1. Who we are
FRM Prep (https://frmmastery.com) provides online practice exams and study tools for the GARP® Financial Risk Manager (FRM®) certification. For data protection enquiries contact admin@frmmastery.com.
2. What data we collect
- Account data: email address, password hash (if you register with email), role, premium access expiry, and account timestamps.
- Usage data: exam attempts, question answers, progress, reviewed mistakes, and flashcard interactions.
- Payment data: premium checkout records and amounts. Card details are processed by Stripe — we do not store full payment card numbers.
- Support data: messages you send via our contact form.
- Technical data: session cookies required for authentication, IP address in server logs (for security and rate limiting), and basic request metadata.
3. Legal bases (GDPR Article 6)
- Contract: processing necessary to provide the service you signed up for (account, exams, purchases).
- Consent: where you accept our Terms and Privacy Policy, and when you agree to non-essential cookies (if offered).
- Legitimate interests: fraud prevention, security, service improvement, and responding to support requests — balanced against your rights.
- Legal obligation: where we must retain records for tax or accounting law.
4. How we use your data
We use your data to operate your account, deliver practice content, process payments, send transactional emails (verification, password reset, support replies), improve the product, and comply with law. We do not sell your personal data. We do not send marketing emails unless you opt in (we currently send transactional email only).
5. Processors and international transfers
We use trusted sub-processors to run the service, including:
- Stripe — payment processing (may transfer data outside the EEA with appropriate safeguards).
- Google — optional OAuth sign-in.
- Email provider — transactional email delivery via SMTP as configured.
- Hosting provider — application and database hosting.
Where data is transferred outside the European Economic Area, we rely on Standard Contractual Clauses or equivalent mechanisms where required.
6. Retention
- Account and progress data: kept while your account is active.
- After account deletion: personal data is erased promptly except where retention is required by law (e.g. payment records).
- Server logs: typically retained up to 90 days for security.
7. Your rights
If you are in the EEA, UK, or another jurisdiction with similar laws, you may have the right to:
- Access your data (Article 15)
- Rectify inaccurate data (Article 16)
- Erase your data (Article 17) — use Account → Privacy or email us
- Restrict or object to processing (Articles 18–21)
- Data portability (Article 20) — download JSON from your Account page
- Withdraw consent where processing is consent-based
- Lodge a complaint with your supervisory authority
To exercise these rights, use the tools in your Account settings or email admin@frmmastery.com. We respond within one month.
8. Children
The service is not directed at children under 16. If you believe a child has provided us personal data, contact us and we will delete it.
9. Security
Passwords are hashed with Argon2id. We use HTTPS, access controls, and rate limiting. No method of transmission over the Internet is 100% secure.
10. Changes
We may update this policy. Material changes will be communicated via the site or email. Continued use after changes constitutes acceptance where permitted by law.