01
Who controls your information
Simply Sustainable Ltd is the controller for information collected by the readiness check.
02
What we collect
We collect your name, optional role, work email, industry, reason for using the tool, reporting experience, assessment answers, and any sustainability topics you enter. We also process limited technical information needed to secure and operate the tool, including server access logs that record the internet address of each request, the page requested and the response returned.
03
What we do with it
We calculate and display your blended disclosure-readiness and management-maturity result, create your personal results link, email that link at your request, maintain the latest assessment in our CRM, protect the service from misuse, and enable our team to respond to your enquiry. The score is generated by fixed, version-controlled rules and is a high-level indication only. It does not make a legal or similarly significant decision about you.
04
Our lawful bases
We rely on our legitimate interests to provide the result you request, respond to your enquiry, and keep the service secure. When you submit the form, you also agree that Simply Sustainable may contact you about your request and related services. You can unsubscribe from those messages at any time.
05
Service providers
Microsoft Azure hosts the application in the UK, sends the requested service emails from a European email resource, and stores short-lived one-way identifiers used for abuse prevention. HubSpot stores the contact and latest assessment in our CRM. Azure OpenAI processes the role, sector, reason, topics and score to draft a bounded internal brief for our team; it does not receive your name, company or email address. Microsoft and HubSpot may use approved subprocessors or process information outside the UK under applicable contractual transfer safeguards.
06
Retention and results links
Your signed results link expires after 30 days. Your latest assessment and contact record remain in HubSpot only for as long as needed for the purposes above and in line with Simply Sustainable's retention procedures. Security rate-limit identifiers expire after no more than one hour. Server access logs are kept for 30 days and then deleted automatically. Do not forward your personal results link unless you are comfortable giving its recipient access to your result.
07
Measuring how the tool is used
We use Google Analytics to count visits and see how far people get through the check. It is configured to store nothing on your device: no analytics cookies are set and no identifier is kept, so we see totals and trends rather than individuals. Google receives the pages viewed, the stage you reached, your industry and reason for using the tool, and your result band, alongside technical details including an approximate location derived from a truncated IP address. It does not receive your name, email address, company name, or the topics you enter. Google may process this information outside the UK under applicable contractual transfer safeguards.
08
Your rights and contact
Depending on the circumstances, you may ask us for access, correction, deletion, restriction, portability, or object to processing. Contact info@simplysustainable.com. You can also complain to the UK Information Commissioner's Office.
Last updated: 16 September 2026. Privacy and legal owners must approve this tool-specific notice and the associated retention schedule before launch.