). |
| All categories | Credit reference, law enforcement and fraud prevention agencies | To prevent, investigate and/or report fraud, terrorism, misrepresentation, security incidents or crime, in accordance with applicable law. |
| All categories | Prospective Buyer/Seller | In the event that the business is sold or integrated with another business, your details will be disclosed to our advisers and any prospective purchaser's advisers, and will be passed to the new owners of the business. |
Where we transfer your personal data
Personal data that we collect from you may be transferred to and stored at a destination outside the UK, including in the US. Where these transfers are to countries not approved by UK regulations, we ensure appropriate safeguards are in place to protect the transfer of your personal data to these countries. When transferring your personal data we may rely on decisions of adequacy by the UK Government or on appropriate safeguards such as the UK Addendum to the EU standard contractual clauses.
A copy of the relevant mechanism can be obtained for your review on request by using the contact details above.
Children
The Site is a study resource used by students, including students under 18, so we apply high privacy standards by default. We do not show targeted advertising, we do not sell personal data, we do not profile visitors who have not created an account, and optional analytics only runs if you choose to accept it via the cookie banner.
If you are under 13, please do not create an account or send us any personal information. If we discover that we have collected personal data from a child under 13, we will delete it. If you are a parent or guardian and have any questions or concerns about your child’s use of the Site, please contact us at contact@pastpapers.com.
Your choices and rights
You have the following rights:
| Right | Summary |
|---|---|
| The right of access | Enables you to receive a copy of your personal data. |
| The right to rectification | Enables you to correct any inaccurate or incomplete personal data we hold about you. |
| The right to erasure | Enables you to ask us to delete your personal data in certain circumstances. |
| The right to restrict processing | Enables you to ask us to halt the processing of your personal data in certain circumstances. |
| The right to object | Enables you to object to us processing your personal data on the basis of our legitimate interests (or those of a third party), including processing for direct marketing purposes, and we will cease processing your personal data unless the processing is based on compelling legitimate grounds or is needed for the exercise or defence of legal claims. |
| The right to data portability | Enables you to request that we transmit personal data you have provided to us to a third party without hindrance, or to give you a copy of it so that you can transmit it to a third party, where technically feasible. |
These rights may be limited, for example if fulfilling your request would reveal personal data about another person, or if you ask us to delete information which we are required by law, or have compelling legitimate interests, to keep.
If you wish to exercise any of these rights, please contact us using the details set out in the “Contact us” section.
Wherever we rely on your consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. We may however have other legal grounds for processing your data for other purposes, such as those set out above.
We will only send you direct marketing where you have consented to receive it. You can opt out at any time by following the unsubscribe instructions in the relevant message, or by contacting us using the details set out in the “Contact us” section.
We do not use your personal data to make any solely automated decisions, including profiling, which produce legal or similarly significant effects.
Where we need to collect your personal data by law, or under the terms of a contract we have with you, and you fail to provide that personal data when requested, we may not be able to provide our services to you. In this case, we may have to cancel the supply of a service, but we will notify you if this is the case at the time. The provision of all other information is optional.
How to complain
If you have any concerns about our use of your personal data, you have the right to make a complaint via the details in the “Contact us” section. If you remain unhappy with how we have used your personal data after raising a complaint with us, you can also complain to the ICO:
Information Commissioner’s OfficeWycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint
How long do we keep your personal data?
Where we process Account Information, we do this for as long as you are an active user of the Site and for 6 years after this.
Where we process Saved Content (such as annotations, notes and saved workspaces), we retain it for as long as you are an active user of the Site and for 2 years after this. If you are looking for past content, or just want to discover the personal data we have about you, please see the “Your choices and rights” section above.
Where we process personal data for marketing purposes, or with your consent, we process the data until you ask us to stop and for a short period of 30 days after this (to allow us to implement your request). We also keep a record of the fact that you have asked us not to send you direct marketing, or to process your data, indefinitely, so that we can respect your request in future.
Where we process personal data for Site security purposes, we retain it for 6 months.
We may rectify, update or remove incomplete or inaccurate information at any time and at our discretion. For more information on our retention periods, please contact us via the details in the “Contact us” section.
Updates to this privacy notice
We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.