Privacy notice

Effective 9 July 2026

ComplianceSME operates compliancesme.com and is the controller of the personal data described in this notice. Contact us through the contact page or by email to the support address shown there.

The free assessment. Your answers are processed in your browser. Nothing is stored on our systems unless you request your report by email or create an account, in which case we store your email address and your obligation list so we can deliver what you asked for. The lawful basis is your consent, and for account holders, the contract between us.

Your account. We store your email address, your entity name, your assessment results, your purchase history, and your download and update history. The lawful basis is the contract between us.

Update emails. Members receive update files by email when a regulation behind a system they own changes. The lawful basis is the contract between us. Cancelling membership stops these emails.

The contact form. We store what you send us so we can answer you. The lawful basis is our legitimate interest in responding to correspondence.

Payments are processed by Stripe. Your card details go directly to Stripe and never touch our systems. Stripe acts as its own controller for payment data under its own privacy notice.

We do not sell your data. We do not share it with third parties for marketing. We do not send marketing emails to members beyond the update files and service notices that membership exists to deliver. We do not use analytics or tracking on this site.

Account and purchase records are kept for as long as your account is active, and afterwards for the periods that tax and consumer law require. Contact form correspondence is kept for two years. Assessment report requests from people who never open an account are deleted after one year.

You have the right to access your data, to correct it, to have it erased, to receive it in a portable format, and to object to processing based on legitimate interests. Write to us through the contact page and we will respond within one month.

If you are dissatisfied with how we handle your data, you may complain to the Information Commissioner's Office at ico.org.uk.