Legal

Privacy policy

Draft for counsel review — not yet published. Every blank from the previous draft is now filled in from the platform as actually built and deployed on 21 September 2026, and three statements that were factually wrong have been corrected — hosting location, retention, and technical data. Nothing factual is outstanding. What remains is marked FOR COUNSEL: legal decisions for a solicitor to make, not gaps for us to fill. Do not publish until one has reviewed it.

Last updated 21 September 2026 · draft 2

1. Who we are

The Workplace Compliance Company Ltd, trading as The Automated Decision Making Company (company no. 17330424, registered office 167-169 Great Portland Street, 5th Floor, London W1W 5PF) — "we", "us", "our" — operates a web-based tool that helps UK businesses assess their exposure under the automated decision-making provisions of the UK GDPR and the Equality Act 2010. This policy explains how we collect, use, store and protect personal data under the UK GDPR and the Data Protection Act 2018.

We are the controller of personal data about the people who hold logins to our service — your staff. Where your answers happen to contain personal data about anyone else, we act as a processor on your instructions, and our terms of service govern that.

By design we do not ask for, or knowingly process, personal data about the individuals your automated decisions affect. The questionnaire is written to be answered without it.

2. Data we collect

  • Account and user data: first and last name, email address, your password stored only as a one-way hash and never in readable form, the organisation and sub-organisation you belong to, and your role in it.
  • Sign-in data: if you sign in with Google we store a Google account identifier and your verified email address. We never receive your Google password.
  • Billing data: billing contact details, your plan and its history, credits bought and used, and invoice records. Card details are entered directly with Stripe and are never seen or stored by us.
  • Questionnaire answers: structured and free-text answers describing how your automated decision-making works. Please do not enter any individual's personal data into these fields.
  • Documents we generate for you: assessment reports, practical guides, DPIA drafts, retention and human-review policies, vendor due-diligence packs and procurement answers.
  • Staff training records: which modules a user has started and completed, quiz attempts and scores, and any certificate issued, including the name printed on it.
  • Compliance workflow data: remediation tasks and who they are assigned to, incident log entries you record, and requests you raise to refer a matter to a data protection officer.
  • Audit records: a log of significant actions — who generated or opened a report, and when — which exists so you can evidence your own compliance position.
  • Technical data: a session cookie that keeps you signed in, and your IP address held briefly in memory to limit repeated sign-in and sign-up attempts.

Corrected: the previous draft listed "device identifiers, IP address, and usage/session data". We do not collect device identifiers, and IP addresses are never written to our database — they exist only in memory, for a few minutes, to stop brute-force attempts.

3. How we use data

  • To run your account and produce the reports and documents you have paid for.
  • To take payment, manage your subscription, and provide support.
  • To tell you when a regulatory change affects a finding in a report we have already issued you.
  • To keep the service secure, including limiting repeated sign-in attempts.
  • To meet our own legal obligations, such as keeping financial records.

4. Our legal basis

  • Performance of a contract — running your account and delivering the service you bought.
  • Legitimate interests — keeping the service secure and preventing abuse. The data involved is limited, and the alternative is an unprotected service.
  • Legal obligation — financial and tax record-keeping.

5. Who we share data with

We do not sell personal data and we do not share it for advertising. We use the following providers, each processing data on our instructions under a data processing agreement:

  • Render — application hosting. Frankfurt, Germany.
  • Supabase — database and document storage. Frankfurt, Germany.
  • Stripe — card payments and subscription billing.
  • Resend — service emails such as password resets and reassessment reminders.
  • Google — only if you choose to sign in with a Google account.
  • Cloudflare — traffic routing and protection in front of the application.
  • Dropbox — encrypted off-site backups of our database.
  • Sentry — error reporting, so we find out when something breaks. Hosted in the EU. Crash reports deliberately exclude your form submissions, your cookies and your IP address; see section 9.
  • Vercel — hosting for this marketing website, which holds no account data.

FOR COUNSEL — we intend this to serve as the published sub-processor list under Article 28, with a commitment to notify customers before it changes. Please confirm the wording and an appropriate notice period.

6. Where your data is held

Corrected: the previous draft said data is hosted in the UK and that we make no transfers outside it. That was wrong. Our application and database are hosted in Frankfurt, Germany. Backups are held with Dropbox, and Stripe, Resend, Google, Sentry and Cloudflare process data on their own infrastructure. Our Sentry account is configured to the EU region, so error reports stay in Europe rather than defaulting to the United States.

Transfers from the UK to the EEA are permitted under the UK's adequacy regulations. For any provider processing outside the UK and EEA we rely on the UK International Data Transfer Addendum to the European Commission's standard contractual clauses. FOR COUNSEL — please confirm this holds for each provider named above, and whether a transfer risk assessment is required.

7. How long we keep data

Corrected: the previous draft set out a retention schedule we do not actually operate. We would rather say what is true than publish a commitment we do not keep.

Today: we keep account data, reports and the records in section 2 for as long as your account is open, and delete them on request. We do not yet run automated deletion, so it is done manually when you ask or when your account closes.

What we intend to move to, once automated deletion is built: reports and their supporting assessment records kept six years from generation so they remain available as evidence of the position at the time; account data deleted 90 days after an account closes; billing records kept six years for HMRC; audit logs kept six years.

FOR COUNSEL — please confirm these periods, and advise how best to describe the gap between current practice and intended policy.

8. Your rights

You can ask for a copy of your data, have it corrected or deleted, receive it in a portable format, object to processing, or ask us to restrict it. Email the address in section 10 and we will respond within one month.

One honest caveat: deleting a report removes your own evidence of the compliance position it recorded. We will point that out where it is relevant, so the choice is an informed one. It is not a reason for us to refuse.

If you sign in with a password you can change it yourself at any time. If you sign in with Google you can disconnect our access from your Google account.

9. How we protect data

  • Traffic is encrypted in transit, and data is encrypted at rest by our hosting providers.
  • Passwords are stored only as one-way hashes.
  • Access is limited to your own organisation and the part of it your role covers. This is enforced both in the application and independently in the database, so a mistake in one layer does not expose another organisation's data.
  • Generated documents are held in private storage and served only through an authenticated request.
  • Significant actions are recorded in an audit log.
  • Backups are encrypted, held separately from the live system, and restores are tested rather than assumed.
  • When something goes wrong, the error report sent to our monitoring tool deliberately leaves out what you submitted, your cookies and your IP address. We would rather diagnose a fault with less information than route your data through another service to do it.

10. Contact and complaints

The Workplace Compliance Company Ltd, company number 17330424, registered office 167-169 Great Portland Street, 5th Floor, London W1W 5PF.

For any privacy question, or to exercise your rights, email privacy@automateddecisionmaking.com. We will respond within one month, as section 8 says.

We have not appointed a Data Protection Officer. FOR COUNSEL — please confirm none is required under Article 37.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113 at any time. We would rather you came to us first, but you do not have to.