This Privacy Policy explains how arx Partners Limited (“we”, “us”, “arx Partners”), company number 10370754, registered in England & Wales at North Houghton, Stockbridge, SO20 6LF, collects and uses your personal data when you use the Martyn's Law Workbook self-assessment and workbook (the “Service”). Martyn's Law Workbook is a trading name of arx Partners Limited. We are the data controller for that personal data. We are registered with the Information Commissioner’s Office (ICO), registration number ZA259740.

1. The personal data we collect

Depending on how you use the Service, we collect:

Account details — your name, email address, role, and a securely hashed password.
Self-assessment details — the name of the person completing it, the site/premises or event name, the responsible legal entity, address, contact email and phone, your answers, and the assessment outcome.
Workbook content — the information, documents, floor plans and images you add to your workbook, including details of responsible people and your protection plans.
Communications — emails we send you (verification, reminders, plan documents) and any support correspondence.
Payment information — taken and processed by Stripe. We do not see or store your full card details; we keep limited transaction records (such as a payment reference, amount and status).
Technical data — IP address, browser/user-agent, and server logs, collected automatically for security and to run the Service.
Marketing and feedback preferences — whether you have opted in to updates, your marketing choices, and any feedback you give us (for example why you did or did not continue to the workbook).

2. How and why we use it (lawful bases)

To provide the Service — create and secure your account, run the assessment, host your workbook, take payment, and send service emails. Lawful basis: performance of a contract.
To keep the Service secure and prevent fraud/misuse, and to improve and support it. Lawful basis: our legitimate interests (balanced against your rights).
To meet legal and regulatory obligations. Lawful basis: legal obligation.
To send you service messages about your workbook (such as reminders to review and keep it up to date, renewal reminders, security notices and messages about your account). Lawful basis: performance of a contract and our legitimate interests.
If you are a paying customer, to tell you about related products and services from arx Partners (such as the Pro version or our other security services). Lawful basis: our legitimate interests, relying on the “soft opt-in” rules for existing customers; you can opt out at any time.
Where you opt in (for example when you complete a free assessment), to send you updates and marketing about Martyn's Law and the Workbook. Lawful basis: consent, which you can withdraw at any time.
To understand why some people do not continue, and to improve the Service, including short feedback questions and surveys. Lawful basis: our legitimate interests.
To produce anonymised, aggregated information for research, benchmarking and product development. Lawful basis: our legitimate interests; the result is anonymised so it no longer identifies you.

We do not sell your personal data, and we do not use it for third-party advertising. We send service messages, and — with the appropriate basis above — updates and marketing you can opt out of at any time. We may also create anonymised, aggregated information that does not identify you (see section 4).

3. Communications, marketing and feedback

Service messages. We send messages you need to run the Service — reminders to review and keep your workbook up to date, renewal reminders, security notices and messages about your account. These are part of the Service.

If you are a paying customer, we may occasionally tell you about related products and services from arx Partners, such as the Pro version or our other security services. We rely on the “soft opt-in” rules for existing customers: we tell you when you sign up, and every such email has an unsubscribe link — opt out at any time and we will stop.

Free assessments. If you opt in when you complete a free assessment (or ask us at any time), we will email you updates about Martyn's Law and the Workbook. We rely on your consent, which you can withdraw at any time via the unsubscribe link in any email or by contacting us.

Feedback. We may ask you short questions — for example, if you do not continue to the workbook — to understand why and to improve the Service.

Opting out of marketing never stops the essential service messages above, which we must send to run the Service.

4. Anonymised and aggregated data

We may create anonymised and aggregated information from assessments, workbook content and how the Service is used — for example statistics about the types of premises in scope, common risks, and how duty holders prepare. This information is aggregated and stripped of identifiers so that it cannot be used to identify you, your organisation or your premises, and so that you cannot be singled out or re-identified from it. Once information has been anonymised in this way it is no longer personal data, and we may use and share it — including with research partners and commercially — for research, benchmarking, statistics, improving security practice, and developing and promoting products and services. Because this information cannot be linked back to you, the rights in “Your rights” below do not apply to it.

5. Who we share it with

We share personal data only with service providers who process it on our behalf under contract, and only as needed to run the Service:

Stripe — payment processing.
Twilio SendGrid — sending our transactional emails.
Amazon Web Services (AWS) — hosting and infrastructure, in the UK (London) region.
Professional advisers and authorities — where we are required to by law, or to establish or defend legal claims.

Each provider is bound to protect your data and use it only for the purpose we specify.

6. International transfers

Some providers (for example Stripe and SendGrid) may process data outside the UK. Where they do, we rely on appropriate safeguards — such as UK adequacy regulations or the UK International Data Transfer Agreement / addendum to the EU Standard Contractual Clauses — so your data stays protected.

7. How long we keep it

We keep your account and workbook data for as long as your account is active and for 12 months afterwards, unless you ask us to delete it sooner or we must keep it longer to meet a legal obligation. Limited payment records are kept for the period required by law (typically six years for financial records). Server logs are kept for a short period for security.

Where you give us your details through a free assessment, or ask us for updates, we keep them until you opt out or ask us to delete them, and then remove them within a reasonable period.

8. How we protect it

We take security seriously. We hold Cyber Essentials and Cyber Essentials Plus certification and follow National Cyber Security Centre (NCSC) guidance. Practical measures include encryption of data in transit (HTTPS), passwords stored only as salted hashes, parameterised database access, hardened session handling, access controls on the limited staff who can see data, and regular review. No system is ever completely secure, but we work to protect your data proportionately to its sensitivity.

9. Cookies and analytics

The Service uses a single essential session cookie to keep you signed in and to protect the security of forms. It is not used for tracking or advertising.

To understand how the site is used, we use privacy-friendly, cookieless analytics (Plausible), which we host ourselves on our own infrastructure. It sets no cookies, does not track you across other websites, and does not collect or store personal data or anything that identifies you — only aggregated, anonymous usage statistics. Because of this, no analytics cookies are set and no consent banner is required. We do not use advertising or cross-site tracking cookies.

10. Your rights

Under UK data protection law you have the right to:

access the personal data we hold about you;
have inaccurate data corrected;
have your data erased in certain circumstances;
restrict or object to certain processing;
data portability;
object to direct marketing at any time (we will always stop); and
withdraw consent where we rely on it.

To exercise any of these, email support@martynslawworkbook.co.uk. We will respond within the time limits set by law. You also have the right to complain to the ICO (ico.org.uk), though we would appreciate the chance to put things right first.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will publish the updated version here and change the “last updated” date above; significant changes will be communicated to account holders.

12. Contact

Questions about your data or this policy? Email support@martynslawworkbook.co.uk, or write to us at North Houghton, Stockbridge, SO20 6LF.