Privacy Policy
This policy explains what CITB Practice Test collects, why, and what rights you have over it. It is written to comply with the UK GDPR and the Data Protection Act 2018.
The short version: you can revise every question and take a mock test without an account. An account is optional. If you make one, we keep your email address, your mock test results and, if you buy a plan, a record of the payment. Card details go to Stripe and never reach us.
We use Google Analytics to count which pages get read, and there is no advertising on this site at all. Until you opt in it runs without cookies: page views are counted, but nothing is stored on your device and nothing recognises you on a later visit. No optional cookie is set unless you opt in through the banner.
1. Who we are
CITB Practice Test (https://citbpracticetest.co.uk) is operated by the CITB Practice Test Team, based in England and Wales. For the purposes of data protection law we are the data controller for this website and for accounts made on it.
Data protection enquiries: [email protected].
2. Information we collect
2.1 If you email us
We receive your email address and whatever you write. We use it to reply and to fix reported errors, and nothing else.
2.2 If you create an account
Accounts are held by our account service, the system we run to handle logins, mock tests and payments for our websites. It stores:
- Your email address, whether you have confirmed it, and when you joined.
- Your password, stored only as a one-way hash, never in a form anyone can read. If you sign in with Google instead, we receive your email address and a Google account ID from Google, and no password is stored.
- Your mock test attempts: the questions you were given, the answers you picked, how long you spent, your scores and the questions you flag.
- Your paid plan, if you buy one: which plan, when it started and ends, and the payment records Stripe sends us (amount, date and status, never the card number).
- Basic security records such as when you logged in, and a hashed (scrambled) form of the IP address used to start a test, to stop abuse of the free limits.
2.3 If you take a mock test or practice quiz without an account
Timed mock tests and the practice quizzes on the topic and specialist pages are marked by our account service, so the answers you pick are sent to it. Without an account they are linked only to a random practice ID kept in your browser, which is how we count the free weekly mock test and the free weekly practice quiz. We also keep a hashed (scrambled) form of your IP address, so that one network cannot claim unlimited free tests. Tests and quizzes taken without an account are deleted after 90 days.
2.4 Information collected automatically
The server logs our hosting provider keeps in order to serve the site and defend it against abuse. Those record the IP address, the page requested, the time, and the browser's user-agent string.
Google Analytics also collects the following. The first line applies to every visit; the second only once you opt in:
- Analytics data: IP address (truncated by Google before storage), approximate location at city level, device and browser type, pages visited, referring site and time of visit.
- Cookie and similar identifiers set by analytics, which link your visits together. Set only after you opt in, and described in our Cookie Policy.
3. Your sign-in token
When you log in, your browser keeps a sign-in token in local storage so you stay logged in between visits. It is removed when you log out. It is strictly necessary for the account to work and is listed in our Cookie Policy.
Links in our emails (to reset a password, confirm your email or log in) carry a one-time token. The site moves it out of the address bar as the page loads, before analytics runs, so it is never sent to Google Analytics.
4. Payments
Payments and refunds are processed securely by Stripe. You pay on Stripe's own checkout page, so your card details go to Stripe and never reach us. Stripe is responsible for the payment data it needs for its own legal duties, such as fraud prevention, under its own privacy policy at stripe.com/privacy.
The business name shown on the Stripe checkout page and on your card statement may differ from the name of this site.
5. How we use your information
- To run your account, mark your mock tests, show your results and progress, and apply the free weekly limits.
- To provide a plan you buy, send the emails your account needs (confirmation, password reset, receipts) and handle refunds.
- To run and improve the website, including understanding which pages and question topics are used most, and which questions are often answered wrongly.
- To reply to your emails and process corrections you report.
- To keep the site secure and to investigate abuse.
- To comply with our legal obligations, including keeping payment records for tax.
6. Our lawful bases for processing
- Contract: to provide your account, your mock tests and any plan you buy.
- Consent: for non-essential analytics cookies. You give this through the cookie banner and can withdraw it at any time.
- Legitimate interests: for the secure operation of the website, preventing abuse of the free limits, improving our questions, and responding to correspondence you initiate.
- Legal obligation: where we are required to retain or disclose information by law, such as payment records.
7. Cookies and tracking
We use a small number of cookies and similar technologies. Strictly necessary ones make the site and your account work and need no consent. Analytics cookies are off by default and are set only if you opt in; before that, analytics runs without them. There are no advertising cookies.
The full list, including who sets each one and how long it lasts, is in our Cookie Policy. You can change or withdraw your choice at any time using the Cookie settings link in the footer.
8. Who we share information with
We do not sell your personal data, and we do not share it for cross-context behavioural advertising. There is no advertising on this site.
- Payments: Stripe, which processes payments and refunds.
- Sign-in with Google, only if you choose it: Google sign-in (Google Ireland Limited), which tells us your email address and confirms it belongs to you.
- Email delivery: the provider our account service uses to send account emails such as confirmation and password reset links.
- Bot protection: the sign-up, password reset and login link forms use Cloudflare Turnstile to block bots, which sends Cloudflare technical details about your browser and connection; it is strictly necessary for security, so it runs whatever you choose in the cookie banner.
- Analytics: Google Analytics 4 (Google Ireland Limited), which processes usage data on our behalf. Cookieless unless you opt in.
- Hosting and infrastructure: our hosting providers, which process server logs in order to serve the site and run our account service.
- Law enforcement or regulators, where we are legally required to disclose.
9. International transfers
Some of our providers, including Stripe, Google and our hosting provider, are US-headquartered and may process data outside the UK.
Where they do, they rely on the UK Extension to the EU-US Data Privacy Framework, or Standard Contractual Clauses with the UK International Data Transfer Addendum, as each provider sets out.
10. How long we keep it
- Your account: for as long as you keep it. When you ask us to delete it, we remove your logins and stored data and anonymise the account, so your email address no longer appears on it.
- Payment records: kept after an account is deleted, for as long as tax law requires, without your email address attached. Stripe keeps its own copy under its own policy.
- Mock tests taken without an account: deleted after 90 days.
- Emails you send us: kept while the matter is open and for 24 months after the matter is closed, so we have a record of reported errors and what we did about them.
- Analytics data: retained for 14 months in line with our Google Analytics retention setting, then deleted automatically.
- Server logs: approximately 30 days, as retained by our hosting provider.
11. Your rights
Under UK data protection law you have the right to access your data, correct it, have it erased, restrict or object to processing, request portability, and withdraw consent at any time.
To delete your account or get a copy of your data, email [email protected] from the email address on the account. If you have a Monthly Plan, cancel it under Manage billing first, or ask us to. We will respond within one month.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.
12. Automated decision-making and profiling
Your mock tests are marked automatically, and your account shows the topics you get wrong most often. That is the service you asked for. It has no legal or similarly significant effect on you, and we do not use it to decide anything about you.
There is no advertising on this site, so there is no ad personalisation to object to.
13. Whether you have to give us anything
No. There is no statutory requirement to give us personal data. You can revise every question and take a mock test without an account. An account needs an email address and a paid plan needs a payment through Stripe, and both are your choice.
14. Children's privacy
The site is aimed at adults and at young people entering construction. Candidates under 16 can sit the CITB test with parental consent, so some of our readers will be under 16.
You must be 13 or over to create an account, and under 18 you need a parent or guardian's permission to buy a plan. If you believe a child under 13 has made an account or sent us personal information, contact us and we will delete it.
15. Data security
The site and our account service are served over HTTPS. Passwords are stored only as hashes, card details never reach us, and email links work once and expire.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
16. Links to other sites
We link to CITB, CSCS, Pearson VUE, the HSE and others. Once you follow a link you are on their site and their privacy policy applies, not ours.
17. Changes to this policy
We update this policy when our practices change. The Last Updated date at the top always reflects the current version, and material changes will be flagged on the site.