Privacy policy
Effective date: 31 October 2026.
Who holds your data
Sava Labs Ltd, which runs Simply Pass Canada, holds your data. Its full details are in our terms. We are based in the United Kingdom.
The person in charge of privacy is our privacy lead, reached at [email protected]. Write there about anything on this page.
We follow the Personal Information Protection and Electronic Documents Act (PIPEDA) for the data of people who use Simply Pass Canada. For people in Quebec, we also follow the privacy rules of Quebec (Law 25) where they apply. This page says how.
What we collect
- Your email address. We need it to send the code that signs you in, your receipt, and an answer when you write to us.
- Your answers, your scores and your progress by topic. This makes your results page.
- Your purchase: the amount, the date, and your access window. Our payment provider holds the payment details. We never see or keep your card number.
- Technical records: the pages you asked for, the time, your internet address, your browser type and the errors the site met. We keep these to run the site and find faults.
- How you use the site, but only if you say yes in the cookie banner (see below). That means a visit log that we keep ourselves: the pages you open and the buttons you press, with a random visitor number, the page address, your language, a few small details about the action and the time. When you sign in, we link the visitor number to your account. Our analytics services may also record sessions and heat maps (where you move the pointer, click and scroll). A completed purchase is also reported to them from our side. We delete the log after 13 months, and we delete the link when we delete your account.
- When you make an account, where you came from. We save the website or campaign that sent you, the first page you opened and your random visitor number in your account record.
Your email is all we need to run your account. We never ask for your name, your postal address, your phone number, your date of birth, your immigration status, your citizenship application or your test booking, and you can leave them out of messages to support too. If you send them, we use them only to answer you.
If you claim our pass guarantee, you send us your test result, which may show your name. We use it only to check your claim. We keep a note of the claim and delete the result itself once we have answered.
Why we use it
| What we do | Why |
|---|---|
| Sign you in, give you the access you paid for, show your results, send your receipt, answer your messages | We need it to do what you bought. You agree to this when you buy |
| Keep purchase records for tax and accounts | The law asks us to |
| Fix faults, stop fraud and abuse, keep the site safe | Running a safe service |
| Measure how the site is used (analytics services and our own visit log) | Only if you say yes. You can say no, and take it back |
| Send marketing emails | Only with your consent. You can take it back at any time |
We use your data for these purposes only. We do not use it for anything you would not expect.
Who receives it
We share only what each one needs to do its job. They act on our instructions.
| Who (by kind) | Why | What they get |
|---|---|---|
| Hosting provider in Germany | Run the site and store our data | Everything we hold, as the host |
| Our email sending service | Delivers the sign-in code, receipt and any emails you asked for | Your email address and the text of the email |
| Stripe, our payment provider, in the United States and other countries | Takes your payment, keeps the payment record | Your email address, payment details and billing country |
| Analytics services, only after you say yes in the cookie banner | Measure how the site is used | What you do on this site, and technical records |
| An adviser, auditor or authority | Only when the law makes us, or to defend a legal claim | Only what is asked for |
We do not sell your data. We do not give it to advertisers or data brokers.
Our emails to you
Account emails, such as your sign-in code and your receipt, are not marketing. They carry no promotion, and you do not need to agree to them.
We send marketing emails (study tips and offers) only in two cases. You ticked the box (we never tick it for you), or you bought from us less than 2 years ago. Every marketing email says who we are and links to our company details, and has an unsubscribe link that is free and works without signing in. We stop within 10 business days, and usually at once. We keep a note that you unsubscribed so that we never write again. Our emails can use small tracking tools to tell us whether they arrive and are opened.
Cookies and the cookie banner
We always set the few cookies the site needs to work: the one that keeps you signed in, the one that remembers your cookie choice, and the one that remembers your language if you picked one.
Our analytics services are off by default. They do not run, and set no cookie, until you accept them in the cookie banner, which names them. Accept and Reject are equal choices. If you refuse, nothing more is set. To change your answer, press "Cookie settings" at the bottom of any page. We set no advertising cookie. We load no advertising pixel and no social network tracker.
We also set one cookie of our own that holds a random visitor number. It holds no personal details and it is not an advertising cookie. It lasts 24 hours, or one year if you say yes to analytics. We set it so that an account you make can show where it came from, and so that a test of two versions of a page shows you the same version each time.
Where your data goes outside Canada
Your data leaves Canada. It goes to the United Kingdom, where we are based, to Germany, where our servers are, and to the United States, where Stripe works. If you accept analytics, our analytics services may handle it in the United States and other countries. The laws of those places can let their courts and authorities ask for access to data.
We use written terms with each provider that limit what they may do with your data and require them to protect it. We remain responsible for your data when a provider handles it for us.
How we protect it
Sign-in is by emailed code. Connections to the site are encrypted. Only the people who run the service can reach your data. We keep your data only as long as we need it, and then delete it or remove what could identify you.
How long we keep it
Your account and your results stay while your account exists. If you have not signed in for 24 months, we delete them. We keep the record of a purchase for six years because tax and company law require it. Technical records stay for 90 days. The visit log stays for 13 months.
Your rights
You can ask us to
- give you a copy of the data we hold about you, in a common format you can read and move to another service,
- correct something that is wrong,
- delete your data,
- stop using your data for marketing, or for analytics, at any time, and take back a consent you gave.
Write to [email protected] from the email address on your account. We answer within 30 days and we do not charge. If you ask us to delete your account while you have paid access left, the access goes with it, so tell us if you would like to wait. We must keep the purchase record for tax duties even after the account is gone.
Complaints
Please write to us first so we can put it right. You may also complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca). If you live in Quebec, you may complain to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).
Children
Simply Pass Canada is for adults who prepare for the Canadian citizenship test. It is not for children, and we do not knowingly collect data from a child. If you think a child gave us data, write to us and we delete it.
If a breach happens
If a breach of your data creates a real risk of significant harm to you, we tell you by email without delay, and we tell the Office of the Privacy Commissioner of Canada (and in Quebec, the Commission d'accès à l'information). We keep a record of every breach for 24 months.
Changes to this policy
We put the new policy on this page with a new date at the top. If a change matters to you, we also email you before it starts.