Privacy notice, GDPR and cookies
Applies to PLAB WEB (https://plabweb.com). Written for the UK GDPR and the Data Protection Act 2018, and for the Privacy and Electronic Communications Regulations (cookies). Last updated 24 October 2026.
Who is responsible for your data
PLAB WEB and is the “controller” of the personal data described here. Contact for every privacy request: admin [at] plabweb [dot] com. We have not appointed a Data Protection Officer because the law does not require one for a service of this kind.
How this website earns money
This website earns income from sponsors and from affiliate links. Sponsored messages are labelled “Sponsored”. Some links to books and other products are affiliate links: if you buy after clicking one, we may receive a commission at no extra cost to you. Income never changes what the guide says, and sponsors and retailers do not receive your name, email address or account details from us. The sections below explain exactly what is shared when you load or click these items.
What we collect, why, and on what legal basis
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| Reading the guide | No account is needed. We do not ask who you are. | n/a | n/a |
| Account (optional): a sign-in identifier from the service you choose, optionally an email address, and a random public name such as “member-12345” | To let you save progress across devices | Contract (providing the account you asked for) | Until you delete the account |
| Progress: the guide steps you mark as done | To show your progress | Contract | Until you delete the account. Signed-out ticks stay in your browser only. |
| Community posts (optional, signed-in members only): the discussions and replies you write, shown publicly beside your public username once a moderator approves them; any reports you send | To run a moderated community and keep it safe | Contract (the account and features you asked for) and legitimate interests (keeping the community safe) | Until you delete your account, which deletes your posts. Records of posts rejected for breaking the rules: 180 days after the decision. Reports: until resolved or you delete your account. |
| Contact messages: name, email, message | To reply to you | Your request / legitimate interests | 365 days |
| Server logs: IP address, time, page, status, browser type, referring page (secrets in web addresses are removed) | Security, preventing abuse, diagnosing faults | Legitimate interests | Crawler requests only, 14 days; error logs 30 days; proxy access logs 180 days; database backups 7 days |
| Cookie choice | To remember your cookie preference | Strictly necessary | 12 months |
| Analytics (only if you allow it): pages viewed, approximate location, device type | To understand which pages help and which do not | Consent | Set in the analytics service; 14 months or less |
We do not ask for your real name, date of birth, nationality, medical-registration number, health information or payment details, and we ask you not to put them in contact messages. We do not build advertising profiles. In the community, automated checks hold back posts that break the published rules (for example links or images); a moderator reviews every post, and a person decides whether an account that repeatedly breaks the rules stays paused. You can contact us to challenge any decision.
Cookies and similar technologies
- Strictly necessary (no consent needed): a session cookie when you sign in (up to 14 days), a security (CSRF) cookie, and a cookie that remembers your cookie choice. Your progress ticks use your browser’s local storage if you are signed out.
- Analytics (only after you press “Allow analytics”): cookies whose names begin with
_ga. Nothing is sent to the analytics service before you agree. Ad personalisation and cross-site signals are switched off, and pressing “Essential only”, or “Cookie settings” in the footer, withdraws consent and deletes these cookies. Withdrawing is as easy as agreeing. - Sponsored messages and affiliate links do not set cookies on this website. See the next two sections for what happens when they load or are clicked.
Sponsored messages
When a page containing a sponsored message loads, your browser contacts the service that delivers sponsored messages, so that service receives your IP address and browser details, as any website you visit would. We use a delivery service that counts views and clicks for the sponsor in aggregate and that does not use advertising cookies or visitor tracking on this website. Delivery needs your IP address, so our legal basis is legitimate interests (funding a free guide). You can object using the contact address above, and you can block sponsored messages with a browser setting or extension; the guide still works.
Affiliate links
If you click an affiliate link (for example, a book on the Resources page) you leave this website and the retailer’s own privacy notice applies. The link carries an identifier showing that you came from us so that the retailer can credit our commission; it does not contain your name, email address or account details. We do not learn what you buy.
Who receives your data
We share personal data only with these categories of recipients, each bound by contract to protect it and to use it only on our instructions: hosting and database providers; cloud storage providers (server logs); an email service (contact messages and notifications); an analytics provider (only if you consent); the sign-in service you choose (when you create or use an account, it tells us who you are and we tell it that you are signing in); and a sponsored-message delivery service (as described above). We may disclose data where the law requires it. We never sell personal data.
Some providers process data outside the UK. We rely on UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, or equivalent safeguards. Ask us at the address above for a copy of the safeguards.
Young people
This guide is written for students from about 16 and for adults. You must be at least 13 to create an account (the age of digital consent in the UK). We do not knowingly profile or advertise to children, we do not use their data for marketing, and our default is to collect as little as possible. If you are under 18 and believe we hold data you would like removed, tell us and we will delete it.
Your rights
You may ask to access, correct, erase or restrict your data, to receive it in a portable format, and to object to processing based on legitimate interests. Signed-in members can download or delete their data themselves. Where processing is based on consent you may withdraw it at any time. We respond within one month. If you are unhappy, please talk to us first; you also have the right to complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113).
Security
Traffic is encrypted in transit, staff access uses two-factor authentication, secrets are not stored in the source code, personal data in logs is minimised, and we keep data only for the periods above. If a breach is likely to harm you, we will tell you and the regulator as the law requires.
We may update this notice; the date above shows the latest version. Material changes are announced on this page.