Privacy notice

This notice explains how AndersonRisk Limited uses personal information: when you visit this website, when you use the Seven Questions, when you contact us, and when you take part in a review or risk maturity assessment we carry out for an organisation. We keep it short because we collect very little.

Who we are

AndersonRisk Limited is the controller of your personal information. We are registered in England and Wales, company number 09386279, with our registered office at 10 Fairway Close, Harpenden, AL5 2NN. We are registered with the Information Commissioner’s Office, registration number ZC260108. For anything about your information, email Richard Anderson at rca@andersonrisk.com.

When you visit this website

The site sets no cookies and does not track visitors. Where an article has an audio edition, the site counts how many times the recording is played and downloaded: it keeps a running total for each article and nothing else, so no IP address, cookie or other detail that could identify you is recorded. It has three forms: one for the Seven Questions, and two for the AI Blast Zone (one to open the tool, one to suggest a change to its evidence register), all described below. Our hosting provider, Netlify, automatically records technical information when pages are requested, including your IP address, browser type and the time of your visit. This is used only to deliver the site securely and reliably, and Netlify keeps it for a limited period under its own policies.

When you use the Seven Questions

Your answers to the Seven Questions are worked out in your own browser and shown on screen. They are not stored. They travel in the web address of your results page, so, like any page request, they may appear briefly in our hosting provider’s technical logs, without your name.

If you ask for your report, or ask us to set up the questions for your board or senior management team, the form sends us your name, organisation, role, email address, any phone number or note you add, your answers, and the numbers of people to invite. We use this only to respond to your request. We never ask for the names or details of the other people you invite.

The form has two optional boxes, both unticked. The first asks us to keep your details and email you from time to time about our work, including AI Risk Reading; you can unsubscribe at any time. The second adds your organisation’s combined, anonymous results to our benchmark; your organisation is never named, and participating organisations receive the benchmark findings periodically.

When directors or senior managers answer through a private link, we do not know who holds which link. Individual answers are never shown to anyone, including the person who invited them, and are deleted once the combined report is delivered. Each person can see and save their own answers when they finish.

When you use the AI Blast Zone

Before the AI Blast Zone opens, the form sends us your name, organisation, role and email address, together with a record that you have read and accepted the note that the tool is illustrative and is not advice, and the time you did so. We use this to know who has used the tool and to keep a record of that acceptance.

Anything you then enter about your organisation, and the report you download, stay in your own browser on your own device. They are never sent to us. The form has one optional box, unticked, which asks us to keep your details and email you from time to time about our work, including AI Risk Reading; you can unsubscribe at any time.

When you suggest a change to the AI Blast Zone register

The suggestion form sends us your name, email address, any organisation you give, your suggestion and the evidence link. We use these only to review your suggestion and, if needed, to ask you about it. If you tick the optional box and your suggestion is accepted, we may acknowledge you by name in the register; otherwise we never publish your details. We keep suggestions while they are relevant to the register, and delete them within two years.

When you contact us

If you email or phone, we receive your name, contact details and whatever you choose to tell us. We use this to reply, to discuss possible work, and to keep a record of our correspondence. We do not add you to a mailing list or send you marketing unless you ask us to.

When you take part in a review

If your organisation engages us, we may interview you and receive board papers and other documents that mention you. We use this information only to carry out the review for your organisation. Interview comments are treated in confidence, and our reports present findings without attributing views to named individuals unless you agree. The engagement letter with your organisation sets out how long review material is kept and how it is returned or destroyed.

When you try the full risk maturity assessment yourself

If you ask to try the full assessment, the form sends us your name, organisation, role and email address, and whether you would like us to keep in touch. We use these to email you a personal link, to show you your result and, if you ask, to talk to you about it. Your answers are saved as you go, so that you can come back to them, and are held securely by Netlify in the European Union (Frankfurt). Only we see them. We keep your answers and details for no more than two years, or until you ask us to delete them; if you tick the box to keep in touch, we keep your contact details as described below.

When you ask about an assessment for your organisation

The enquiry form sends us your name, role, work email, any phone number, your organisation, its type, the rough numbers who would take part, and anything else you tell us. We use these only to reply and to discuss the work, and we email you a copy of your enquiry.

When you take part in a risk maturity assessment

If your organisation asks us to assess its risk management, it gives us your name, work email address, role level and department, so that we can send you a personal link to the questions. We ask your organisation to let you know before the invitation arrives, and the invitation itself comes from us.

Your answers and any comments are saved as you go, so that you can return to the questions through your link until you submit. While you are answering, a copy of your unsaved answers is also kept in your own browser, and removed once they are saved. Your answers are held securely by our hosting provider, Netlify, in the European Union (Frankfurt), separately from your name and email address.

Your answers are confidential. Only we see individual answers. Your organisation receives grouped results only, and no group of fewer than five people is ever reported. Comments are reported without your name, and may be edited to remove anything that would identify you. Your organisation sees how many people in each group have responded, but not who.

We use your name and email address only to send you the invitation and reminders, which go through our email provider, Resend, from its servers in the European Union (Ireland). Once the report is issued, we delete every name and email address from the assessment. What remains is your answers with your role level and department, which we keep for as long as our engagement with your organisation requires, and in any case for no more than two years. With your organisation’s agreement, we may add its combined results to our benchmark, without naming it.

Our lawful basis

We rely on our legitimate interests in responding to enquiries and requests, running our business and carrying out reviews. Where you tick an optional box on the Seven Questions or AI Blast Zone forms, we rely on your consent, which you can withdraw at any time by emailing us. Where we have a contract with you, we rely on that contract. We also keep some records because the law requires it, for example for tax and company purposes.

Who else handles your information

We use a small number of trusted providers who process information on our behalf: Netlify, which hosts this website, receives form submissions and stores risk maturity assessment answers, Resend, which sends the invitation and reminder emails for risk maturity assessments, and Microsoft 365, supplied through GoDaddy, which provides our email. We will never sell your information. We do not share it with anyone else, except where the law requires it or with our professional advisers under a duty of confidence.

Netlify, Resend and Microsoft are based in the United States, so some information may be processed outside the UK. Where that happens, it is protected by safeguards recognised under UK data protection law.

How long we keep it

We keep correspondence for as long as it is useful, and business records for up to six years after our last dealings with you, unless the law requires longer. Review material is kept as agreed in the engagement letter.

If you ask us to keep in touch, we keep your name and contact details until you unsubscribe, and we periodically remove people who no longer engage. Individual answers given through a private board or senior management team link are deleted once the combined report is delivered. Names and email addresses in a risk maturity assessment are deleted once the report is issued. Benchmark totals are kept without any organisation’s name.

Your rights

You have the right to ask for a copy of your information, to have it corrected or deleted, to restrict or object to how we use it, and to ask for it to be transferred to someone else. To use any of these rights, email rca@andersonrisk.com. We will respond within one month.

If you are unhappy with how we have handled your information, please tell us first so we can try to put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

Changes to this notice

If we change how we use personal information, we will update this page and the date at the top.