Privacy Notice

1. Who We Are

This Privacy Notice is issued by CXO Ready LTD (trading as "CXO Ready", "we", "us", "our"), a company registered in England and Wales, in connection with the CXO Ready service available at https://cxoready.com.

CXO Ready LTD acts as a data processor. Our customers decide what personal data to record in the Service and for what purpose; we process it on their documented instructions in order to provide the Service, and we do not use it for our own purposes.

If you are an individual whose personal data appears in the Service, the organisation that entered it is the controller and is the right party to contact about your rights. We will assist that organisation in responding to you.

The terms governing our processing are set out in our Terms of Use.

For any privacy-related questions or to exercise your rights, contact us at privacy@cxoready.com.

2. Personal Data We Collect

We collect the following categories of personal data:

Account data — name, email address, password (hashed), organisation name, job title.
Profile and content data — information you upload to the platform, including AI system records, policies, assessments, and team information.
Communications — support enquiries, feedback, and any correspondence with our team.
Usage and telemetry data — pages visited, features used, login times, and device or browser identifiers.
Technical data — IP address, approximate location derived from IP, session identifiers, and cookies.
Billing reference data — subscription status, plan, and references to transactions managed by Stripe (our payment processor). We do not store full payment card details.

3. How We Use Personal Data

We process personal data for the following purposes:

Creating and managing your account.
Providing and operating the CXO Ready service.
Processing subscriptions and recording entitlements (payments are handled by Stripe).
Providing customer support and responding to enquiries.
Securing the service, detecting fraud, and preventing abuse.
Improving the service through aggregated analytics.
Sending service notifications and, where you have opted in, marketing communications.
Complying with legal, regulatory, and tax obligations.

4. Legal Basis for Processing

We rely on the following legal bases under UK GDPR:

Performance of a contract — to provide the service you have signed up for.
Legitimate interests — to secure our service, prevent fraud, improve features, and communicate with users about their accounts.
Consent — for non-essential cookies and optional marketing communications. You can withdraw consent at any time.
Legal obligation — to comply with tax, accounting, and other applicable laws.

5. Who We Share Personal Data With

We share personal data with the following categories of recipients:

Payment processor (Stripe) — Stripe Payments Europe Ltd processes card payments on our behalf and stores tokenised payment details. See Stripe's privacy notice.
Hosting and infrastructure providers — cloud hosting, database, and storage providers used to operate the platform.
Email and communications providers — used to deliver transactional and account emails.
Analytics and monitoring providers — to measure performance and detect issues, with data minimised where possible.
Professional advisers — legal, accounting, and audit advisers, where required.
Authorities — where required by law, regulation, or legal process.

We do not sell personal data.

6. International Transfers

Some of our service providers are located outside the UK and EEA. Where personal data is transferred internationally, we rely on appropriate safeguards such as the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or adequacy decisions issued by the UK Government or the European Commission.

7. Data Retention

We keep personal data only for as long as necessary for the purposes set out in this notice. In general:

Account and content data — kept while your account is active and for up to 12 months after closure, after which it is deleted or anonymised.
Billing and tax records — kept for at least 6 years to meet UK accounting and tax obligations.
Support communications — kept for up to 3 years after the last interaction.
Security and audit logs — kept for up to 2 years.

8. Your Rights

Under UK GDPR you have the right to:

Access the personal data we hold about you.
Request correction of inaccurate or incomplete data.
Request erasure of your personal data, where applicable.
Restrict or object to processing in certain circumstances.
Receive your data in a portable format.
Withdraw consent at any time, where processing is based on consent.
Lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.

We aim to respond to verified requests within one month, in line with UK GDPR.

9. Security

We apply appropriate technical and organisational measures to protect personal data, including encryption in transit, encrypted storage, role-based access controls, audit logging, and regular security reviews. No system is completely secure, so we cannot guarantee absolute security.

10. Cookies

We use cookies and similar technologies to operate the service, remember your preferences, secure your session, and measure usage. Non-essential cookies are only set with your consent, which you can manage at any time through the cookie banner or your browser settings. Categories include:

Essential — required to log in and use the service.
Analytics — to understand how the service is used and improve it.
Marketing — only set with explicit consent.

11. Changes to This Notice

We may update this Privacy Notice from time to time. We will post the updated version on this page with a new "last updated" date and, where changes are material, notify you by email or in-product notice.

12. Contact Us

CXO Ready LTD, privacy@cxoready.com.