1. Who is responsible for your personal data?
For the purposes of applicable data protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and applicable amendments, the controller is the operator of ConsultTemplate: ConsultTemplate.com, contact email: services@consulttemplate.com, business address: Virtual Office, Ellesmere Port, CH66 1TL.
This Privacy Policy explains how we collect, use, disclose and protect personal data when you visit consulttemplate.com, contact us, request a free resource, complete the Compliance Health Check, purchase or licence Digital Materials, use a platform account, book an assessment, receive a report, or otherwise interact with us.
2. Personal data we may collect
Contact and identity data: name, business name, job title, email address, telephone number, postal address and other contact details you provide.
Account and licence data: login identifiers, account preferences, authorised-user details, organisation name, licence type, licence ID, purchase date, licence status, download history and related administration records.
Order and transaction data: products or services ordered, invoices, payment status, billing details, refund records and transaction references. Payments made through our Stripe checkout are processed by Stripe. We receive order and payment-status information, not full payment-card details. See Stripe’s Privacy Policy.
Enquiry and communications data: messages, support requests, feedback, complaint details, survey answers and records of communications with us.
Health Check and assessment data: answers about your organisation, compliance priorities, operational processes, premises, hazards, accessibility, home or workplace safety, and information needed to prepare an assessment report or action plan. Please do not provide unnecessary sensitive personal data.
Platform and technical data: account activity, documents and information uploaded by users, workflow records, audit entries, reminder settings, device/browser information, IP address, log data, timestamps and security events, where the relevant features are enabled.
Marketing preferences: whether you have opted in or out, the source and date of your preference, email engagement data where lawfully collected, and your preferences for communications.
Website and cookie data: information collected through essential cookies and, where enabled and consented to where required, analytics, advertising or similar technologies.
3. How we collect data
- Directly from you when you complete forms, request a resource, complete the Compliance Health Check, contact us, make a purchase, create an account, book an assessment or communicate with our team.
- Automatically through the Website, account systems, server logs and cookies or similar technologies, subject to applicable consent requirements.
- From your organisation or an authorised representative who books a service, creates an account or provides information on your behalf.
- From service providers involved in payment, hosting, security, communications, scheduling, analytics or customer support, where relevant.
- From public or third-party sources where necessary for a requested business assessment, such as publicly visible business listings, search results or business websites. We will not treat publicly available contact details as automatic permission to send marketing.
4. Why we use personal data and our lawful bases
We identify a lawful basis for each processing purpose. Depending on the circumstances, our bases may include performance of a contract or steps requested before entering a contract; compliance with a legal obligation; legitimate interests, where those interests are not overridden by your rights; and consent, where required or where we choose to rely on it.
Purpose |
Use |
Potential lawful basis |
|---|---|---|
Responding to enquiries and proposals |
To respond, provide requested information and prepare proposals. |
Pre-contract steps; legitimate interests for general business correspondence. |
Delivering purchases and services |
To process orders, provide downloads, administer licences, deliver assessments and reports, manage subscriptions and provide support. |
Contract; legal obligation for relevant records. |
Free Compliance Health Check and resources |
To generate requested outputs, deliver resources and improve the relevance and reliability of the service. |
Contract or steps requested by you; legitimate interests for service improvement where appropriate. |
Platform operation and security |
To authenticate users, provide requested features, manage permissions, maintain logs, prevent abuse and troubleshoot faults. |
Contract; legitimate interests; legal obligation where applicable. |
Billing, tax and accounting |
To maintain invoices, payment records and required business records. |
Contract; legal obligation. |
Service communications |
To send order confirmations, licence notices, service updates, security messages, appointment information and important changes. |
Contract; legitimate interests; legal obligation where applicable. |
Marketing |
To send newsletters, product updates, offers and related promotional communications. |
Consent where required; or another lawful route permitted by applicable direct-marketing law, including PECR where relevant. We assess the subscriber type and circumstances before relying on an exception. |
Website measurement and cookies |
To operate essential website functions and, where enabled, understand website performance or measure campaigns. |
Strictly necessary technologies may be used where legally exempt; consent or another applicable legal condition for non-essential technologies. |
Claims, disputes and compliance |
To establish, exercise or defend legal claims, respond to lawful requests and demonstrate compliance. |
Legitimate interests; legal obligation; establishment, exercise or defence of legal claims where applicable. |
Where we rely on legitimate interests, those interests may include operating and securing our services, managing customer relationships, improving products, preventing fraud and protecting intellectual property. We consider necessity and balance those interests against individuals’ rights. We will not use one lawful basis as a blanket justification for unrelated processing.
5. Direct marketing and your choices
We may send marketing emails where you have given valid consent or where another route is permitted by applicable law. The rules differ between corporate subscribers and individual subscribers, including sole traders and some partnerships. We will assess the recipient type and circumstances rather than assume that every business email address can be marketed to. We do not treat the mere public availability of an email address as consent.
You can opt out of marketing at any time by using the unsubscribe link in the message or contacting the email address in Section 18. We will action the request and retain a minimal suppression record where necessary to ensure that we respect your choice. Opting out of marketing does not prevent service or transaction messages that are necessary to fulfil a purchase, manage an account or meet legal obligations.
6. Cookies and similar technologies
The Website may use cookies, pixels, local storage or similar technologies. Strictly necessary technologies may be used to provide functions you request, such as security, account access or checkout. Non-essential analytics, advertising or tracking technologies will be used only where the required consent or other applicable legal condition has been obtained.
We will provide a cookie notice and preference mechanism where required, explain the purposes of the technologies actually in use, and allow you to change your preferences. You may contact us for information about the technologies used on the Website.
7. Who we share data with
We may disclose personal data, limited to what is necessary, to the following categories of recipients:
- Website hosting, cloud storage, database, security and IT support providers.
- Payment processors, invoicing and accounting providers.
- Email delivery, customer relationship management, newsletter and support providers.
- Scheduling, assessment, mapping, analytics or search-related providers where needed to deliver a requested service.
- Professional advisers, insurers, auditors and legal representatives where reasonably necessary.
- Public authorities, regulators, law enforcement or courts where required by law or necessary to protect legal rights.
- A purchaser or successor in connection with a genuine business sale, restructuring or transfer, subject to appropriate safeguards.
We do not sell personal data to third parties. Our Website uses Lovable Cloud for hosting and cloud services and Stripe for payments. See Lovable’s Privacy Policy and Stripe’s Privacy Policy. Where a provider processes data on our behalf, we will put in place appropriate contractual terms and safeguards.
8. International transfers
Some suppliers may process or access personal data outside the United Kingdom. Where a restricted transfer occurs, we will use a lawful transfer mechanism and required safeguards, such as applicable UK adequacy regulations, the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, and conduct any required transfer risk assessment. You may contact us for further information about relevant safeguards, subject to lawful limitations.
9. How long we keep data
We keep personal data only for as long as reasonably necessary for the purposes described in this Policy, including legal, accounting, contractual, security and dispute-resolution requirements. Retention depends on the type of information and the purpose for which it is held. The following criteria apply:
- Enquiries and proposals: for the period needed to respond and manage the relationship, then deleted or minimised unless a longer period is justified by a contract, dispute or legitimate business need.
- Customer, order, invoice and tax records: for the period required by applicable tax, accounting and limitation rules.
- Accounts, licences and platform records: for the duration of the account or licence and a reasonable period afterwards for support, security, audit trail and dispute handling.
- Assessment information and reports: for the period needed to deliver the service, manage follow-up and handle liability or complaints, based on a documented retention schedule.
- Marketing preferences and suppression records: until you withdraw consent or object, with minimal suppression information retained as needed to respect the opt-out.
- Technical logs and cookie data: according to the purpose, security needs, cookie lifetime and retention settings of the relevant system.
When information is no longer needed, we will securely delete it, anonymise it or otherwise dispose of it in accordance with our retention procedures, subject to lawful exceptions.
10. Security and data breaches
We will implement technical and organisational measures appropriate to the nature and risks of the personal data we process. Measures should include, as applicable, access controls, least-privilege permissions, secure authentication, backups, updates, encryption in transit, supplier due diligence, staff confidentiality and incident response procedures. No system can be guaranteed completely secure.
If a personal data breach occurs, we will assess it and notify the Information Commissioner’s Office and affected individuals where and when required by law.
11. Your data protection rights
Subject to applicable legal conditions and exemptions, you may have the right to request access to your personal data, correction of inaccurate data, erasure, restriction of processing, data portability, and to object to certain processing. Where processing relies on consent, you can withdraw consent at any time; withdrawal does not affect processing carried out before withdrawal.
You have an absolute right to object to the use of your personal data for direct marketing. If we rely on legitimate interests, you may object and we will stop unless we have compelling legitimate grounds that override your interests, rights and freedoms or the processing is needed for legal claims, as provided by law.
To exercise a right, contact the email address in Section 18. We may need to verify your identity and clarify your request. We normally respond within the period required by law. Rights are not absolute and may be subject to lawful restrictions.
12. Complaints and the ICO
Please contact us first if you have a concern about how we handle personal data, so we can try to resolve it. You also have the right to complain to the UK Information Commissioner’s Office (ICO). Guidance and contact details are available at ico.org.uk.
13. Children and household/residential assessments
Our business-facing products and services are not directed at children. A parent, guardian, homeowner, tenant or authorised adult may provide information relevant to a residential assessment, including information about a child or vulnerable person where necessary to evaluate safety. Please provide only information relevant to the assessment and avoid unnecessary medical or other sensitive details. We will handle any personal data relating to children or vulnerable people with particular care and use it only for the relevant service, legal obligations and related legitimate purposes.
14. Automated recommendations and profiling
The Compliance Health Check or platform may use rules, scoring or automated logic to generate recommendations, readiness indicators, reminders or action priorities from information you provide. These outputs are intended to support your judgement and are not a formal certification decision or legal determination. The Compliance Health Check provides informational recommendations; it does not automatically decide eligibility, grant certification or impose legal obligations. Contact us if you have questions about your results. Where applicable law provides rights in relation to automated decision-making, those rights remain unaffected.
15. Data you provide about other people; business customer responsibilities
If you provide personal data about employees, contractors, household members, customers or other people, you must have a lawful basis and authority to share it with us, provide any required privacy information, and minimise the data to what is necessary. Where we process personal data solely on behalf of a business customer through the Platform or a service, the parties may need a separate data processing agreement setting out instructions, confidentiality, security, subprocessors, assistance with rights requests, breach notification, deletion/return and audit arrangements.
16. Third-party websites and services
Our Website may contain links to third-party websites or services. Their handling of personal data is governed by their own policies. We encourage you to review those policies before providing information to them. This Policy applies to processing for which ConsultTemplate is responsible.
17. Changes to this Policy
We may update this Policy to reflect changes in our services, systems, suppliers or legal requirements. The latest version will be published on the Website with its effective date. If a change materially affects how we use personal data, we will provide additional notice where required.
18. Contact us
Privacy enquiries and rights requests: services@consulttemplate.com
Website: consulttemplate.com
Business address: Virtual Office, Ellesmere Port, CH66 1TL