Privacy notice
Last updated 12 May 2026 · Effective from launch
This notice covers the Waymark5 ERA Health Check tool at wm5.co.uk: what we collect, what we do with it, how long we keep it, and your rights.
Who we are
The Waymark5 ERA Health Check is provided by Waymark5("we", "us"). We are the data controller for the personal data described below.
Contact: privacy@wm5.co.uk.
To exercise any of the rights in section 10, email us.
What data we collect
| Category | What we collect | When |
|---|---|---|
| Disclaimer acceptance | Timestamp, disclaimer version, browser type, and a hashed IP (we never store the raw IP). | When you click "Start the check". |
| Answers | Your 8 question answers. | While you complete the check. |
| Contact details | Email address; first name and business type (both optional). | Only if you submit the email form. |
| Marketing preferences | Whether you ticked the updates box. | Only if you tick it. |
| Analytics | Aggregate, non-identifying usage data via Plausible. | While you use the site. |
We do not collect phone numbers, addresses, payment details, raw IPs, or any data identifying individual employees.
How we use your data
- To produce and email your ERA Readiness Report, if you request it.
- To send the October 2026 ERA changes checklist, if you ticked the box.
- To send one follow-up about related tools we are developing, if you gave marketing consent.
- To record that you saw and accepted the disclaimer.
- To improve the tool by reviewing aggregate completion patterns (never individual answers).
We do not use your data for any other purpose. We do not sell your data.
Our lawful bases
Under UK GDPR we rely on:
| Activity | Lawful basis |
|---|---|
| Producing and emailing your Readiness Report | Article 6(1)(b) — steps taken at your request to deliver the report you asked for. |
| Sending the October 2026 ERA checklist | Article 6(1)(a) — your consent (checkbox). Withdrawable at any time. |
| Sending the day-5 follow-up email | Article 6(1)(a) — your consent (marketing-consent checkbox). Withdrawable at any time. |
| Recording disclaimer acceptance | Article 6(1)(f) — legitimate interests in evidencing what you saw and agreed to. |
| Aggregate analytics (Plausible) | Article 6(1)(f) — legitimate interests. Plausible uses no cookies and does not identify users. |
For electronic marketing emails we also rely on consent under the Privacy and Electronic Communications Regulations (PECR).
Who we share your data with
We use a small number of sub-processors:
| Provider | Role | Location | Safeguard |
|---|---|---|---|
| Vercel | Website hosting. | United States | UK Extension to EU-US DPF. |
| Supabase | Database + Storage: contact details, answers, disclaimer record, completion record, PDF. | EU (Ireland, eu-west-1) | UK adequacy — none required. |
| Resend | Email delivery. | United States | UK Extension to EU-US DPF. |
| Plausible Analytics | Aggregate, non-identifying analytics. | European Union | UK adequacy — none required. |
We do not share your data with anyone else and do not use it for third-party advertising.
International transfers
For US sub-processors (see section 5), we rely on the UK Extension to the EU-US Data Privacy Framework. We confirm Framework participation before using a provider and do not use non-Framework providers for personal data.
How long we keep your data
| Data | Retention |
|---|---|
| Email address (no further interaction) | 24 months from form submission. |
| Email address (active engagement) | Rolling 24 months from last interaction. |
| Your 8 answers | Anonymised after 12 months. |
| Disclaimer acceptance record | 6 years. |
| Aggregate Plausible analytics | 24 months. |
Afterwards we delete or anonymise the data.
Is providing your data required?
No. You can complete the 8 questions and see your score without giving any personal data; email is required only for the PDF report, with first name and business type optional. Without the marketing-consent box ticked, the report is the only email we send.
Your marketing choices
- Choose not to tick the marketing-consent box (no marketing emails will be sent).
- Click "Unsubscribe" in any email to withdraw consent at any time.
- Email privacy@wm5.co.uk to ask us to stop contacting you.
Withdrawal does not apply to processing we already carried out.
Your rights
You have the right to request access to the personal data we hold about you.
You have the right to request access to the personal data we hold about you, to ask us to correct inaccurate data, to request deletion of your data, to restrict or object to our processing in certain circumstances, and to ask for a copy of data you have provided to us in a portable format where applicable. Where we rely on consent, you may withdraw it at any time. These rights are subject to legal limits and conditions.
To exercise any of these rights, email privacy@wm5.co.uk. We will respond within one month of receiving your request.
Complaints to the ICO
If you are unhappy with how we use your personal data, please contact us first so we can try to resolve your concern. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, the UK supervisory authority for data protection issues.
Source of data
All data we hold came directly from you — through the disclaimer click or the email form — and nowhere else.
Automated decision-making
The Readiness Score is a fixed rule set — same answers, same score. No profiling, no machine learning, no automated decision with legal or similarly significant effects on you. The score is guidance, not a decision.
Changes to this notice
We may update this notice if our practices change. The updated version will appear here with a new "Last updated" date. If the changes are significant, we will email anyone whose address we hold before the changes take effect.