Your data rights

Everything the portal holds about you is yours to see, correct, take away or have deleted. This page says exactly what you can ask for, and what happens when you do.

Who answers for it

The Court of Master Sommeliers is the data controller — it decides what is collected and why. The portal is built and run on the Court’s behalf by SOMM DIGI AI, which acts on its instructions and for no other purpose.

In writing, that is Court of Master Sommeliers, 33 Felhampton Road, London, SE9 3NT, registered in England and Wales under company number 5485362. A request sent to that address reaches the same people as one sent by email.

Requests go to rsayburn@courtofmastersommeliers.org and are answered within one month. There is no charge. You do not need to give a reason, quote an article, or use any particular form — a sentence saying what you want is enough.

For a copy of your data you need not write at all: sign in and use Download my data on your account page. It gives you everything the portal holds about you, at once, as a file.

What you can ask for

A copy of everything

Your account, your reading record, your notes, your quiz attempts, your saved words and your visit records — sent to you in a form you can read.

A correction

Anything wrong or out of date put right. Your name and level you can change yourself, at once.

Deletion

Your account and your study record removed. You can do this yourself from your account, and it takes effect immediately. What must be kept is named below.

Your data in a portable form

Everything you gave us or created here, in a structured, machine-readable file you can take elsewhere.

An objection

To anything held on the Court’s legitimate interests rather than to run your membership — the visit records are the only such thing here. Object and they stop.

A restriction

That we hold something but stop using it, while a disagreement about its accuracy is worked out.

Why each thing is held

Data protection law requires a lawful basis for everything kept. These are the ones that apply, and there are only three:

To perform your contract

Your email address and password, your membership and its renewal date, and your study record. Without these there is no account, no way to sign you in, and nothing to remember where you were.

The Court’s legitimate interests

Visit records — page, day, approximate city and country, IP address — kept so the Court can see how many candidates it has and where, and recognise an account being shared. Deleted after 90 days. This is the one basis you may object to outright.

A legal obligation

Payment and tax records, kept for as long as UK tax law requires. These are the one thing deleting your account does not remove, because the Court is not permitted to remove them.

Nothing here is held on the basis of consent, which is why you are not asked for any — and nothing is used for advertising, sold, or shared for anyone else’s marketing.

No decisions are made about you by machine

Nothing in the portal profiles you or decides anything about you automatically. Your quiz results are marked against the book’s own answers and shown to you; they are not used to judge you, rank you, or affect anything outside the portal. Passing an examination of the Court depends on the examination, never on this.

Where your data actually is

Four companies process data on the Court’s behalf, each for one job. This is where each one holds or handles it:

Said plainly: the database and the code that reads it are both in London, so your account and your study record do not leave the United Kingdom. Only Stripe and Resend sit outside it — your email address reaches them to take a payment or send a letter — and each is covered by the safeguards named above. Card details never reach the Court at all; Stripe holds those.

Complaining

Write to us first — most things are settled in one email. If you are not satisfied with the answer, you have the right to complain to a regulator, and you can do so without going through us:

• United Kingdom — the Information Commissioner’s Office, ico.org.uk.
• European Union — the supervisory authority in the country you live or work in, or where you think the problem happened.

The rest of it

What is recorded and why is set out in the privacy notice. What is kept in your own browser is in the cookie notice. What you are buying is in terms of membership.