Privacy notice

Who is responsible

The controller for the processing described here is the operator of this site, named above. Write to the address given there for anything to do with your data, including the requests described under your rights.

The assessment stays in your browser

Your answers to the ten assessment questions are stored in your own browser, using local storage, so that they survive when you move from the results to the compliance pack. They are not sent to us and we never see them.

When you ask the site to generate the pack, your answers and the organisation details you type are sent to the server so the documents can be written. They are used to compose the response and are discarded when it is sent. Nothing from that request is stored.

Clearing your browser data removes the answers permanently. There is no copy anywhere else.

If you ask to be kept informed

If you tick the consent box on the results page and submit your email address, we store three things: the address itself, which obligations the assessment found applied to you, and the exact wording you agreed to along with the date you agreed to it.

We keep the wording because the law places the burden of demonstrating consent on us, and a record that merely says you consented does not demonstrate what you consented to.

We do not store your underlying answers with your address. The list of obligations is a summary, not the questionnaire.

• Legal basis: your consent, under Article 6(1)(a) GDPR.
• You can withdraw it at any time, using the unsubscribe link in any message we send or by writing to us.
• Withdrawing is as easy as giving it, and does not affect anything sent beforehand.

What we do not do

This site sets no cookies, for any purpose. There is no advertising network, no tracking pixel, no social media button phoning home, and no profiling of any kind. That is why you have not been shown a cookie banner: there is nothing to ask you about.

We do count a few things, and would rather say so than let you discover it. When a document pack is opened, or a purchase link is followed, or an address is submitted, or someone arrives through a link handed out in an email or a post, a number goes up by one. What is stored is a name, a date and a total: eleven packs opened on a Tuesday, or four arrivals from email. That last label describes the batch of letters, never the person who was written to, and the labels are a fixed short list rather than something generated per recipient. Nothing else is attached, so there is no identifier, no address and none of your answers, and there is no way to work backwards from a total to any one visitor. It is not personal data and it is not run through any outside service.

The local storage described above is used only to carry your own answers between two pages of the service you asked for, which is why it does not require consent either.

We do not sell, rent or share your address with anyone for their own marketing.

Others who process data for us

The site runs on Cloudflare, which hosts it and keeps short-lived technical logs that include IP addresses, as any web server must in order to serve pages and resist abuse.

If you buy the compliance pack, the payment is handled by Lemon Squeezy, which acts as the seller of record and receives whatever you give it at checkout. We never see your card details.

Subscriber addresses are not passed to anyone. They are stored in a database on Cloudflare, in Europe, beside the site itself, and no separate mailing company holds a copy. If one is ever used to send the updates you asked for, this notice will name it before the first message goes out.

Transfers outside the EEA

Some of those providers are established in the United States, so your data may be processed outside the European Economic Area. Where that happens, the transfer relies on the European Commission's standard contractual clauses or on an adequacy decision covering the provider.

How long anything is kept

Your assessment answers last as long as you leave them in your browser and no longer.

A subscriber address is kept until you withdraw consent, after which it is removed from the list. A minimal record that consent was withdrawn may be retained, because being unable to show that we honoured a withdrawal is its own problem.

Server logs are short-lived and are kept only for the retention period of the hosting platform.

Your rights

Under the GDPR you may ask for a copy of the personal data we hold about you, ask for it to be corrected or erased, ask us to restrict what we do with it, object to the processing, and ask to receive it in a portable form. Where processing rests on consent, you may withdraw that consent at any time.

Write to the contact address above and we will answer within one month. If you are not satisfied with the answer, you may complain to the data protection authority in the country where you live or work.

Changes

If this notice changes materially, the date at the top changes with it, and anyone on the mailing list is told in the next message rather than left to notice on their own.