Who we are and how to contact us
Crown Technology Limited is a private limited company registered in England and Wales, number 17393089. Our registered office is 9 Redwood Gardens, Thornton-Cleveleys, England, FY5 5NT. Contact enquiries@crownpartners.co.uk for privacy enquiries and rights requests.
Our role and your organisation’s role
We act as controller when deciding how to use personal information for accounts, service administration, billing, security, support, consultations, limited product measurement and our legal obligations.
Where your organisation puts personal information into its workspace for us to process on its instructions, we act as processor under the Data Processing Addendum. Your organisation is normally the controller, or a processor authorised by its own controller. It is responsible for its notices, lawful basis and instructions. The same record can serve distinct purposes: for example, a workspace file is customer-controlled content, while an access audit is used for our service security.
Information we collect
Account information includes names, business email addresses, roles, invitations, authentication and recovery records. Company information includes business identity, registration details, services and contact information, which may identify sole traders or individuals.
Workspace information includes assessment answers, policies, uploaded evidence, previous work, saved opportunities, generated documents and assistant interactions. Consultation records include requests, availability, attendees, adviser assignments and scheduling details. Support records include correspondence and information you provide when requesting help.
Billing records include purchases, subscription status, invoices and limited payment-provider references. We do not store full payment-card details. Security and technical records can include IP addresses, browser or device information, sign-in events, audit events and error information. Limited product milestones record actions such as completing a step or saving an opportunity.
Where information comes from
Information comes from you, your organisation’s owner or authorised users, our service providers when handling payments or service delivery, and records generated by use of the platform. Procurement information may come from public authorities, public notice services and buyer portals. If your organisation invites you or supplies information about you, it should also explain its use of that information.
Purposes and lawful bases
We use account and service information to provide the requested service and answer enquiries. Where the individual is personally party to the contract, this is necessary for the contract or requested steps before it. For representatives of a corporate customer, we rely on our legitimate interests in operating and supporting that business relationship.
We use billing information to collect payment and administer purchases on those same bases, and to meet tax and accounting legal obligations. Security, fraud prevention, access audits and fault investigation serve our legitimate interests in protecting customers and operating a reliable service, and legal obligations where applicable.
We use consultation and support records to arrange and deliver requested help, based on contract where applicable and otherwise our legitimate interests in serving the business customer. Limited product measurement serves our legitimate interests in understanding useful outcomes and improving reliability and journeys. We use records needed to establish, exercise or defend legal claims in our legitimate interests and retain legally required records under legal obligation.
If an optional activity requires consent, we ask separately and explain how to withdraw it. Withdrawing consent does not affect earlier lawful processing. Accepting the Terms or acknowledging this notice is not consent to marketing or every use of personal information. Processing customer-controlled workspace data follows the customer’s instructions under the Data Processing Addendum.
Information needed to provide the service
We need basic account, security and relevant billing details to provide access and paid services. Without them we may be unable to open or secure an account or complete a purchase. You choose which optional workspace information to provide, although missing information can limit a requested assessment or document. Do not include unnecessary personal information, special-category data or criminal-offence information. Your organisation must establish any additional legal conditions needed for such data.
Product measurement
Our product measurement records defined milestones, identifiers and bounded categories or counts. It does not collect answer text, searches, document contents, website content or AI conversations as product-event properties. This is distinct from storing the workspace content you ask us to process, and from technical or security logs used to operate the service. We do not sell personal information.
AI-assisted features
OpenAI provides AI processing for supported features. The in-depth report uses the company name, frozen assessment answers, approved criterion guidance, customer-readable assessment states and the action roadmap derived from those inputs. It does not send account email addresses, evidence files, Premium workspace records or internal scores for that report. The checkout request authorises the requested report generation; it is not a separate blanket GDPR consent.
Other AI features use the task-relevant information needed for the feature and the permissions you grant. The company owner can enable Winston access to saved work and uploaded files, including future uploads; relevant content can then be sent for processing. Revoking access stops further use dependent on that permission, but does not undo completed processing or automatically delete saved records.
OpenAI states that API business data is not used for model training by default unless the customer opts in. Provider security and abuse-monitoring retention may still apply. We do not promise UK-only AI processing or zero retention. See the linked supplier information and AI Transparency Notice for scope and controls. Review AI output: it can be inaccurate. We do not use AI to make solely automated decisions about individuals that have legal or similarly significant effects, or to make final readiness, eligibility or compliance decisions.
Who receives information
Access is limited to authorised staff and contractors who need information for their work, relevant service providers, your organisation’s authorised users and advisers involved in requested consultations. Providers include DigitalOcean for hosting, Resend for email, Stripe for payments and OpenAI for AI processing. Google Analytics receives limited visit and engagement information from public pages only when a visitor opts in. This includes page paths and referrers, scrolls, clicks to other sites, downloads, embedded video engagement, demonstration enquiry starts and successful submissions, and standard technical request details such as IP address and browser/device information. It is not used on account or company workspace pages, and form field values and site-search terms are not sent. Google Analytics user and event data associated with identifiers is configured for 14 months’ retention; most standard aggregated reports are not affected by this setting. The supporting supplier page explains provider roles and international processing.
Authorised staff may use controlled, audited support access when needed to assist a company or investigate a problem. We may disclose relevant information to professional advisers, regulators, courts or law-enforcement bodies where lawfully required or necessary to protect legal rights. We do not make Customer Content public merely because you upload it.
International transfers
Some suppliers operate internationally, including in the United States. UK hosting does not mean all email, payment, AI, support or backup processing stays in the UK. Our Subprocessors and International Transfers page identifies the services and links to their published locations and safeguards.
For restricted transfers, we must use an applicable UK adequacy regulation or appropriate safeguards, such as the UK International Data Transfer Agreement or UK Addendum to standard contractual clauses, with the required assessment and supplementary measures. You can request information about relevant safeguards or a copy from enquiries@crownpartners.co.uk; confidential commercial information may be redacted.
How long we retain information
The Data Retention Schedule linked below sets out periods and criteria by record type. We keep information while needed for the requested service, then delete or anonymise it unless a legal, security or claims-related reason justifies limited retention. Subscription cancellation and account deletion are different: cancelling paid access does not delete an ongoing free account. Backup copies and independently controlled supplier records can follow different retention cycles, as explained in the schedule.
Security
Controls include company access restrictions, owner permissions, authentication protections, audit records, private-file access controls and encryption for supported private files. See the Security Overview for scope. No system can guarantee absolute security. You should protect credentials, control invitations and only upload information you are authorised to share.
Your rights and objections
Depending on the circumstances, UK data-protection law gives you rights to access, correct, erase or restrict personal information, obtain portable information, and withdraw consent where processing relies on it. These rights have conditions and exceptions.
You have a right to object to processing based on legitimate interests on grounds relating to your particular situation, and an absolute right to object to direct marketing. Contact enquiries@crownpartners.co.uk. We may need proportionate information to verify identity or authority before acting. We normally respond within one month; where a lawful extension applies, we will explain it.
For information your organisation controls in its workspace, direct the request to that organisation first. We will assist it under the Data Processing Addendum and will not disclose another customer’s information in response to an unauthorised request.
Complaints
Please contact us if you have a concern so we can investigate. You may also complain to the Information Commissioner’s Office at ico.org.uk or by calling 0303 123 1113. You do not have to complain to us before contacting the ICO.
Cookies and changes to this notice
The Cookie Notice explains essential session and security cookies and optional Google Analytics on public pages. Analytics remains off until you actively allow it, and you can change your choice at any time from Cookie settings in the footer. It measures page views, public-site engagement and demonstration enquiry starts and successful submissions. We do not send form values or site-search terms. Identifier-associated Google Analytics user and event data is configured for 14 months’ retention. Google Signals and advertising personalisation are disabled, and Google may process the information under its published terms and policies.
We will update this notice when processing changes and identify the effective date. We will bring material changes to your attention before the changed processing where required, and obtain separate consent where legally necessary. An acknowledgement of a revised notice does not itself change the lawful basis or authorise unrelated uses.
Organisation details
Crown Technology Limited is a private limited company registered in England and Wales. Company number 17393089. Registered office: 9 Redwood Gardens, Thornton-Cleveleys, England, FY5 5NT. Email: enquiries@crownpartners.co.uk.