What we collect, why, who sees it and how long we keep it.
RiskSorted Ltd, company number 17438978, registered office 66 Paul Street, London EC2A 4NA, is the data controller for the information described here. Contact us at [email protected] with any question about this policy or your data.
What you type into the assistant; your name, email address, phone number and company name; the site address and postcode; what the premises is used for, how many floors, whether anyone sleeps there and the other answers that set the price; any timing constraints or access notes; and your order details. We use this to price, book, schedule and deliver the service, to send your confirmation and certificate, and to keep the records the law requires. Lawful basis: performance of a contract with you.
Payment is taken by Stripe. We receive confirmation of payment and the last four digits of the card; we never receive or store the full card number. If you choose auto-renewal, Stripe stores your card so that a renewal can be charged later, and we hold the reference Stripe gives us. Lawful basis: contract.
Your sign-in email address, a record of sign-ins, the sites and certificates in your account, and the colleagues you invite. Documents you upload are read by an automated service to extract the type, dates and issuer; you confirm what it found before anything is saved. Lawful basis: contract, and our legitimate interest in keeping accounts secure.
Your name, phone number, email and what you asked about. Lawful basis: taking steps at your request before a contract, and our legitimate interest in responding to enquiries.
Your name, business name, contact details, base postcode, travel radius, services offered, qualifications, registrations and insurance details, and references where we ask for them. We use this to assess and verify your application. Lawful basis: taking steps at your request before a contract, and our legitimate interest in vetting the people who attend customers' premises.
Cloudflare, which hosts and protects the site, processes technical information such as your IP address and browser type for security and performance. Cloudflare Web Analytics gives us aggregated, cookie-free statistics. If you accept the cookie banner, Google's advertising tag stores a cookie recording that you arrived from one of our adverts so that a later booking can be attributed to it; if you reject, no advertising cookie is set. See our Cookies page. Lawful basis: legitimate interest for security and aggregate analytics; consent for the advertising cookie.
The assistant on our order page is powered by an AI model provided by Anthropic. Your messages, and the details of your booking, are sent to Anthropic's service to generate responses. Anthropic processes this data under contractual terms that do not permit it to be used to train their models. The assistant prices your booking from your answers using our published price list; no decision that has a legal or similarly significant effect on you is made solely by automated means. Conversations are stored by us so that we can deliver what was agreed, deal with any query, and improve the service.
We do not sell personal information and we do not share it with anyone for their own marketing.
Some of the providers above are based in, or process data in, the United States. Where that happens we rely on the UK–US Data Bridge for providers certified under it, or on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, so that your information has equivalent protection to that required in the UK.
You have the right to be informed, to access your data, to have inaccurate data corrected, to have data deleted where there is no longer a reason to keep it, to restrict or object to processing based on legitimate interests, to data portability, and to withdraw consent where we rely on it (for example, the advertising cookie). Email [email protected] and we will respond within one month. You can also complain to the Information Commissioner's Office at ico.org.uk.
Please note that where the law requires us to keep records — orders and invoices, for instance — we cannot delete them before the retention period ends, but we will limit how they are used.
What we use and how to change your choice is set out on our Cookies page.
The site is served over HTTPS. Certificates and reports are stored privately and only ever served through your signed-in account; there are no public links to them. Sign-in is by one-time emailed link. Access to systems holding personal data is restricted to those who need it, and our providers are bound by contract to protect what they process for us. No system is perfectly secure; if we become aware of a breach that affects your rights we will tell you and the ICO as the law requires.
The site and the services are for businesses and adults. We do not knowingly collect information from anyone under 16.
We will update this policy when what we do changes. The "Last updated" date at the top reflects the most recent version. Material changes to how we use information you have already given us will be notified by email.
RiskSorted Ltd
Company number 17438978
Registered office: 66 Paul Street, London EC2A 4NA
Email: [email protected]
Phone: 0330 043 3495
This policy is written in plain English by RiskSorted to meet the transparency requirements of UK GDPR. It does not constitute legal advice.