Privacy and Data Notice

Introduction

This Privacy and Data Notice explains the types of personal data we may collect about you when you interact with us. It also explains how we’ll store and process that data and keep it safe.

Throughout this notice, when we refer to ‘we’ or ‘us’ it means Peak Study Resources Ltd, a company registered in England no. 12181054. On our website and in our marketing or other documents we might shorten that to just “Peak Study Resources”, “Peak”, “we” or “us”.

Where we refer to the website, it means any one of our sites. Our main website address is www.peakib.com.

This Privacy and Data Notice was last updated on 4 March 2025 and supersedes any prior notice.

How to contact us

For all questions, comments and requests regarding this Privacy and Data Notice you are welcome to contact us:

  • by submitting a contact form at https://www.peakib.com/contact-us/.
  • by post to: The Data Controller, Peak Study Resources Ltd, 1 & 3 Kings Meadow, Oxford OX2 0DP, UK
  • by phone: +44 (0)330 113 5644

or by any other means detailed on our website or in communications you have received from us.

The legal bases for collecting and processing data

UK law on data protection, which is largely based on and compliant with EU-wide regulations, sets out several different reasons for which a company may collect and process your personal data, including the following four key bases.

Contractual obligations

If we enter into a contract with you, we may need your personal data to comply with our contractual obligations. You may be the customer, supplier, or other type of partner in the contract.

The most common example would be if you purchase books from us directly, we need your name and address to be able to send your order to you and your email address to communicate with you about your order. If you are located outside the UK we may need additional information required by customs, taxation authorities, or the delivery agent in order to complete our contract with you.

Legal compliance

If the law requires us to, we may need to collect and process your data. For example, we need to keep financial records that may include personal data.

Legitimate interest

We may require your data to pursue our legitimate interests in a way which might reasonably be expected as part of running our business and which does not materially impact your rights, freedom or interests. An example may be that you hold the position of librarian or Diploma Programme Coordinator in an IB school and we believe you would be interested in the Diploma Programme study resources that we produce. If we identify you by name rather than just by title/position, then you can contact us to object to further contact.

Consent

We can collect and process your data with your consent. If we are collecting your personal data and it isn’t based on contractual obligations, legal compliance or legitimate interest then we’ll always make clear what the data will be used for and how you can withdraw consent.

When we collect your personal data

We do not purchase personal data of students or parents from third parties.

There are several channels through which we may collect personal data:

  • when you express interest in or request updates from Peak Study Resources by registering on our website, by email or telephone, or in person;
  • when you initiate an order or make a purchase from Peak Study Resources via our website, by email or telephone, or in person;
  • if you engage with us on social media;
  • when you download content from our website;
  • if you contact us by any means with queries, requests for quotes, complaints, order updates, product suggestions or for any reason connected to our business;
  • if you ask us to email you information about a product or service;
  • when you enter prize draws or competitions;
  • if you choose to complete any surveys on our website or that we send you;
  • when you comment on or review our products and services;
  • when you are a school representative or business customer and complete forms or profiles;
  • when a third party has provided your information in order for us to meet our obligations, for example a parent providing the details of their child for delivery of an order;
  • when you visit our website, we may collect information via cookies, pixels and tags in order to track marketing effectiveness or our website’s performance.

We may also obtain personal data regarding relevant school personnel, booksellers, or business partners from public sources, conferences and events, meetings, enquiries or referrals, provided we are confident the personal data has been made available with the explicit consent of the individual or for legitimate business purposes.

The personal data we collect

If you initiate or place an order for our products or services we will request your name, address for delivery, billing and payment details, email and contact details that may include telephone number.

If you use the contact form on our website or register with Peak Study Resources for information and offers then we will collect your name and at least one means of contacting you, normally email, and we may request optional details such as the subjects you are interested in so that we can personalise the information that we send you.

We may ask someone completing a form on the website to state whether they are a student, parent, teacher or other type of person. Providing this information is generally optional but is useful to ensure that only appropriate communications are sent, for example a parent signing up for our newsletter may not be interested in notifications regarding study skills articles we have published.

If you email or contact our Customer Service team we will store copies of correspondence and details of your interactions with us including any personal information you have provided in the process. In some cases, we will delete information immediately after use, for example if you have provided payment information via email.

Customs or delivery agents may require information about an individual so that an order can be processed by their systems and arrive safely at its destination. If you are required to provide identification, the data may also include your place of birth, gender and nationality.

Interaction with our website and social media accounts may provide us with:

  • details of your visits to our websites or apps, and which site you came from to ours;
  • information gathered by the use of cookies in your web browser;
  • your social media username and any public profile information you have connected to it, if you interact with us through those channels;
  • your contact information if you interact with us via phone, WhatsApp, Skype or other internet-based communications.

An important principle of our Data and Privacy Policy is we do not exploit personal data just because we have access to it. For example, while our website may record data for analytical purposes, the type of information we are interested in is generally at an aggregated level such as the countries where site visitors are located, or the most popular subject resource pages. This enables us to ensure we can focus our efforts and meet the needs of the students we produce resources for.

Children’s privacy

All of our products and services are intended for people aged 15 and over, with students of the International Baccalaureate Diploma Programme normally being aged 16 to 18.

We do not knowingly collect personally identifiable information from anyone under the age of 13, the definition of ‘children’ online in most jurisdictions. When interacting with people whether via our website, email, messaging service or phone, we do not request or record the age of the person. If a parent or guardian becomes aware that their child under the age of 13 has provided us with personal data, they should contact us. If we become aware that we have collected personal data from children without verification of parental consent, we will take steps to remove that information from our servers.

How and why we use your personal data

In order to conduct our business, data protection and privacy regulations allow us to hold and use your personal data to perform our contracts with you and for our legitimate business interests.

If you wish to change how we use your data, you’ll find details in the ‘Your rights’ section below.

If you choose not to share your personal data with us, or refuse certain permissions, you may not be able to place an order directly with us (you can still purchase our study guides through booksellers) or you may not be able to access resources on our website, some of which are complementary to (but provided independently of) our range of study guides.

Promoting and providing our products and services

We will use your details in connection with the products and services delivered by Peak Study Resources. This will include:

  • to process and fulfil orders placed with us, including communicating with you by sending emails confirming an order, invoice and payment information, status updates, and delivery confirmation where applicable;
  • processing payments and preventing fraudulent transactions. We do this on the basis of legitimate interest as it helps to protect our business and our customers from fraud;
  • using your personal data, preferences and details of your transactions to keep you informed by email or instant messaging or any means that you have used to contact us about relevant products and services including tailored special offers, discounts, promotions, events, competitions and so on. This will be on the basis that you have provided consent, or we believe it is a legitimate interest;
  • sending you communications required by law or which are necessary to inform you about changes to the services we provide you;
  • to develop, test and improve the products and services we provide to you, on the basis that this is in our legitimate business interest. This may include sending you surveys and feedback requests and processing your responses;
  • to comply with our contractual or legal obligations to share data with law enforcement or other relevant parties;

Website and electronic communications

We will use cookies, pixels and tags to identify which pages of our website are being used to help us analyse data about web page traffic and improve our website for our customers’ needs. A cookie is a small file which our web server asks permission to be placed on your computer’s hard drive. Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences. We use traffic log cookies to identify which pages are being used. This helps us analyse data about web page traffic and improve our website in order to tailor it to customer needs. Overall, cookies help us provide you with a better website, by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.

While as at the time of publishing this Privacy and Data Notice we do not place third party cookies connected with advertising services such as Facebook or Google, we may in the future if it is required to use their service and this may facilitate ‘remarketing’ where our products are advertised on other websites you visit. These cannot be used to identify you, and are simply used to indicate, “This person visited this page, so show them related ads”. Advertising service providers may also use more sophisticated methods on other platforms you may visit, over which we have no control, that result in our adverts being shown to you however this is not as a result of us providing any personal data.

We also collect and use Aggregated Data such as statistical or demographic data to build a general model of users and behaviours to improve and/or enhance our services. Aggregated Data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to understand and analyse demand and interest for our services. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Privacy and Data Notice.

Using your data for direct marketing

We want to provide you with information, offers and promotions that are most relevant to your interests at times. To help us form a better, overall understanding of you as a customer, we combine your personal data gathered as described above, for example your order history. For this purpose, we may also combine the data that we collect directly from you with data that we obtain when you post on social media relating directly or indirectly to our pages and/or posts.

Protecting your data

We know how much data security matters to all our customers. We will treat your data with care and take appropriate steps to protect it.

Our policy is to, where applicable and possible:

  • use https technology on all web interfaces in order to encrypt data between the user and the processing server;
  • use strong passwords and two-factor authentication to access online systems;
  • use strong passwords, access controls, and disk encryption on local systems where personal data is stored or processed;
  • minimise the number of systems where personal data is stored, and not duplicate data unnecessarily between systems;
  • regularly monitor our systems for possible vulnerabilities and attacks.

How long we hold your personal data

We hold any personal data linked to financial transactions for at least the legal requirements for record keeping, typically seven years.

We hold personal data linked to financial transactions that is not required to be held for legal requirements for:

  • up to three years if you are a customer;
  • as long as it is relevant to managing the business relationship if you are a business partner.

We hold personal data that is not directly linked to financial transactions and review it periodically for ongoing relevance. We recognise that some of the data we store or process relates to people who are following the two-year IB Diploma Programme, and therefore the maximum period which we will hold personal data depends on the nature of our relationship with you:

  • if you have identified yourself as a student then the retention period is up to two years, or when you have indicated you will complete the Diploma Programme;
  • if you have identified yourself as a parent then the retention period is up to two years, or longer if you indicate that you have children who have yet to start or complete the IB Diploma Programme;
  • if you have requested a one-time notification, for example to let you know when a book is back in stock, once that notification is served we may retain your information for a short time for analytical purposes (for example to measure the response rate to the notification) after which it is will be deleted;
  • if we have a current relationship with you (including, for example, a teacher or school administrator who is still in a relevant post) then we may retain a full contact history.

These periods may be overruled by you by your exercise of rights set out in the section below. Even if we are not legally compelled to, we will of course respect any request we receive from you regarding the personal data we hold about you.

Who we share your data with

We sometimes share your personal data with trusted third parties. The policy we apply to those organisations to keep your data safe and protect your privacy is:

  • where we need to share personal data with third parties, our selection criteria include the strength of their privacy and data policies and their compliance with relevant regulations;
  • we only provide the third party with the information they need to perform their specific services;
  • they may only use your data for the purposes we specify in our contract with them;
  • if we stop using third party services, we will request that any of your data held by them be deleted or rendered anonymous though this may be subject to any legal basis that requires them to retain your data.

Examples of the kind of third parties we have service agreements with are:

  • Companies who support our website and other business systems. Our main partners include Stripe and PayPal for website payments processing, and Royal Mail, DHL, and UPS for the carriage of orders.
  • Marketing companies who help us manage our advertising and communications with you. Where possible, we use products that do not require us to share data with the provider (e.g. self-hosting website analytics and email marketing). Our main third party providers are Meta (Instagram, WhatsApp and Facebook), Google, and LinkedIn, who we may pay for advertising to be targeted at specific audiences. For example, we may place an advertisement and ask it to be shown to International Baccalaureate students, but we are not provided with personal data about the audience and we would only get access to personal data if someone interacts with us directly as a result of seeing the advertisement.
  • Professional advisers who provide consultancy, banking, legal, insurance and accounting services.

Sharing your data with third parties for their own purposes

We do not share your data with third parties for their own direct marketing purposes.

For fraud management, we may share information about fraudulent or potentially fraudulent activity in our premises or systems. This may include sharing data about individuals with law enforcement bodies.

We may also be required to disclose your personal data to the police or other enforcement, regulatory or Government body, in your country of origin or elsewhere, upon a valid request to do so. These requests are assessed on a case-by-case basis and take the privacy of our customers into consideration.

We may share your personal data with third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may only use your personal data for the same purposes it was provided as set out in this privacy notice.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

Third-party links

Our website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and we are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice and exercise your privacy rights for every website you visit.

Where your data is processed

Peak Study Resources and its office-based systems are located in the UK. We do use ‘cloud-based’ providers where even though the computers accessing the systems are within the UK, the storage and processing of data may occur outside the UK. Our web and email servers are based in the UK and where possible we select providers whose internet-accessed servers are also physically located in the UK or EU.

Where your data is processed within the UK or the EU it is done so under the Data Protection Act or equivalent requirements. Where we use providers based in the US, we may transfer data to them if they are part of a regulatory scheme that requires them to provide similar protection to personal data. We fulfil customer orders to countries around the world, some of which may not have equivalent data and privacy protections, and while we select reputable delivery service partners we do not have control over national or local mail operators or customs agents that may have access to personal information required to deliver orders.

Your rights

Under data protection and privacy regulations you have a number of rights with regards to your personal data, these are:

  • the right of access to the personal data we hold about you;
  • the correction of your personal data when incorrect, out of date or incomplete;
  • the right to request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us to continue processing it;
  • the right to object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms;
  • the right to request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; or (c) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it;
  • the right to request the transfer of your personal data to you or to a third party;
  • the right to withdraw consent at any time where we are relying on consent to process your personal data.

You can contact us to request to exercise these rights at any time by any of the means set out at the start of this Privacy and Data Notice.

Your right to withdraw consent

Whenever you have given us your consent to use your personal data, you have the right to change your mind at any time and withdraw that consent.

Where we rely on our legitimate or legal basis

In cases where we are processing your personal data on the basis of our contract with you or our legitimate interests, you can ask us to stop for reasons connected to your individual situation.

However, depending on the data which you are requesting us to stop processing, this may result in us not being able to provide you with an ongoing service including an order in progress. In such cases where you accept that this may be the outcome, we must then do so unless we believe we have a legitimate or legal overriding reason to continue processing your personal data.

Direct marketing

You have the right to stop the use of your personal data for direct marketing activity through all channels, or selected channels. We must always comply with your request.

Checking your identity

To protect the confidentiality of your information, we will ask you to verify your identity before proceeding with any request you make under this Notice. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

If you have authorised a third party to submit a request on your behalf, we will ask them to prove they have your permission to act.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

Opting out of direct marketing

There are several ways you can stop direct marketing communications from us:

  • click the ‘unsubscribe’ link in any email communication that we send you. We will then stop any further marketing emails from that address;
  • contact us by any of the means set out at the start of this Privacy and Data Notice.

Please note that you may continue to receive communications for a short period after changing your preferences while our systems are fully updated. If you subsequently re-subscribe then this will override any previous request to opt out.

If you do not wish to participate in our Google Ads Remarketing, you can opt out by visiting Google’s Ads Preferences Manager.

The Regulator

If you feel that your data has not been handled correctly, or you are unhappy with our response to any requests you have made to us regarding the use of your personal data, you have the right to lodge a complaint with your country’s data or privacy regulator or with the Information Commissioner’s Office in the UK (www.ico.org.uk).