Privacy policy

Controller

{{legalName}}, {{street}}, {{postalCode}} {{city}}, {{country}}

Data protection contact

privacy@ready4ki.com

Supervisory authority

{{supervisoryAuthority}}

If you have a question about how we handle your data, write to the address above. You will get an answer from a person.

We process the minimum needed to run an account, deliver a report and take payment. We do not sell data, we do not run advertising profiles, and we do not train models on your assessment answers.

Most of what you give us is business information about your organisation rather than personal data. The personal data involved is largely the contact details of the people who use the service.

• Account data: name, work email address, organisation, interface language, password hash.
• Assessment answers: business information about your organisation, plus the identity of the person who answered.
• Order data: tier, amount, VAT status, invoice references. Card details are handled by Stripe and never reach us.
• Communication: messages you send through the contact or book-a-call forms.
• Technical data: IP address, user agent and timestamps in server logs, kept short-term for security and troubleshooting.

• To create and operate your account and organisation workspace.
• To run the assessment and produce your report.
• To take payment, issue invoices and meet tax obligations.
• To answer your enquiries.
• To keep the service secure and diagnose faults.
• With your consent, to measure how the website is used in aggregate.

• Art. 6 (1) (b) GDPR, performance of a contract: account, assessment, report delivery, payment.
• Art. 6 (1) (c) GDPR, legal obligation: retention of invoices and tax records.
• Art. 6 (1) (f) GDPR, legitimate interests: service security, fraud prevention, answering business enquiries.
• Art. 6 (1) (a) GDPR, consent: analytics and marketing cookies, which are off until you switch them on.

We use a small number of processors, each bound by a data processing agreement. They may process data only on our instructions.

Where a processor processes data outside the European Economic Area, the transfer is covered by the European Commission's Standard Contractual Clauses together with supplementary measures where required.

Data residency is one of the four controls we state explicitly in every report, and we hold our own platform to it. The specific region is agreed with enterprise customers before onboarding.

• Account data: for as long as your account exists, then deleted.
• Assessment answers and reports: for the duration of the engagement plus {{retentionEngagement}}, so you can come back to your own report.
• Invoices and tax records: for the statutory retention period, currently {{retentionTax}}.
• Server logs: {{retentionLogs}}.

Deleting your account removes your personal data immediately, except where a statutory retention obligation applies.

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object (Art. 21). Where processing is based on consent, you may withdraw it at any time with effect for the future.

You can delete your account yourself from Settings. For anything else, write to privacy@ready4ki.com and we will respond within one month.

You also have the right to lodge a complaint with a supervisory authority, in particular in the member state of your residence, place of work or the place of the alleged infringement.

Your report is generated automatically from your own answers, and the maturity stage is derived by a scoring engine. This is not a decision producing legal effects concerning you or similarly significantly affecting you within the meaning of Art. 22 GDPR: it is an assessment of your organisation, reviewed by people before it is acted on.

No automated decision is made about individuals, not about employment, creditworthiness or access.

Access to customer data is scoped to the owning organisation at the database level with row-level security. Locked report sections are filtered on the server before a page is built, so content you have not purchased is never sent to your browser.

We use transport encryption throughout, keep audit trails of privileged operations, and design logging and human oversight in from the start rather than retrofitting them.

We set only strictly necessary cookies by default. Analytics and marketing cookies require your consent and are off until you give it. The full inventory and the controls are on the cookie policy page.

We update this policy when the service changes. The date at the top always reflects the current version. Material changes are announced by email to account holders.