Privacy Policy

Last updated: 16 September 2026

What we collect

We may collect your organisation and contact details; answers and scores from the Grant Control Risk Check; booking details; correspondence; payment, invoice and transaction identifiers; diagnostic materials you choose to provide; and technical or attribution data such as IP address, browser information, referring page, UTM parameters and advertising click identifiers.

Do not submit beneficiary records, special-category personal data, passwords, bank credentials or other unnecessary sensitive information through the assessment or booking journey.

Why we use it

We use personal data to provide the risk check, prepare for calls, qualify enquiries, take payment, deliver contracted services, maintain records, secure and improve the service, measure marketing performance and comply with legal obligations.

Our lawful bases are: steps at your request before a contract and performance of a contract; legitimate interests in operating, securing and improving our business; consent for optional analytics, advertising and direct marketing where required; and compliance with legal obligations.

Who receives it

We use service providers for website hosting, booking and email, payment processing (Stripe), business systems/CRM, security, analytics and advertising. Google and Meta receive data only when their technology is enabled and the required consent has been given. Providers act under their own terms and/or data-processing obligations.

International transfers

Some providers may process data outside the UK. Where required, transfers are protected using UK adequacy regulations, the UK International Data Transfer Agreement/addendum or other lawful safeguards.

Retention

• Uncompleted or unqualified assessment/enquiry data: normally up to 12 months.
• Qualified prospect and relationship records: normally up to 24 months after the last meaningful interaction.
• Client contracts, delivery and payment records: normally six years after the relationship or transaction ends.
• Marketing data: until consent is withdrawn or after 24 months of inactivity.
• Security logs: normally up to 12 months unless required for an investigation.

We may retain information longer where required by law, a dispute or a legitimate security need.

Your rights

Depending on the circumstances, you may ask for access, correction, deletion, restriction, portability or objection, and may withdraw consent at any time. Email antony@antonydraper.com. You may complain to the UK Information Commissioner’s Office at ico.org.uk.

Automated score

The assessment generates an indicative management-control score from your selected answers. It is not used to make a legal or similarly significant decision about you and is not an audit, certification or regulated professional opinion.

Cookies and marketing

Optional analytics and advertising storage is denied by default. See our Cookie Policy and use “Cookie settings” on the main page to change your choice.

Changes

We may update this policy when the service, providers or law changes. The date above shows the latest version.