Privacy and Cookies Policy

Last updated: 31 July 2026

This policy explains what personal information we collect, why we collect it, who we share it with and what control you have over it. We have written it in plain English, and we have tried to describe what actually happens rather than what a template says should happen.

The short version: we sell books. We need your name and address to send them to you, and your email address to tell you they are on the way. We do not use Google Analytics, we do not have a Facebook pixel, we run no advertising trackers, and we never sell your data to anyone. Our website statistics run on our own server.

Contents

1. Who we are and how to contact us
2. What this policy covers
3. What we collect
4. Why we use it, and our legal basis
5. Who we share it with
6. What stays with us
7. Sending data outside the UK
8. How long we keep it
9. Your rights
10. Marketing emails
11. Children
12. Cookies
13. Security, changes and complaints

1. Who we are and how to contact us

This website is owned and operated by Ninja Alliance Ltd, which trades as Exam Ninja. For the purposes of data protection law we are the data controller for the information described here.

Ninja Alliance Ltd
19 Canford Lane
Westbury on Trym
Bristol
BS9 3DQ

Registered in England and Wales, company number 8599425
Registered with the Information Commissioner's Office, registration number ZA034922

For anything to do with your personal information, contact Joshua Geake at [email protected], by telephone on 0117 214 0031, or by post at the address above.

We are not required to appoint a Data Protection Officer and we have not appointed one. The contact above deals with these questions directly.

2. What this policy covers

1. This policy covers examninja.co.uk and the emails we send you.
2. If you buy from us on eBay, eBay's own privacy policy also applies to that sale, and eBay decides how it handles your data on its platform.
3. Our website links to other sites, including our reviews site. We are not responsible for how other organisations handle your data.

3. What we collect

Information you give us

• When you order: your name, email address, delivery and billing addresses, and a telephone number for the courier.
• When you create an account: your name, email address and password. We store passwords in a hashed form, so we cannot see them.
• When you contact us: whatever you put in the message, plus your email address or telephone number so we can reply.
• When you sign up for emails: your email address, and optionally the school year your child is in so we can recommend books that are relevant.
• When you leave a review: your name and what you wrote.

Information we collect automatically

• Your IP address, browser and device type, and the pages you look at, through our own website statistics.
• Which website sent you to us, if any.
• Information stored in cookies. Section 12 lists every one.

Information we receive from others

• Our payment providers confirm whether a payment succeeded, and tell us the result of their fraud checks. We never see your full card number.
• eBay passes us the order and delivery details for anything you buy from us there.
• Couriers tell us the delivery status of your parcel.

4. Why we use it, and our legal basis

Data protection law requires us to have a valid reason, called a lawful basis, for each thing we do with your information. Here is the complete list.

A note on website statistics. Many websites ask for your consent to analytics cookies through a banner. We do not show a banner, so we do not rely on your consent for this. We rely on our legitimate interest instead, on the basis that our statistics run on our own server, the data is not shared with anyone, and it is not used to build advertising profiles. You can still opt out, and section 12 explains how. We would rather tell you this plainly than show you a banner that implies more choice than we actually offer.

5. Who we share it with

We do not sell your personal information, and we never share it with advertisers. We do share it with the organisations below, because we could not run the shop otherwise.

We will also disclose information if the law requires it, if we need to protect someone's safety, or to establish or defend legal claims.

6. What stays with us

This is unusual enough to be worth stating clearly. Several things that most online shops hand to third parties, we run ourselves:

• Website statistics. We use Matomo, hosted on our own server at track.examninja.co.uk. Your browsing data does not go to Google or anyone else.
• Our email newsletter system. Run on our own server. Your subscription details are not passed to a marketing company.
• Our product images. Processed and served from our own server.

We do not use Google Analytics, Google Tag Manager, the Facebook or Meta pixel, any advertising or retargeting network, or a third party live chat widget. We have removed the services we used to use, and this policy has been rewritten to match.

7. Sending data outside the UK

1. Our website and database are hosted in Germany. The UK government has decided that the European Economic Area provides adequate protection for personal data, so no extra safeguards are needed.
2. Cloudflare, Amazon Web Services and Stripe are based in the United States and may process your data there or elsewhere. These transfers are covered by the UK International Data Transfer Addendum to the European Commission's standard contractual clauses, or by the UK extension to the EU to US Data Privacy Framework.
3. If you ask us to send a parcel abroad, your delivery details necessarily go to the courier and to customs authorities in that country.
4. You can ask us for more detail about any of these safeguards.

8. How long we keep it

We keep information for as long as we need it, and no longer. We want to be straightforward about this rather than quote precise periods we do not actually enforce.

1. Order and payment records are kept for at least 6 years after the end of the financial year they relate to, because tax and company law require it.
2. Your account stays while you use it. If you ask us to close and delete it, we will, apart from the order records above.
3. Newsletter subscriptions are kept until you unsubscribe.
4. Emails and messages are kept while they are useful for answering your questions and dealing with any follow-up.
5. Website statistics are kept for up to two years.
6. We do not currently delete data automatically on a schedule. If you want your information removed, ask us and we will do it.

9. Your rights

Under UK data protection law you have the following rights, free of charge.

• To see your data. Ask us for a copy of what we hold about you.
• To correct it. If something is wrong or incomplete, tell us and we will fix it.
• To have it deleted. We will delete what we can, though we must keep order records for tax purposes.
• To restrict what we do with it while a query is sorted out.
• To object to us using it where we rely on legitimate interests, including for website statistics and recommendations.
• To stop marketing at any time. This one is absolute, and we must always comply.
• To receive your data in a portable, machine-readable form.
• To withdraw consent at any time, where we relied on it.

To use any of these rights, email [email protected] or write to us. You can ask in any way you like, and you do not have to use a special form or particular wording. We will respond within one month. If your request is complicated we may need longer, and we will tell you if so.

There is no self-service download or delete button in your account, so these requests are handled by a person. That is why we ask you to contact us directly.

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office, the UK regulator:

ico.org.uk/make-a-complaint
Helpline: 0303 123 1113
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

10. Marketing emails

1. We send marketing emails if you have asked for them, or if you have bought from us and have not opted out. This is allowed under the Privacy and Electronic Communications Regulations.
2. Every marketing email has an unsubscribe link. You can also change your preferences on the email preferences page when signed in, or just email us.
3. Unsubscribing from marketing does not stop order confirmations and dispatch notices, which we have to send to fulfil your order.
4. We do not pass your email address to other companies for their marketing.

11. Children

1. Our shop is intended for adults buying educational books, usually for children. Accounts and orders are for over-18s.
2. We may ask which school year a child is in. That is a shopping preference you give us so we can recommend suitable books. We do not ask for a child's name, date of birth or contact details, and we do not need them.
3. We do not knowingly collect personal information from children. If you believe a child has given us their information, tell us and we will delete it.
4. We do not make automated decisions that have legal or similarly significant effects on anyone, and we do not profile children. An earlier version of this policy said otherwise. It was wrong, and this corrects it.

12. Cookies

A cookie is a small file a website stores on your device, usually to remember something between pages, such as what is in your basket.

We do not show a cookie banner. We think it is more useful to tell you exactly what we set and why, and to make opting out genuinely easy, than to show a pop-up that most people click through without reading. Below is the complete list, checked against the live website on 31 July 2026.

Cookies set when you browse the site

Cookies set only in certain situations

Other companies our pages contact

Some parts of our site load from other companies. Even where they set no cookie, they receive your IP address:

• Cloudflare sits in front of our whole website, so it sees every request. We also load an icon font from its public library on every page, and it provides the anti-spam check on our contact form.
• Stripe loads on product and basket pages so that payment and fraud checks work.

How to opt out

• Opt out of our website statistics using the Matomo opt-out page. This sets a cookie remembering that you do not want to be counted.
• Turn on Do Not Track in your browser and our statistics will respect it.
• Block or delete cookies in your browser settings. Every major browser lets you do this, and has instructions in its help pages.

Blocking the essential cookies above will stop the basket and sign-in working, so you will not be able to place an order. Blocking the others has no effect on your ability to shop.

13. Security, changes and complaints

1. Our website runs over an encrypted connection, passwords are stored hashed rather than in readable form, and access to customer data is limited to the people who need it.
2. No system is completely secure. If a breach happens that puts your rights at risk, we will tell the Information Commissioner's Office within 72 hours, and we will tell you if you are likely to be seriously affected.
3. We may update this policy. The date at the top always shows when it last changed, and the current version is always the one on this page. We do not email you about changes to this policy, so please check here if it matters to you.
4. If you have a question or a complaint about your information, contact [email protected] and we will do our best to sort it out. You can also complain to the Information Commissioner's Office at any time.