Privacy Policy

This website is operated by The Compliance Workbook Ltd, trading as TCW ("TCW", "we", "us" or "our"), registered in England and Wales under company number 08760486, with its registered office at 5 Bridge Street, Birkenhead, Wirral CH41 1AS. TCW is registered with the Information Commissioner's Office (ICO) as a data controller under registration number ZA064993.

We process personal data in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (as amended, including by the Data (Use and Access) Act 2025), and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), as amended.

TCW is generally the data controller for personal data collected through this website for its own business purposes. Where TCW processes personal data on behalf of clients through its software and associated services, TCW may act as a data processor under separate contractual arrangements.

TCW may independently control certain business contact, account administration, billing and security information. This policy covers the website processing described below; separate notices or agreements may apply to our products and services.

Depending on how you interact with us, we may collect: (a) enquiry and demonstration information, including name, work contact details, organisation, role and message; (b) information supplied when requesting resources or expressing product interest; (c) marketing preferences and records of consent or opt-out; (d) technical information such as IP address, device, browser, security logs and website usage data where collected; and (e) authorised website administrator details and sign-in records.

Where applicable, we may also receive professional contact details from referrals, events or publicly available business sources. We collect information directly from you, through website technologies and, where relevant, from those other sources.

Please do not submit special category information through general enquiry forms unless necessary. If we receive such information, we will assess and handle it under applicable law.

We process personal data for the following purposes, subject to the lawful basis applicable to each activity: Enquiries and demonstrations: to respond to business enquiries and arrange requested demonstrations. We generally rely on legitimate interests in responding to enquiries; where necessary to take steps at an individual's request before entering into a contract with that individual, contractual necessity may apply.

Requested resources: to deliver publications or resources requested through our website. We generally rely on legitimate interests in fulfilling those requests.

Marketing: to provide relevant product, event and industry updates. Our UK GDPR lawful basis may be consent or legitimate interests, depending on the circumstances. We also comply with PECR rules for electronic marketing, including obtaining consent where required and honouring opt-outs.

Analytics: to understand and improve website use. The UK GDPR lawful basis is determined for the specific processing activity; consent is obtained for cookies and similar technologies where required by PECR.

Security and administration: to operate and protect the website, maintain access controls and investigate incidents, generally on the basis of legitimate interests or a legal obligation where applicable.

Legal compliance: to comply with legal requirements, respond to lawful requests and establish or defend legal claims, relying on the appropriate lawful basis in the circumstances.

We use strictly necessary storage to make the site work, for example keeping authorised staff signed in. Where analytics tools are enabled, they may set cookies to measure visits and page usage. Non-essential cookies are only used in line with your choices, and you can block or delete cookies at any time through your browser settings.

Some pages embed videos from YouTube and Wistia. These providers may set their own cookies when you play a video and are covered by their own privacy policies.

See our Cookie Policy for more information.

We do not sell personal data. Where necessary, we may disclose it to website hosting and infrastructure providers, business communications and document management services, analytics and video providers, professional advisers, and regulators or authorities where legally required or permitted.

Where a provider processes personal data on our behalf, we use appropriate data-processing terms as required by Article 28 UK GDPR. Some recipients may act as independent controllers for their own purposes; where applicable, their own privacy notices explain those activities. We restrict disclosures to what is necessary and take appropriate steps to protect the information.

Some suppliers may process or access personal data outside the United Kingdom. Where an international transfer is restricted under UK GDPR, we use an appropriate transfer mechanism, which may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, or another lawful mechanism or exception.

Where required, we assess transfer risks and apply suitable contractual, technical and organisational safeguards. You may request further information about the safeguards relevant to your information by contacting us.

We retain personal data only for as long as necessary for the purpose for which it was collected, taking account of applicable legal, contractual, security and dispute-resolution requirements.

Enquiry and demonstration records are normally retained for up to three years after our last meaningful interaction unless an ongoing relationship or another justified requirement calls for longer retention. Marketing records are reviewed periodically; limited suppression records may be kept after an opt-out to prevent unwanted contact. Analytics, authentication, security and complaint records are retained according to our documented retention schedule.

When no longer required, information is securely deleted or anonymised, subject to lawful retention obligations.

We use appropriate technical and organisational measures to protect personal data, including encrypted connections, access controls limited to authorised staff and secure, reputable hosting providers.

Subject to the conditions and exemptions under UK law, you may have rights to be informed, access your personal data, correct inaccurate data, request erasure, restrict processing, object to processing (including an unconditional right to object to direct marketing), and receive portable data where applicable. Where we rely on consent, you may withdraw it at any time without affecting earlier lawful processing.

You also have rights and safeguards relating to certain solely automated decisions producing legal or similarly significant effects, where applicable.

To exercise a right, contact info@TCWin.co.uk. We normally respond within one month, subject to lawful extensions. Requests are generally free of charge, although limited exceptions apply. We may ask for information reasonably needed to verify identity.

We take complaints about the handling of personal data seriously. You may complain by emailing info@TCWin.co.uk or writing to our registered office. Please explain your concern and provide sufficient information to allow us to investigate.

We will acknowledge a data protection complaint within 30 days, take appropriate steps to investigate it without undue delay, request further information where reasonably necessary, and communicate the outcome without undue delay, including any relevant actions taken or proposed.

You also have the right to complain to the Information Commissioner’s Office (ICO). You do not need TCW's permission to do so. The ICO can be contacted through its official website or on 0303 123 1113.

We may update this policy from time to time. The latest version will always be published on this page with the date it was last updated.