TemplateFor legal review before launch. Bracketed text is a placeholder. This isn't legal advice.
Privacy notice
Last updated: [DATE]
[COMPANY LEGAL NAME] ("we") is the controller of the personal data described here. Contact: [EMAIL ADDRESS], [ADDRESS]. [ICO registration number: NUMBER.]
What we collect, and why#
| Data | Why | Lawful basis |
|---|---|---|
| Name, email and company you send through a form | To reply to you | Legitimate interests |
| Account details: name, email, company, role | To provide your account | Contract |
| Billing details, handled by Stripe | To take payment and issue invoices | Contract; legal obligation |
| Sign-in and activity log: times, uploads, exports | Security and the audit trail your administrator can see | Legitimate interests |
| Website analytics, aggregated and without cookies | To understand which pages help | Legitimate interests |
Programme files you upload#
Programme files are your data. We process them on your behalf, as your processor, under our Data Processing Agreement. They usually contain little personal data, such as resource names or a responsible person's name in an activity code.
Who we share it with#
Only the sub-processors listed on our Security page, to run the service. We don't sell personal data.
Where it's processed#
In the European Economic Area and the UK. [Where a provider processes data outside them, the safeguard used, for example the UK International Data Transfer Addendum.]
How long we keep it#
- Form messages: [24 months].
- Account data: while your account is open, then [30 days].
- Billing records: as long as tax law requires ([6 years]).
- Uploaded programmes: see Security. [TO CONFIRM per decision D-008.]
Your rights#
You can ask to see, correct or delete your personal data, to restrict or object to processing, and to move it. Email [EMAIL ADDRESS]. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ico.org.uk).