Privacy Policy

The data controller is Nullam Method. For any privacy matter, contact us at ian@nullam.org.uk.

Account details — your first name, surname, company / organisation name and email address. Your password is stored securely (hashed) by our authentication provider; we never see it.

Assessment data — the answers you give in a self-assessment, the resulting scores, and the report generated from them. This relates to your organisation's governance and operational arrangements.

Payment data — payments are handled by Stripe. We do not see or store your card details; we retain a record of what you purchased and your account's email.

Communications — emails you send us and the contact form.

Technical data — limited information needed to run the service securely, including cookies that keep you logged in (see section 8).

To provide the service (creating your account, running assessments, generating and emailing your report, taking payment) — on the basis of performing our contract with you.

To contact you about consultancy support to help deliver your action plan — only where you have given consent (the optional box at sign-up). You can withdraw this at any time.

To keep records required by law (e.g. accounting and tax records) — to meet our legal obligations.

To keep the service secure and improve it — on the basis of our legitimate interests, balanced against your rights.

We do not use your data for automated decision-making that produces legal or similarly significant effects.

Where you have consented, we may retain your assessment results and use them to offer and inform consultancy support from Nullam Method. If you have not consented, we use your assessment data only to deliver the service to you. You can withdraw consent, or ask us to delete your data, at any time (see section 6).

We use a small number of trusted providers ("processors") to run the service, each under a data-processing agreement:

• Supabase — database & account authentication (stores your account and assessment data).
• Stripe — payment processing.
• Resend — sending transactional emails (confirmations and your report).
• Vercel — hosting of the website/application.

Some of these providers are based outside the UK. Where data is transferred internationally, it is protected by appropriate safeguards (such as the UK International Data Transfer Agreement or Standard Contractual Clauses). We also share data with professional advisers or authorities where required by law. We never sell your personal data.

Under UK GDPR you have the right to access, correct, erase, restrict or object to the processing of your data, to data portability, and to withdraw consent at any time. To exercise any of these, email ian@nullam.org.uk. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

We keep your account and assessment data for as long as your account is active, and thereafter only as long as needed for the purposes above or to meet legal obligations (for example, financial records are typically kept for six years). We delete or anonymise data when it is no longer needed, and on valid request.

We use only strictly necessary cookies — set by our authentication provider to keep you securely logged in. We do not use advertising or analytics cookies. Because these cookies are essential to provide the service you request, they do not require consent. You can block cookies in your browser, but the service may not work if you do.

We use technical and organisational measures to protect your data, including encryption in transit, access controls, and reputable infrastructure providers. No online service can be guaranteed completely secure.

The service is intended for use by organisations and individuals aged 16 or over. We do not knowingly collect data from children.

We may update this policy from time to time. Changes will be posted on this page with a revised date.

Questions about this policy or your data? Email ian@nullam.org.uk.