Last updated: 17 October 2026
This policy explains how ARENA collects and uses personal data when you visit www.jointhecops.co.uk, use the Join The Cops practice app at app.jointhecops.co.uk, receive our emails or contact us. It is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
The controller of your personal data is ARENA, an EURL (single-member limited liability company under French law), registered office 229 rue de Solférino, 59000 Lille, France, SIREN 934 277 344, RCS Lille Métropole. Join The Cops is a brand of ARENA.
Contact for any privacy question or request: [email protected], or by post to the address above.
Person responsible for data protection: Eliott Raoult, managing director of ARENA, 229 rue de Solférino, 59000 Lille, France, [email protected].
Because ARENA is established in France, the EU General Data Protection Regulation also applies to our processing. ARENA is registered with the UK Information Commissioner’s Office (ICO) under registration reference ZC266766.
Change of operator. Join The Cops was previously run by another business. ARENA took over the business, including existing customer accounts and the email list, in October 2026. If you had an account or subscribed before that date, ARENA has been the controller of your data since then and uses it as described in this policy.
2. The data we collect
- Account data: email address, name (if you give it), password (stored in encrypted form), account type (free or Pro), access period.
- Learning data: test scores and answers, lesson and guide progress, bookmarks, study streak, the exam date you enter, feedback and feature votes you send through the App.
- Purchase data: name, email address, amount, date, payment status and, where collected for tax purposes, billing country and postcode. Your card details are collected by Stripe; we never see your full card number.
- Pass guarantee and refund data: the Police Scotland result notifications you send us and the information needed to process the refund.
- Communications: emails and contact form messages you send us, and our replies.
- Technical and usage data: IP address, browser and device type, pages visited, actions in the App, login dates and count, how you arrived on the Site (for example the referring site or campaign link).
- Cookie data: see section 8.
We do not ask for special category data (such as health data). Please do not include it in messages to us.
3. How we use your data, legal basis and how long we keep it
| What we do | Data used | Legal basis (UK GDPR Article 6) | How long we keep it |
|---|---|---|---|
| Create and run your account, give you Free access or Pro, save your scores and progress | Account data, learning data | Performance of our contract with you (6(1)(b)) | While your account is open. If an account without current paid access has not been used for 3 years, we delete it. You can ask us to delete your account at any time. |
| Process your purchase and keep accounting and tax records (including UK VAT) | Purchase data | Contract (6(1)(b)) and legal obligation (6(1)(c)) | 10 years from the end of the financial year of the purchase, as required by French accounting rules (this also covers the 6 years required for UK VAT records) |
| Send service emails (password set-up and reset, purchase confirmation, important changes) | Email address, name, purchase data | Contract (6(1)(b)) | As long as your account is open; sending logs at our email provider for its standard retention period |
| Handle Pass guarantee claims and refunds | Result notifications, purchase data, email exchanges | Contract (6(1)(b)) | Up to 6 years after the claim, the period during which a legal claim could be made; refund records are kept with accounting records |
| Answer your questions and complaints | Communications, account data | Legitimate interests (6(1)(f)): providing customer support | 3 years after our last exchange |
| Send you tips and offers by email | Email address, name, sign-up source | Your consent (6(1)(a)), or, if you are a customer, our legitimate interests (6(1)(f)) in telling you about similar products, with an opt-out in every email | Until you unsubscribe. We then keep your email address on a suppression list so that we do not email you again. Contacts who never open our emails for 2 years are removed. |
| Measure Site audience (Google Analytics) | Cookie data, technical and usage data | Your consent (6(1)(a)) | 14 months (Google Analytics retention setting) |
| Understand how visitors use the Site with heatmaps and session recordings (Microsoft Clarity) | Cookie data, technical and usage data (clicks, scrolls, mouse movements) | Your consent (6(1)(a)) | Microsoft's standard retention for Clarity |
| Improve the App and spot problems, using our own usage records (actions in the App, logins, IP address, browser) | Technical and usage data, account data | Legitimate interests (6(1)(f)): improving the product and keeping accounts secure | 12 months |
| Understand which websites and campaigns bring visitors (referrer and campaign parameters stored on your account) | Technical and usage data | Legitimate interests (6(1)(f)): measuring our marketing | 12 months |
| Keep the Service secure and prevent fraud and abuse (for example limiting sign-ups per IP address, server logs) | IP address, technical data | Legitimate interests (6(1)(f)): security | As long as needed for security, and no longer than 12 months |
| Record your cookie choices | Consent record, IP address, browser data | Legal obligation (6(1)(c)) and legitimate interests (6(1)(f)) | 12 months, after which we ask you again |
| Show Google reviews on our home page and load fonts | IP address, browser data (sent by your browser to the provider) | Legitimate interests (6(1)(f)): presenting the Site | Not stored by us |
| Establish, exercise or defend legal claims | Any relevant data | Legitimate interests (6(1)(f)) | For the relevant limitation period |
Where we rely on legitimate interests, we have balanced them against your rights. You can ask us for details of that assessment and object at any time (see section 9).
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. We do not sell your personal data.
4. Who we share your data with
We share personal data only with service providers who process it on our behalf and under our instructions (processors), or, where stated, as independent controllers.
| Provider | What they do for us | Where the data is processed |
|---|---|---|
| Hostinger International Ltd | Hosting of the Site and of the database that stores accounts, scores and progress | European Union (servers in France) |
| Vercel Inc. | Hosting and delivery of the practice App | United States, and global delivery network |
| Cloudflare, Inc. | Domain name system, website delivery and security, routing of emails sent to our addresses | United States, and global network |
| Stripe Payments Europe, Ltd | Payment processing. Stripe also acts as an independent controller for fraud prevention and its legal obligations | Ireland, with transfers to Stripe, Inc. in the United States |
| Resend | Sending of service emails | United States (sending infrastructure in the European Union) |
| Omnisend UAB | Marketing emails. We are closing this account; your data will then be deleted from Omnisend | European Union (Lithuania) |
| Google Ireland Limited and Google LLC | Google Analytics, Google Tag Manager, Google Fonts, display of Google review profile pictures | Ireland and United States |
| Microsoft Ireland Operations Limited and Microsoft Corporation | Microsoft Clarity (heatmaps and session recordings) | Ireland and United States |
| Trustindex | Display of our Google reviews on the home page | European Union (Hungary) |
| Securiti, Inc. | Cookie banner and storage of cookie choices | European Union instance |
| Google Ireland Limited (Google Workspace) | Customer support mailbox (emails to hello@ and enquiries@ are forwarded to it) | Ireland, with possible transfers to Google LLC in the United States (UK Extension to the EU-US Data Privacy Framework) |
We may also disclose data where required by law, to protect our rights, or to a buyer if the Join The Cops business is sold (in which case this policy, or a policy giving the same protection, will continue to apply).
5. International transfers
Transfers of personal data from the UK to the European Economic Area (including France, Ireland, Lithuania and Hungary) are covered by UK adequacy regulations.
Where a provider processes data in the United States, the transfer is protected by the UK Extension to the EU-US Data Privacy Framework if that provider is certified under it, or otherwise by the International Data Transfer Addendum to the EU standard contractual clauses or the International Data Transfer Agreement approved under the UK GDPR, as set out in the provider's data processing terms. You can ask us for a copy of the relevant safeguards.
6. How we protect your data
Connections to the Site and App are encrypted (HTTPS). Passwords are stored in encrypted form. Access to customer data is limited to people who need it to run the Service. Our providers are bound by confidentiality and security obligations.
7. Children
The Service is intended for adults and young people preparing to apply to Police Scotland. It is not directed at children under 16, and we do not knowingly collect data from them. If you believe a child under 16 has given us data, please contact us and we will delete it.
8. Cookies and similar technologies
Cookies are small files stored on your device. We use them, and similar technologies such as local storage, as follows.
| Category | Purpose | Examples | Consent needed? |
|---|---|---|---|
| Strictly necessary | Make the Site and App work: login session, security, remembering your cookie choices, basket and account pages on the Site | WordPress and WooCommerce session cookies, Securiti consent cookie; in the App, your login token is kept in your browser's local storage | No |
| Analytics | Measure audience and understand how the Site is used | Google Analytics (_ga, _ga_*), Microsoft Clarity (_clck, _clsk) | Yes |
| Marketing | Recognise email subscribers on the Site and measure email campaigns; record which source brought a visitor | Omnisend tracking cookies; WooCommerce source attribution cookies (sbjs_*) | Yes |
We are updating our cookie banner so that you can accept or reject analytics and marketing cookies before they are set, and change your choice at any time. In the meantime, you can block or delete cookies in your browser settings, although some parts of the Site may then not work.
9. Your rights
Under data protection law you have the right to:
- access the personal data we hold about you and receive a copy;
- rectification of inaccurate or incomplete data;
- erasure of your data in certain circumstances;
- restriction of processing in certain circumstances;
- object to processing based on our legitimate interests, and to object at any time to direct marketing (we will then stop);
- data portability: receive the data you gave us in a structured, machine-readable format, or have it sent to another organisation, where processing is based on consent or contract and carried out by automated means;
- withdraw your consent at any time, where we rely on consent. This does not affect processing carried out before you withdrew it.
You can unsubscribe from marketing emails with the link in every email. To exercise any other right, email [email protected]. We may ask you to confirm your identity. We will reply within one month, which may be extended by up to two further months for complex or numerous requests (we will tell you if so). Exercising your rights is free, unless a request is clearly unfounded or excessive.
10. Complaints
If you have a concern about how we use your data, please contact us first at [email protected] so that we can try to resolve it.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority: ico.org.uk, telephone 0303 123 1113. As ARENA is established in France, you can also contact the Commission Nationale de l'Informatique et des Libertés (CNIL): cnil.fr.
11. Changes to this policy
We may update this policy. The date at the top shows when it was last changed. If we make significant changes, we will tell you by email or with a notice on the Site.