Privacy Policy

Data controller: UKCSL Ltd, a company registered in England and Wales. UKCSL operates CanniComply in collaboration with Aidoido S.L. (Spain), our product-engineering partner. We are jointly responsible for the security of your data.

You can reach our data-protection team at privacy@ukcsl.co.uk.

We only collect data that is strictly needed to run the platform:

• Account data — your name, work email, business name, job title and department.
• Compliance content — SOPs and policies you upload, competency assignments, learning modules, question banks and assessment answers.
• Certificates — the signed record of every completed acknowledgement or assessment, including scores, timestamps and a unique verification ID.
• Usage telemetry — pages visited, actions taken and device/browser type. Used only to keep the service reliable and improve it.
• Support correspondence — anything you send us by email.

We do not collect health information, financial information beyond what is needed for billing, or any special-category data within the meaning of UK GDPR Article 9.

• Contract — to provide the platform you're paying for.
• Legitimate interest — to keep the service secure, prevent fraud and improve product quality.
• Legal obligation — to retain audit-grade compliance records for the period required by regulators.
• Consent — for optional marketing communications; you can withdraw this at any time.

• Data is stored on UK / EU infrastructure with encryption at rest (AES-256) and in transit (TLS 1.2+).
• Access is limited to CanniComply staff with a genuine operational need, and every access is logged.
• Certificates carry a tamper-evident verification ID and a QR code that resolves against our public /verify endpoint.
• Passwords are never stored in plain text — we use bcrypt with a per-user salt.

Compliance records exist to prove staff training on the day an inspector asks. We retain them for the lifetime of your subscription plus six years after the last relevant event, which matches the retention windows of the primary UK regulators our customers answer to (MHRA, Home Office, HSE, ICO).

When you close your account we delete or fully anonymise everything except the audit trail required by law. You can request a copy of your data at any time.

We do not sell your data. We use a small number of vetted sub-processors purely to deliver the service:

• Cloud hosting — infrastructure and file storage (UK / EU regions).
• Email delivery — Resend, used to send invitations, assignments and reminders.
• AI learning generation — Anthropic Claude, called only with the extracted text of SOPs you upload; content is not used to train third-party models.
• Product analytics — PostHog, self-hostable and cookie-lite; used to keep the platform reliable.

Each sub-processor is bound by a Data Processing Agreement and is reviewed annually. A full list is available on request.

Under UK GDPR you have the right to:

• Access the data we hold about you.
• Correct data that is inaccurate.
• Ask us to delete data we no longer need to hold.
• Restrict or object to certain processing.
• Take a portable copy of your data to another provider.
• Complain to the Information Commissioner's Office (ico.org.uk).

We use a small number of essential cookies to keep you signed in and remember your preferences. See our Cookie Policy for details.

If we make a material change we'll notify you by email and give at least 30 days' notice before it takes effect.