Privacy notice

1. Who is responsible

Denver House Consultancy Ltd, trading as SchemeReady, company number 15473342, registered office 82a James Carter Road, Mildenhall, Suffolk IP28 7DE, is the controller for your account (section 3): your name, your work email address, your sign-in and the record of what your account has done. For what you type into an assessment, which is often personal data about your own workers, you are the controller and we are your processor (sections 2 and 10). We hold it, keep it available to your firm, and do nothing else with it. Contact us at [email protected]. We do not have a data protection officer. The director handles privacy questions.

If the template pack is ever sold by card, the payment provider named at checkout is a separate controller for that purchase (section 4). You are the controller for anything about your own workers that you type into the app or upload for review (section 10).

2. Your assessment: your account and your devices

Your organisation details, profile, answers, notes, evidence locations, site visit records, logo, action plan and the reports you generate are saved in two places.

• On the device you are using, first, in the browser's own storage. That is what lets the site walk work with no signal. Anything you type while offline reaches your account when you are next online.
• In your account, held for you in our database so that anyone you have invited to your firm sees the same assessment on any device. Our database is Cloudflare D1. Section 5 says where it runs.

Denver House administrators can read your assessment. An administrator can open your answers, notes, evidence locations, site visit records, profile and action plan from our administration tools, to support you and to run the service. Other Denver House staff can see that an assessment exists, how far along it is and when it was last touched, but not what it says. Every time an administrator reads an assessment it is recorded in your account's history, and you can ask us for that record. Louise Postill, our director, audits firms for certification bodies, and she does not read the assessment of a firm she audits or has audited in the last two years. There is no bulk export from our administration tools.

If you accept an invitation from an assessment body (a consultancy or certification body you work with), it can read your full report once you have completed the assessment, for the standards named in the invitation: the score and band, every section, every question with your answer and any note you wrote, where you keep your evidence, your site visit records and your action plan. That is the same report you can print yourself, and it is what the consent wording you agree to says. It sees nothing before you complete, cannot sign in to your account and cannot change anything in it. Every time someone at the assessment body opens your report, you can see that it happened. You can end the arrangement yourself at any time.

A copy you export is written to your device and goes only where you send it. Your assessment stays in your account as well.

The free check on this site is different. Its answers are scored in your browser and are not sent anywhere.

You can delete an organisation and its assessments from within the app, which removes them from your account and from your devices. Closing your account (section 11) removes the rest, apart from the records section 9 says we keep after closure.

3. What reaches Denver House

Personal data about you, as a person, reaches us in four ways.

• Your account. When your account is set up we hold your name, your work email address, a one-way hash of your password (never the password), which firm you belong to and with what role, the devices you have signed in on, and a history of what your account has done: sign-ins, invitations, changes to who can see what, each time a Denver House administrator read your assessment, and each time an assessment body opened your report. We use it to sign you in, to keep your firm's people and their access straight, and to tell you when something has changed. Lawful basis: performance of the contract. We keep your details, sign-in and devices for the life of the account and for thirty days after you close it, then delete them. The history of what your account has done is kept in our database after the account closes. Section 9 says for how long.
• The support inbox. When you email us you give us your name, your email address, and whatever you write, which for a refund includes your invoice number. We use it to answer you and to process refunds. Lawful basis: performance of the contract, and our legitimate interest in running the product. We keep support mail for two years after the last message, then delete it.
• Your invoice. Your firm's name and address, the email address we send the invoice to, and what was bought, kept with our accounting records for six years, which the law requires. Lawful basis: performance of the contract, and our legal obligation to keep accounting records.
• Cloudflare request logs. Our host records the IP address, browser type and requested page of every visit for security and to keep the service running, in the way any web server does. We can see aggregate figures and, for a short time, individual request logs. Lawful basis: our legitimate interest in keeping the site secure and available.

We do not buy, sell, rent or share personal data for marketing, and we do not send newsletters. We will only email you in reply to something you sent us, or if we have to tell you something about your licence.

4. Payment

We invoice you ourselves. The invoice carries your firm's name, the address you gave us and the email address we send it to, and we keep it with our accounting records for six years, which the law requires. We never see card details. If you pay by bank transfer, your bank handles it. If the template pack is ever sold by card, the payment provider named at checkout takes the payment under its own privacy notice, and we see the order but not the card.

Nothing about your assessment is involved in payment. What your licence includes is set by us when the invoice is paid, and the app reads it from your account when you sign in. There is no licence key, and nothing is checked with anyone else.

5. Hosting and Cloudflare

The site and the app are hosted on Cloudflare Pages, a service of Cloudflare, Inc. of San Francisco, United States, which serves them from data centres around the world including the United Kingdom. Cloudflare processes request data (IP address, browser type, requested page, timing) as our processor for hosting and security. The Pro review runs on a Cloudflare Pages Function, which is also our processor for the moments the data passes through it. Cloudflare's own privacy notice and data processing addendum apply to what Cloudflare does with the traffic.

6. The Pro evidence review

The Pro review is the one feature that sends your content to anyone other than Cloudflare, our host, and you choose whether and when to use it. The Pro upgrade includes one run per licence. Here is the path it takes.

1. You choose up to twelve documents, the questions they relate to and, in effect, your answers to those questions. Your browser sends them, from your signed-in account, to a small server function that we run on Cloudflare.
2. Our function checks that your account includes the review, then passes the documents, the selected questions and those answers to the AI provider, Anthropic, PBC of San Francisco, United States, through its API, for the duration of one request. Nothing else from your assessment is sent.
3. The provider returns the review, our function streams it back to your browser, and the request ends. The files are removed from the provider's file store at the end of the request. Each one is also sent with a one hour expiry, and a nightly check by us removes anything left behind, so a file cannot outlive the hour.
4. Our function does not store your documents. It records the run against your account: the date, the names of the documents, which questions were chosen, the findings, and what the run cost. The findings are kept for twelve months so that you and your colleagues can read them and the report can print them, then they are removed. The record of the run itself stays for the life of the account.
5. Anything in a document that reads as an instruction to the reviewer is ignored and reported to you, and card numbers, National Insurance numbers, web addresses and email addresses are removed from the findings before they are saved.

The provider's own API terms govern what it keeps of the request itself. At the time of writing they say that inputs and outputs may be retained for a limited period for safety and abuse monitoring. Check the provider's current policy before you upload if that matters to you. We will update this section if it changes.

Because the documents go through two other companies for the length of a request, please leave out what the review does not need. Dates of birth, National Insurance numbers, home addresses, bank details and photographs of people are never needed to check a training matrix or a method statement. Redact them, or upload a version without them. You are responsible for having the right to share what you upload.

7. Cookies and analytics

The website sets no cookies. When you sign in, the app sets one cookie that holds your session and one that protects the forms you submit. Both are strictly necessary to keep you signed in, so no consent banner is needed for them. Both are cleared when you sign out. The app also uses your browser's own storage for the on-device copy described in section 2. The public pages of the website, but not the app, use Cloudflare Web Analytics to count visits and to see how quickly pages load. It sets no cookie and stores nothing on your device. For each page viewed, Cloudflare receives the address of the page, the page you came from, your browser and type of device and how long the page took to load, and works out your country from your connection. It does not use any of this to identify you or to follow you from one website to another, and we see only totals. We use it because we have a legitimate interest in knowing which pages help people and which are slow. Nothing from inside the app, and nothing about your account or your assessment, is sent to it.

8. Transfers outside the UK

Cloudflare and the AI provider are United States companies. The data that reaches them under sections 5, 6 and 7 therefore leaves the United Kingdom. For each of them we rely on the data protection terms in their contracts with us, which include the standard data protection clauses that UK law recognises for transfers to the United States, together with the safeguards described above: request logs are short-lived, review documents are held only for the length of a request, and your account and assessment are held by Cloudflare as our processor under its data processing addendum. If the template pack is sold by card, the payment provider is also a United States company and its own terms cover that purchase. If you would like a copy of the relevant terms, ask us.

9. How long we keep things

10. Personal data about your workers

The training register, the site visit record and several questions ask about named people: who holds which card, who walked which site, who signed what. That is personal data about your workers. You decide what to type and how long to keep it, so you are its controller. We hold it in your account and keep it available to your firm, so we are your processor. The terms of licence set out what we do and do not do with it. Keep what you export, and the registers workbook, as carefully as you would keep the paper versions. Tell your workers that you hold the records, and delete them when you no longer need them. If you upload a training register to the Pro review, section 6 applies to it.

11. Your rights

For the data we hold about you (section 3) you have the right to ask for a copy, to have it corrected, to have it deleted, to object to our use of it, and to ask us to restrict it. You can export any assessment from within the app at any time. To close your account, ask us. Everything stops at once and every owner is emailed. Thirty days later the account is deleted and we cannot restore it, apart from the records section 9 says we keep after closure and the backups it describes, which age out on their own. Any owner can cancel the closure within the thirty days. Email [email protected] and we will answer within one month. If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk, though we would rather you told us first.

SchemeReady is a business product and is not intended for use by children.

12. Changes and contact

If we change how data is handled, for example by turning on analytics or changing the AI provider, we will update this notice, change the version and date at the top, and note it in the change log. Questions: [email protected], or write to Denver House Consultancy Ltd, 82a James Carter Road, Mildenhall, Suffolk IP28 7DE.