Privacy Policy

Groundwork by KINTAL

1. Who controls your data

KINTAL Ltd is the data controller for personal data collected through Groundwork. Our VAT registration number is 511370729.

2. What data we collect and why

Session data

When you use Groundwork, we create a session record containing your answers to the questionnaire. This data is used solely to generate your personalised documents. The lawful basis is contract performance: it is necessary to generate the service you have requested.

Email address

We collect your email address to deliver your documents, send transactional emails about your order, and (if you opt in) to notify you of regulatory changes that affect your documents. The lawful basis is contract performance for delivery and legitimate interests for regulatory update notifications.

Transaction data

On payment, we record your order reference, the amount paid, VAT charged, the date and your email address. This data is retained for 7 years to comply with HMRC record-keeping requirements. The lawful basis is legal obligation.

Account data (Option A users only)

If you choose to retain your session data and create an account, we store your email address and encrypted password via Supabase Auth. The lawful basis is contract performance.

3. How long we keep your data

This depends on the choice you make at the end of your session.

Option A (keep your data): Your session answers and document records are retained for as long as your account is active. You can delete your account and all associated data at any time from your account dashboard.

Option B (delete after delivery): Your session answers and document records are deleted within 24 hours of your documents being delivered. Only your transaction record is retained, for 7 years as required by HMRC.

All users: Your transaction record (order reference, amount, VAT, date, email) is retained for 7 years regardless of the option you choose. This cannot be deleted on request as it is required by law.

Update notification opt-ins: Your email address and opt-in record are retained until you unsubscribe.

4. Who we share your data with

We use the following sub-processors to deliver the service. All are contractually bound to process your data only as instructed.

We do not sell your data. We do not share your data with any third party for marketing purposes.

5. International transfers

Your session data is stored in the UK (Supabase UK region). Document generation involves a call to Anthropic's Claude API. Anthropic is a US company. The structured answer data sent to the API is designed to exclude personal data: it contains only business profile information from your questionnaire answers. We have assessed this transfer under the UK International Data Transfer Agreement framework.

6. Your rights

Under UK GDPR you have the right to: access the personal data we hold about you; correct inaccurate data; request deletion of your data (subject to our legal retention obligations); object to processing; and request a copy of your data in a portable format.

If you are unhappy with how we have handled your data, you have the right to complain to the Information Commissioner's Office at ico.org.uk.

7. Cookies and analytics

Groundwork uses session storage in your browser to maintain your session state. We use Google Analytics 4 for usage analytics. GA4 uses cookies to distinguish unique users. By using Groundwork, you consent to analytics cookies. You can manage cookie preferences via the cookie consent banner displayed on your first visit.

8. Changes to this policy

We will update this policy when our data practices change. The current version will always be available on this page. If changes affect your rights materially, we will notify you by email.