Privacy Notice

01Who we are

ReadyPack is a trading name of MOFE LTD, a company registered in England and Wales under company number 16633320, with its registered office at First Floor, Swan Buildings, 20 Swan Street, Manchester M4 5JW.

We are registered with the Information Commissioner’s Office (ICO) under reference ZC100233. You can check both of those registrations yourself; we would rather you did.

We have not appointed a Data Protection Officer. We are not required to have one: we are a small company, we do not monitor people on a large scale, and handling special category data is not a core part of what we do. Questions about this notice go to hello@readypack.co.uk and are answered by a person, not a ticket system.

02Our two roles

Data protection law asks who decides what happens to personal data. For ReadyPack the answer depends on whose data it is, so we have two roles at once. This trips up a lot of suppliers, so here it is plainly.

Most of the questionnaire is not personal data

Your sector, your headcount, which AI tools you use, what you use them for, which vendors you buy from — that is information about a business, not about a person. Data protection law does not apply to it at all. It is still confidential, and we still treat it that way, but it is worth knowing that the majority of what you tell us is not in scope.

Your own details: we are the controller

Your email address, your name, your order and payment record, and the correspondence between us. We decided to collect these in order to sell you a pack and support you afterwards, so we are the controller and this notice is our explanation to you.

Other people you name in the questionnaire: we are your processor

The questionnaire asks who owns AI governance at your company, and who owns your procurement policy. If you name a colleague and give their job title and email, that is personal data about them — and you decided to give it to us, not us. For that data your organisation is the controller and we act on your instructions only.

The written processor terms required by Article 28 of the UK GDPR are in Schedule 1 of our Terms of Service. You already have them; you do not need to ask us for a separate data processing agreement, and you do not need to negotiate one before you buy.

03What we collect

When you buy

When you fill in the questionnaire

The questionnaire has ten sections. In order, it collects:

1. Your business — company name, trading name, company number, sector, employee count, and your logo if you upload one.
2. Markets and customers — where your customers are, what proportion are in the EU, what type they are and which sectors.
3. AI tools — which tools you use, what you use each one for (including anything you type in yourself), and whether customers come into contact with them.
4. How AI is used — whether it makes or informs decisions, what kinds of decision, whether it faces customers and through which channels, and whether children’s data is involved.
5. AI and people — what you currently tell people about your AI use, the exact wording you use, and whether there is a way to opt out.
6. Data and vendors — the categories of data your AI tools handle, and for each vendor: their name, where they are based, whether you have a data processing agreement with them, the transfer mechanism, whether they reuse your data for training, and their certifications.
7. Existing documents — who owns AI governance, including that person’s name, job title and email, and whether you already have a record of processing, a DPIA or an AI policy.
8. Complaints and incidents — whether you have a complaints procedure, whether you have had complaints, any detail you choose to write, and any contact with the ICO.
9. Procurement — why you are buying, the client or tender you are targeting and its deadline, who owns the policy, and any additional context you want to add.
10. Review and submit — your confirmation that the answers are accurate.

Section 6 asks you to tick which categories of data your AI tools handle, and some of those are special category data — health, biometrics, ethnicity, beliefs, sexual orientation, children’s data. To be clear: we are asking you to describe your business. We are not asking for, and do not want, the underlying records themselves.

Automatically, while you use the site

04Why we can use it

For each thing we do with your personal data, here is the lawful basis we rely on.

Automated scoring

When you submit, your answers are scored automatically to decide whether your pack needs a closer manual look before it goes out. That is a decision about a document, not about you as a person, and it never has a legal effect on anybody. A person at ReadyPack makes the final call on every pack before it is delivered.

05What goes to the AI model

Your documents are drafted and then checked by AI models provided by Anthropic PBC. There are two separate AI steps, they are not given the same thing, and this is the section people actually want to read — so we are going to be exact rather than reassuring.

Step one: drafting. What is swapped out

Seven fields are replaced with placeholders before the drafting request leaves our servers, and the real values are put back into the finished document afterwards: your company name, your trading name, your contact name, your contact role, your contact email, and the two dates printed on the pack.

Step one: drafting. What is sent

Everything else in your questionnaire. Specifically: your sector and headcount, the names of every AI tool you listed, the names of your vendors, what you told us each tool is used for, the categories of data involved, the risk flags our checks raised and the explanations behind them, and — on the Procurement-Ready tier and on any agreed multi-client arrangement — the free text you wrote about the tender or client you are chasing.

We are spelling this out because at the drafting step the swap covers who you are, not what you said. If you would not want a sentence processed by a third-party AI provider, do not type it into the questionnaire.

Step two: the check

Once a draft comes back, a second AI model from the same provider reads it and scores it for completeness, risk, and contradictions between your documents. That score is what decides whether a pack can be released or has to be held back for a closer look.

This second model does see your real company name, contact name, role and email. Not because we send your answers a second time — that copy is swapped for placeholders too — but because what it is given is the finished draft, and by that point the real values have been put back in. It is the same provider, under the same contract, with the same no-training and retention position set out below. We are telling you rather than letting the paragraph above imply your name never reaches them at all.

What Anthropic does with it

• Anthropic acts as our processor and only uses the data to return a draft.
• Your data is not used to train their models.
• On the commercial API we use, conversation content is not retained by default.
• Content that Anthropic’s trust and safety systems flag can be retained by them for up to two years. We are telling you this rather than leaving it out.
• Anthropic stores data in the United States.

The person who releases it

The check above is automated. A person is the next step, not the same one: where your answers flag something higher risk or uncertain the pack is held for a closer manual review, and no pack reaches you until someone at ReadyPack releases it. That means a person at ReadyPack may read your answers and your draft documents. Every time an admin user opens a customer case, that is recorded in our internal log.

06Where your data is

We use five suppliers. Here is every one of them, what it does, and where it handles your data.

Your answers and your finished documents live in the database in Ireland. They are read by the application in London and, in the form described in section 5, by the AI provider in the United States. Nobody else receives them.

We do not sell your data, we do not share it with advertisers or data brokers, and we do not use it to build a product for anyone other than you. If we are ever legally compelled to hand something over, we will tell you unless we are prohibited from doing so.

07Data leaving the UK

Three of our suppliers process personal data outside the UK: Anthropic and Resend in the United States, and Stripe, which transfers to the United States and India as part of running a global payments network. Supabase stores our database in Ireland, which is covered by the UK’s adequacy finding for the EEA.

Every one of these suppliers is engaged under a written data processing agreement that contains the safeguards approved for international transfers. Specifically:

• Anthropic — their data processing addendum, which incorporates the European Commission’s Standard Contractual Clauses, forms part of the commercial terms our account is on.
• Stripe — relies on the Standard Contractual Clauses, the UK International Data Transfer Addendum issued by the ICO, and the UK Extension to the EU–US Data Privacy Framework.
• Resend and Vercel — each engaged under their standard data processing agreement covering transfers out of the UK and EEA.

You can ask us for a copy of the relevant terms and we will point you straight at them.

08How long we keep it

Deletion is carried out by us on a scheduled review of the records that have passed their retention date, and straight away when you ask. We are describing what we do, not an automatic process that runs without anybody looking — if you want your data gone on a particular date, email us and we will confirm when it is done.

09How we protect it

• Everything between your browser and our servers is encrypted (HTTPS).
• Your finished documents sit in private storage. The download links we hand out are signed and expire after one hour, so a forwarded link stops working.
• Sign-in is by one-time link sent to your email address. There is no password on your account, so there is no password to be stolen or reused.
• The database enforces row-level separation, so one customer’s account cannot read another’s records.
• Admin access to customer answers is restricted to us and every case view is logged.
• Secrets and API keys are held as environment variables, never in our source code.

We do not hold ISO 27001 or SOC 2 certification, and we are not going to imply otherwise. We are a small company using well-established providers, and the controls above are the honest description of what protects your data today. No system is perfectly secure; if we ever suffer a breach that is likely to put you at risk, we will tell you and the ICO within the statutory deadlines.

10Your rights

Under UK data protection law you can ask us to:

• Give you a copy of the personal data we hold about you.
• Correct it if it is wrong or incomplete.
• Delete it, where we do not have a legal reason to keep it.
• Restrict what we do with it while a dispute is resolved.
• Hand it over to you or another provider in a portable format.
• Stop processing based on legitimate interests, including all marketing, at any time.

Email hello@readypack.co.uk. We respond within one month, free of charge. We may ask you to confirm your identity first — that is us protecting your data, not us stalling.

11Cookies and tracking

We use one kind of cookie: the session cookie that keeps you signed in after you open your magic link. Without it you would be logged out between questionnaire sections. It is strictly necessary, so it does not require your consent.

That is the complete list. To be specific about what we do not do:

• No analytics of any kind. We do not know which pages you visited.
• No advertising or remarketing tags.
• No tracking pixels, in the website or in our emails.
• No session recording or heatmaps.
• No third-party scripts running on our pages.
• Our fonts are served from our own domain rather than fetched from Google, so loading a ReadyPack page does not tell anybody else that you were here.

This is why you have never seen a cookie banner on this site. There is nothing to consent to. We would rather have that than a pop-up.

12If we emailed you and you are not a customer

We approach a small number of businesses directly. If you received an email from us out of the blue, this section is the one that applies to you, and it is the answer to “where did you get my details?”

What we hold

Your name, your job title, your work email address, your employer, and a note of where we found each of those.

Where we got it

Public sources only: your company’s own website, Companies House, Contracts Finder or another public tender notice, or your public LinkedIn profile. We do not buy lists and we do not use email-guessing tools.

Why we are allowed to

Legitimate interests. We offer a business service to businesses that are likely to be asked about their AI use by their own customers, and contacting a named person in a relevant role at a limited company is a proportionate way to do that. We have weighed our interest against your privacy: the message goes to a work address, it is about your professional role, it is sent by a named person one at a time rather than by a bulk tool, and it always offers a way to stop.

We only contact people at limited companies. We do not cold-email sole traders or ordinary partnerships, because the marketing rules treat them as individuals and that would require your consent, which we do not have.

How to make it stop

Reply and say so, in any words you like, or email hello@readypack.co.uk. We remove you the same day and we do not need a reason. If you would rather we deleted your details entirely rather than keeping a note not to contact you again, say that and we will.

If you never reply, we delete your details 12 months after the last time we contacted you.

13Children

ReadyPack is a business-to-business service and is not intended for anyone under 18. We do not knowingly collect personal data about children. The questionnaire asks whether your AI tools handle children’s data, because that changes what your pack has to say — it does not ask you to give us any.

14Complaints

If you are unhappy with how we have handled your data, tell us first. Email hello@readypack.co.uk or use our complaints form. We acknowledge within five working days and give you a substantive response within 30 days, which is the deadline set by section 103 of the Data (Use and Access) Act 2025.

If we do not resolve it, you can complain to the Information Commissioner’s Office. You do not have to come to us first, but we would like the chance to fix it.

15Changes to this notice

We date every version of this notice at the top. If we change something that materially affects how we handle your data — a new supplier, a new purpose, a longer retention period — we will email customers with an active order rather than quietly updating the page.

16Contact us

ReadyPack produces documentation. It is not legal, tax or regulatory advice. Where you need advice on your specific circumstances, engage a qualified solicitor or accountant. See our Terms of Service for the full position.