Privacy Policy

Last updated: 28 March 2026

1. Who controls your data

KINTAL Ltd is the data controller for personal data collected through Groundwork. Our VAT registration number is 511370729. Company number: 16657658. ICO registration number: ZC050455. Privacy enquiries: privacy@kintal.co

Cyber Essentials certified: certificate number f52a1580-0bcc-465f-a36a-d981eaa215ce, issued 24 March 2026. Verify at: registry.blockmarktech.com.

2. What data we collect and why

Session data

When you use Groundwork, we create a session record containing your answers to the questionnaire. This data is used solely to generate your personalised documents. The lawful basis is contract performance: it is necessary to generate the service you have requested.

Email address

We collect your email address to deliver your documents, send transactional emails about your order, and (if you opt in) to notify you of regulatory changes that affect your documents. The lawful basis is contract performance for delivery and legitimate interests for regulatory update notifications.

Transaction data

On payment, we record your order reference, the amount paid, VAT charged, the date and your email address. This data is retained for 7 years to comply with HMRC record-keeping requirements. The lawful basis is legal obligation.

Account data (Option A users only)

If you choose to retain your session data and create an account, we store your email address and encrypted password via Supabase Auth. The lawful basis is contract performance.

3. How long we keep your data

This depends on the choice you make at the end of your session.

Option A (keep your data): Your session answers and document records are retained for as long as your account is active. You can delete your account and all associated data at any time from your account dashboard.

Option B (delete after delivery): Your session answers and document records are deleted within 24 hours of your documents being delivered. Only your transaction record is retained, for 7 years as required by HMRC.

All users: Your transaction record (order reference, amount, VAT, date, email) is retained for 7 years regardless of the option you choose. This cannot be deleted on request as it is required by law.

Update notification opt-ins: Your email address and opt-in record are retained until you unsubscribe.

4. Who we share your data with

We use the following sub-processors to deliver the service. All are contractually bound to process your data only as instructed.

We do not sell your data. We do not share your data with any third party for marketing purposes.

5. International transfers

Your session data is stored in the UK (Supabase UK region).

When you use Groundwork, your questionnaire answers are processed by Anthropic Ireland, Limited as part of document generation. Anthropic Ireland is based in the EEA, which is recognised as providing adequate data protection under UK law. No additional transfer mechanism is required. Anthropic processes data under a Data Processing Addendum incorporated into their Commercial Terms of Service.

6. Your rights

Under UK GDPR and the Data Protection Act 2018 you have the right to: access the personal data we hold about you; correct inaccurate data; request deletion of your data (subject to our legal retention obligations); object to processing; and request a copy of your data in a portable format.

If you are unhappy with how we have handled your data, you have the right to complain to the Information Commissioner's Office at ico.org.uk.

7. Cookies and analytics

We use Google Analytics (GA4) to understand how Groundwork is used. GA4 may set analytics cookies on your device, but only if you explicitly accept cookies when prompted.

When you first visit Groundwork, a banner will ask whether you accept analytics cookies. If you decline, Google Analytics will still load but will not set cookies and will operate in a cookieless mode. Your choice is saved in your browser and respected on all future visits.

You can withdraw consent at any time by clearing your browser cookies and declining again on your next visit.

For more information on how Google handles analytics data, see Google's privacy policy at policies.google.com/privacy.

8. Changes to this policy

We will update this policy when our data practices change. The current version will always be available on this page. If changes affect your rights materially, we will notify you by email.