PRIVACY & DATA PROTECTION

ReadyState Privacy Notice

Last updated: 11 August 2026

ReadyState Ltd is the data controller for the personal information described in this notice. This notice explains what personal information we collect or use, why we use it, how long we keep it, who we share it with, and your data protection rights.

 

Contact details

Organisation: ReadyState Ltd

Email: enquiries@readystatehq.com

What information we collect, use, and why

To provide and improve products and services for clients

• Names and contact details
• Occupation and professional role information
• Transaction data, including details about payments to and from you and services purchased
• Records of meetings and decisions
• Information provided in enquiries, bookings and client communications, including company or project context, relevant timeframes, evidence-management requirements and stakeholder roles

For information updates or marketing purposes

• Names and contact details
• Professional profile information
• Marketing preferences

To comply with legal requirements

• Name
• Contact information

For dealing with queries, complaints or claims

• Names and contact details
• Purchase or service history
• Customer or client records
• Financial transaction information

Lawful bases and data protection rights

Under UK data protection law, ReadyState must have a lawful basis for collecting and using personal information. The lawful basis used depends on the purpose of the processing.

• Right of access – You can ask us for copies of your personal information and certain information about how it is used.
• Right to rectification – You can ask us to correct personal information you believe is inaccurate or incomplete.
• Right to erasure – You can ask us to delete your personal information in circumstances where this right applies.
• Right to restriction of processing – You can ask us to limit how we use your personal information in circumstances where this right applies.
• Right to object – You can object to certain uses of your personal information. You can object to direct marketing at any time.
• Right to data portability – Where applicable, you can ask us to transfer personal information you provided to us to you or another organisation.
• Right to withdraw consent – Where we rely on consent, you can withdraw that consent at any time.

We will respond to data protection rights requests without undue delay and normally within one month. To make a request, email enquiries@readystatehq.com.

More information about your data protection rights is available from the Information Commissioner’s Office (ICO).

Our lawful bases for the collection and use of your data

Providing and improving products and services

• Contract – where processing is necessary to take steps at your request before entering into a contract, or to enter into or perform a contract with you.
• Legitimate interests – where processing is necessary for ReadyState’s legitimate commercial interests and those interests are not overridden by your rights and freedoms.

Our legitimate interests: ReadyState has a legitimate commercial interest in responding to prospective clients, managing client relationships, delivering its services effectively and improving how those services are provided. We use limited business contact information, professional role information, enquiry details and relevant records of communications or meetings where necessary to understand requirements, communicate with relevant stakeholders and operate the service effectively. We limit the information used to what is relevant to the business relationship, restrict access appropriately and retain it only for as long as reasonably necessary.

Information updates or marketing

• Legitimate interests – where we use limited professional information to identify and contact relevant business prospects who may reasonably have an interest in ReadyState’s services.

Our legitimate interests: ReadyState has a legitimate commercial interest in promoting its services to relevant businesses and professional contacts. This may involve using an individual’s name, business contact details, company, role and relevant professional context. We keep outreach targeted and proportionate, do not use sensitive personal information for marketing, and provide a clear way to object or opt out. If you object to direct marketing, we will stop using your information for that purpose.

Complying with legal requirements

• Legal obligation – where we need to use personal information to comply with a legal requirement that applies to ReadyState.

Queries, complaints or claims

• Contract – where handling the matter is necessary in connection with entering into or performing a contract.
• Legal obligation – where we must process information to comply with a legal requirement.
• Legitimate interests – where processing is necessary to receive, investigate and respond to queries, complaints or claims, maintain appropriate records, and protect the legitimate interests of ReadyState and the people involved.

Our legitimate interests: We use relevant contact details, communications, service history and related records only where necessary to understand the matter, communicate with the individual, establish what occurred and reach an appropriate response or resolution. The information is limited to what is relevant to the particular matter and access is restricted appropriately.

Where we get personal information from

• Directly from you
• Publicly available sources, such as company websites, professional networking platforms and public business information
• Professional referral and introduction partners, such as quality, ISO, compliance, engineering, procurement or business advisers, and other professional contacts who introduce or refer individuals to ReadyState

How long we keep information

We keep personal information only for as long as it is reasonably needed for the purpose for which it was collected, including any legal, accounting or claims-related requirements. Our standard retention periods are:

Information	Typical retention period
Website enquiries, bookings and prospective-client communications	Up to 24 months from the last meaningful contact, unless the individual becomes a client or a longer period is needed for a legal or claims-related reason.
Marketing and outreach contact records	Up to 24 months from the last meaningful interaction, subject to periodic review. If you opt out or object to marketing, we may retain only the minimum information needed on a suppression list so that we can respect that preference in future.
Client engagement records, contracts, key meeting and decision records, and related correspondence	Normally 6 years after the end of the engagement, where this is reasonably required for contractual, claims or business record purposes.
Accounting and transaction records	Normally 6 years from the end of the company financial year to which the records relate, or longer where required by law or HMRC.
Queries and complaints that do not form part of an ongoing client engagement	Normally 24 months after the matter is closed, unless a longer period is required because of an ongoing or reasonably anticipated legal claim.

We may retain information for longer where required by law, where a regulator or authority requires it, or where it is necessary to establish, exercise or defend legal claims. When information is no longer required, we will delete it, securely dispose of it, or anonymise it where appropriate.

Who we share information with

Data processors

Automattic Inc. / WordPress.com

Provides website hosting and associated website services. Personal information submitted through the ReadyState website, including contact-form enquiries, may be stored and processed within the WordPress.com hosting environment.

Microsoft Corporation / Microsoft 365

Provides business email, cloud productivity and appointment-booking services. Personal information may be processed when individuals correspond with ReadyState by email, book meetings through Microsoft Bookings, or take part in communications and meetings using Microsoft 365 services.

FreeAgent Central Limited

Provides accounting and financial record-keeping services. Personal information may be processed where necessary for invoicing, transaction records, accounting and related legal or financial administration.

Other recipients

• Insurance companies, brokers or other intermediaries where relevant to a claim or insurance matter
• Professional or legal advisers where necessary for advice or representation
• Organisations we are legally obliged to share personal information with

Sharing information outside the UK

Where necessary, our data processors may transfer personal information outside the UK. When they do so, appropriate safeguards must be used in accordance with UK data protection law. You can contact us for further information about the safeguards applying to a particular transfer.

Organisation	Recipient category	Location	Transfer safeguard
Automattic Inc.	Website hosting, content management and cloud technology services	United States of America	UK adequacy regulations / UK-US data bridge, where applicable
Microsoft Corporation / Microsoft 365	Cloud productivity, business email and appointment-booking services	United States of America and potentially other international Microsoft processing locations	UK Addendum to the EU Standard Contractual Clauses (SCCs), where applicable
FreeAgent Central Limited	Accounting and financial record-keeping services	United States and other countries used by authorised subprocessors	UK Addendum to the EU Standard Contractual Clauses (SCCs), where applicable

How to complain

If you have concerns about how ReadyState uses your personal information, you can make a data protection complaint to us at enquiries@readystatehq.com.

We will acknowledge a data protection complaint within 30 days, investigate it without undue delay, keep you informed where appropriate, and communicate the outcome of our investigation.

If you remain unhappy with how we have used your personal information after raising a complaint with us, you can also complain to the Information Commissioner’s Office (ICO).

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Helpline: 0303 123 1113

ICO complaints: ico.org.uk/make-a-complaint

 

Reviewing this notice We will review this privacy notice periodically and update it when our processing activities, service providers or legal obligations change.