Privacy Policy

We process your data under the following lawful bases:

We do not use your assessment data for marketing, profiling, or sale to third parties.

4.1 We share data with the following third-party processors under appropriate data processing agreements:

4.2 We do not sell your data to any third party.

4.3 We may disclose your data if required by law, court order, or regulatory authority.

We use Plausible Analytics to understand how visitors use our website.

Plausible does not use cookies and does not collect personally identifiable information. It records page views and custom events in aggregate only.

Data collected by Plausible includes:

• Pages visited
• Referring website
• Browser type
• Country (derived from IP address, not stored)

Your IP address is not stored by Plausible.

No consent is required for Plausible analytics under UK GDPR as no personal data is processed.

We use only strictly necessary cookies.

We do not use advertising, tracking, or analytics cookies.

Full details are in our Cookie Policy.

We apply different retention periods depending on the type of data:

After the applicable retention period, data is securely deleted or further anonymised.

You have the right to request erasure of your personal data under UK GDPR Article 17. When we receive a valid erasure request, we will process it within 30 days.

Where we anonymise data in response to an erasure request, the resulting anonymised data no longer constitutes personal data under UK GDPR. Anonymised records cannot be used to identify you and are not subject to data protection law. We use anonymisation as a privacy-preserving alternative to deletion where we have legitimate interests in retaining the underlying record.

Under UK GDPR you have the right to:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate personal data.
• Right to erasure: Request anonymisation of your personal identifiers (subject to legitimate retention interests as described in Section 7A).
• Right to restriction: Request that we restrict processing of your data in certain circumstances.
• Right to data portability: Receive your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests.
• Right to withdraw consent: Where processing is based on consent, withdraw it at any time.

You can exercise your data rights at any time by visiting your Privacy & Data settings at crownsync.uk/account/privacy. For requests that cannot be handled automatically, contact [email protected].

We will acknowledge all data subject requests within 72 hours and respond in full within 30 days of receipt. If we need additional time (up to a further 2 months for complex requests), we will notify you within the initial 30-day period explaining the reason for the delay.

Contributors and remediation assignees

If you have been invited to contribute to an assessment or assigned a remediation task, your name and email address are processed by CrownSync on behalf of the organisation that invited you. You can submit a data subject request directly via our privacy portal at crownsync.uk/account/privacy after creating a free account, or submit an erasure request at /privacy/erasure-request without creating an account, or email [email protected].

Board sign-off participants

Where an assessment owner requests board sign-off, we process the name, job title, and email address of the director or signatory to send the sign-off request and record the declaration. Upon approval or rejection, the signatory’s IP address and timestamp are recorded for audit purposes. A partial IP address is visible to the assessment owner as confirmation that the sign-off was completed. The full IP address is retained in system audit logs accessible only to CrownSync administrators. Sign-off participants may exercise their data rights by contacting [email protected]. The legal basis for this processing is legitimate interests — specifically the organisation’s interest in maintaining a tamper-evident record of the sign-off declaration.

In the event of an erasure request from a signatory, their name will be replaced with “Former Signatory” in all records. The sign-off decision, timestamp, and role/title are retained for 6 years as part of the organisation’s governance record. This anonymised record no longer constitutes personal data under UK GDPR.

Automated reminders

Where contributors have been assigned tasks with deadlines, we may send automated reminder emails at 7 days, 3 days, 1 day before deadline, and after the deadline passes. Recipients may contact the assessment owner to be removed from assignments.

You also have the right to lodge a complaint with the Information Commissioner’s Office:

• Website: ico.org.uk/concerns
• Helpline: 0303 123 1113

We implement the following security measures:

• All data transmitted over HTTPS/TLS
• Database encrypted at rest
• Access controls limiting staff access to personal data
• Authentication via Clerk with MFA available
• Regular security updates applied within 14 days of release
• Audit logging of all significant data access

We regularly update our software dependencies and address security vulnerabilities as part of our commitment to keeping your data secure. Security updates are applied within 14 days of release.

We regularly review security advisories for our software dependencies. Where vulnerabilities require major version upgrades that would introduce breaking changes, we assess the practical risk in the context of our infrastructure before upgrading. Our application is protected by a Web Application Firewall and authenticated access controls which mitigate the majority of known vulnerabilities in our current dependency versions.

We will notify you and the ICO of any personal data breach within 72 hours of becoming aware of it, where required by law.

CrownSync is built on infrastructure from providers that hold independent third-party security certifications. We selected these providers specifically because of their security posture and compliance with international standards relevant to UK and European data protection law.

Some of our third-party processors are located outside the UK/EEA (specifically Clerk and Resend in the United States). These transfers are protected by Standard Contractual Clauses approved by the ICO.

Your assessment data and organisation data is hosted by Hetzner within the European Union and does not leave the EEA.

Storing data on EU-based servers is fully compliant with UK GDPR. The European Union has been granted adequacy status by the UK government, meaning data transfers between the UK and EU meet the required legal standards.

We may update this Privacy Policy from time to time. We will notify you of material changes by email at least 14 days before they take effect.

The current version is always available at crownsync.uk/privacy-policy.