Privacy Policy

This privacy policy applies to the website workplacecomply.co.uk ("the Website"). The Website is operated by WorkplaceComply. For privacy enquiries, contact us via the feedback link at the bottom of the page.

This policy explains what data we collect, why, how we store it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We use Plausible Analytics to understand how visitors use the Website. Plausible is a privacy-first analytics provider. It does not use cookies, does not track individuals across sessions, and does not collect any personal data.

The data collected by Plausible is fully aggregated and includes:

• Page views and unique visitor counts (no individual tracking)
• Referring site or source (e.g. Google, direct)
• Approximate country (derived from anonymised IP — IP address itself is not stored)
• Browser and operating system type (aggregated)

Because Plausible does not use cookies or store personal data, no cookie consent banner is required. Plausible's privacy policy is available at plausible.io/privacy.

Some forms on the Website use Cloudflare Turnstile for bot protection. Turnstile is a privacy-preserving alternative to CAPTCHA. It analyses browser behaviour to distinguish humans from bots without requiring a challenge.

Cloudflare may process technical data including browser type, operating system, and network information to provide this service. This data is processed by Cloudflare Inc. under their privacy policy at cloudflare.com/privacypolicy. Cloudflare acts as a data processor on our behalf.

Some pages on the Website include optional contact or notification forms where you may provide your name, email address, and/or telephone number. This information is collected only if you voluntarily submit it.

When you submit a form, we use the data to:

• Send you the specific notification or update you requested (e.g. tool launch notification)
• Respond to any query you submitted

We will not use your contact details for unsolicited marketing. We will not sell, rent, or share your contact details with third parties except as required by law.

Contact data is stored on a UK-based server. Data is retained for as long as necessary to fulfil the purpose for which it was collected, and deleted within 12 months of last contact unless you have requested otherwise.

The legal basis for processing this data is consent (UK GDPR Article 6(1)(a)) — by submitting the form, you consent to us contacting you for the stated purpose. You may withdraw consent at any time by emailing us.

Our interactive tools (SSP calculator, dismissal checker, compliance checklist) run entirely in your browser. No data you enter into these tools is transmitted to our servers or stored anywhere. The calculations are performed locally on your device.

The Website does not use cookies for analytics or tracking. Cloudflare may set a security cookie (__cf_bm) as part of its bot management and DDoS protection service. This cookie is strictly necessary for the Website to function and does not require your consent under UK PECR.

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Erase your data (right to be forgotten)
• Restrict processing of your data
• Object to processing based on legitimate interests
• Data portability — receive your data in a machine-readable format
• Withdraw consent at any time where consent is the legal basis

To exercise any of these rights, contact us via the feedback link. We will respond within 30 days.

If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

We may update this privacy policy from time to time. When we do, we will update the "Last updated" date at the top of this page. We recommend checking this page periodically.