Privacy
Privacy policy
Saleema Mahmood Limited, trading as PupillagePrep. Effective 22 September 2026.
- Data controller
- Saleema Mahmood Limited, trading as PupillagePrep
- Effective date
- 22 September 2026
- Website
- https://pupillageprep.co.uk/
- Privacy email
- info@saleemamahmood.com
1. About this privacy policy
This privacy policy explains how Saleema Mahmood Limited, trading as PupillagePrep (“PupillagePrep”, “we”, “us” or “our”), collects and uses personal information when you visit pupillageprep.co.uk, use its free resources, buy the Mastering Criminal Pupillage Interviews digital manual, access or download purchased material, ask us to resend a download link, or contact us.
We are the controller of the personal information described in this policy. This means that we decide why and how that information is used. We process personal information in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018 and, where relevant, the Privacy and Electronic Communications Regulations 2003.
2. Who we are and how to contact us
Controller: Saleema Mahmood Limited, trading as PupillagePrep
Company number: 15725745
Registered office: 71–75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ
Privacy email: info@saleemamahmood.com
Website: https://pupillageprep.co.uk/
Please use the words “Data protection request” in the subject line if you contact us about your information or your rights.
3. Personal information we collect
Information you provide
Purchase and fulfilment information, including your name where supplied, email address, Stripe Checkout Session identifier, transaction status, amount, currency, purchase time and records showing whether access or a download link was issued.
Contact information and the content of communications when you make an enquiry, request support, report a problem, complain, exercise a data protection right or ask us to resend your download link.
Marketing preferences, but only if we introduce an optional mailing list or you separately ask to receive marketing communications.
Information collected automatically
Technical and security information, which may include your IP address, browser and device type, operating system, requested pages, referral source, timestamps, error reports and security events.
Cookie and consent information, including your cookie choices and identifiers used to remember those choices.
Analytics information, but only where the applicable consent or legal exemption permits it. This may include aggregated or pseudonymous information about visits, pages viewed and device or browser characteristics.
Payment information
Stripe processes checkout and payment information. We do not receive or store your full card number, card security code or complete payment credentials. Stripe may provide us with limited transaction and purchaser details needed to confirm payment, provide access, prevent fraud, handle refunds and keep accounting records.
Sensitive information
We do not ask you to provide special category data or criminal offence data through this website. Please do not include sensitive personal information in a general enquiry unless it is necessary. If you send it to us, we will handle it only as permitted by law and delete or restrict it when it is not needed.
4. How we use personal information and our lawful bases
| Purpose | Information | Lawful basis | Typical retention |
|---|---|---|---|
| Process payment, verify purchase and provide access to the manual | Purchase, transaction and access records | Contract; legal obligation for accounting records | Purchase and tax records: normally 7 years after the transaction |
| Send or reissue download links and provide customer support | Email, purchase identifier and communications | Contract; legitimate interests in supporting purchasers | For the supported life of the purchase; support correspondence normally 2 years |
| Prevent fraud, misuse and unauthorised distribution | Transaction, access, IP and security data | Legitimate interests in protecting customers, content and systems | Security logs normally 30–90 days; longer where an incident is investigated |
| Respond to enquiries, complaints and legal claims | Contact details and correspondence | Legitimate interests; legal obligation; establishment or defence of legal claims | Enquiries normally 2 years; complaint or claim files normally up to 6 years after closure |
| Operate, secure and improve the website | Technical, error and limited usage data | Legitimate interests; consent where required for storage or access technologies | Operational data normally 30–90 days; aggregated statistics may be kept longer |
| Measure site use through optional analytics | Cookie or analytics identifiers and usage data | Consent, unless a specific legal exemption applies | According to the cookie tool and provider settings; consent records normally up to 3 years |
| Meet tax, accounting, regulatory and legal duties | Transaction and relevant correspondence | Legal obligation | For the period required by applicable law, normally up to 7 years for transaction records |
| Send optional direct marketing | Email and preference records | Consent, or another basis permitted by PECR where applicable | Until you unsubscribe or after reasonable inactivity; suppression records retained to honour your choice |
Where we rely on legitimate interests, we consider the necessity of the processing, the benefit to us or users, and the effect on your rights. You may ask for more information about this assessment or object as explained below.
5. Cookies and similar technologies
The website uses storage and access technologies such as cookies and local storage. Strictly necessary technologies may be used without consent where they are essential to provide a service you request, such as remembering security or consent settings, supporting checkout, verifying payment and protecting the website.
Optional analytics or other non-essential technologies will not be activated unless you choose to accept them, except where a specific legal exemption applies. You can accept, reject or change your choice at any time through the “Cookie settings” control in the website footer. Withdrawing consent does not affect processing that took place before withdrawal.
The cookie settings interface should be treated as the current cookie list because cookies and provider durations can change. It should identify each technology, its provider, purpose and duration. Browser controls may also block or delete cookies, but doing so can affect checkout or access features.
6. Who receives your information
We disclose personal information only where necessary and subject to appropriate contractual, confidentiality and security requirements. Recipients may include:
- Stripe, which provides checkout, payment processing, fraud prevention, refunds and transaction records. Stripe acts as an independent controller for some payment-related processing and as a processor for some services.
- Vercel, which hosts and delivers the website and may process technical logs and security data.
- KuberKreate.com, which provides website analytics services where analytics are enabled with the required consent or other lawful permission.
- Our transactional email delivery service, which sends purchase, access, support and download-link emails from info@saleemamahmood.com on our behalf.
- Professional advisers, insurers, auditors and service providers where reasonably necessary to run the business, protect legal rights or meet legal and regulatory duties.
- Courts, regulators, law-enforcement bodies, tax authorities or other public bodies where disclosure is required or permitted by law.
- A buyer, investor or successor if all or part of the business is sold, reorganised or transferred, subject to appropriate safeguards.
We do not sell personal information.
7. International transfers
Some service providers, including global technology and payment providers, may process personal information outside the United Kingdom. Where this amounts to a restricted transfer, we use a lawful transfer mechanism. Depending on the destination and provider, this may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another mechanism permitted by UK data protection law. We also consider whether supplementary technical or organisational measures are required.
You may contact us for information about the relevant transfer mechanism and, where available, a copy of the safeguards, subject to appropriate redactions.
8. How we protect your information
We use proportionate technical and organisational measures intended to protect personal information against accidental or unlawful loss, alteration, disclosure, access or destruction. These include access controls, encrypted connections, restricted production access, security monitoring, provider due diligence and data minimisation. No internet service can guarantee absolute security. If a personal data breach creates a legal notification duty, we will notify the Information Commissioner’s Office and affected individuals as required.
9. How long we keep information
We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including contractual support, accounting, tax, fraud prevention and legal claims. The indicative periods in section 4 apply unless a longer or shorter period is justified. When information is no longer required, we delete it, anonymise it or place it beyond routine use in accordance with our retention arrangements.
10. Your data protection rights
Depending on the circumstances, you may have the right to:
- be informed about how we use your information;
- ask for access to your personal information and a copy of it;
- ask us to correct inaccurate or incomplete information;
- ask us to erase information in certain circumstances;
- ask us to restrict the use of information in certain circumstances;
- receive information you provided in a structured, commonly used and machine-readable format, and ask for it to be transferred where the right to data portability applies;
- object to processing based on legitimate interests or to direct marketing;
- withdraw consent at any time where consent is the basis for processing; and
- not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, subject to statutory exceptions.
These rights are not absolute. We may ask for information needed to verify your identity and clarify your request. We normally respond within one month, although the law permits an extension for complex or multiple requests. We do not usually charge a fee, but the law allows a reasonable fee or refusal in limited cases involving manifestly unfounded or excessive requests.
11. Automated decision-making
We do not use personal information to make solely automated decisions that produce legal or similarly significant effects. Stripe or other service providers may use automated systems to identify suspected fraud or security risks under their own policies and legal responsibilities.
12. Children
The website and manual are intended for people preparing for professional pupillage interviews and are not directed at children under 16. We do not knowingly collect personal information from a child under 16 through the website. If you believe a child has provided information to us, please contact us so that we can review and, where appropriate, delete it.
13. Links to other websites
The website may link to third-party websites or services. Their operators control their own processing. We are not responsible for their privacy practices, and you should read their privacy information before providing personal information.
14. Complaints
Please contact us first if you have a concern so that we can try to resolve it. You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: https://ico.org.uk/make-a-complaint/
15. Changes to this policy
We may update this policy to reflect changes in the website, providers, business practices or law. The current version will be published on this page with its effective date. If a change materially affects how we use information already collected, we will take reasonable steps to bring it to your attention and obtain consent where the law requires it.
16. Document control
- Policy owner
- Saleema Mahmood Limited
- Version
- 1.0
- Effective date
- 22 September 2026
- Next review
- At least annually and whenever processing materially changes