Privacy policy
What we collect, why, and what you can ask us to do.
A plain-English account of every piece of personal data we touch, the legal basis for touching it, the third parties involved, and the rights you can exercise.
1. Who is the data controller
The data controller for this site is Horizon Workflow Limited, trading as Board Ready IT, a private limited company registered in England and Wales (company number 15898019), whose registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.
You can reach the data controller by emailing hello@boardreadyit.com.
2. ICO registration
Horizon Workflow Limited is registered with the UK Information Commissioner's Office under the Data Protection (Charges and Information) Regulations 2018. Registration reference: ZC144748. The entry on the public register is at ico.org.uk/ESDWebPages/Entry/ZC144748.
3. What personal data we collect
This is a small product site. We collect very little personal data, and we collect it only to sell and support the toolkits.
- Purchase information. When you buy a digital toolkit, Paddle (the merchant of record) collects your name, email address, billing address, and payment method to process the sale. Paddle is a separate data controller for this information. We receive only summary order data (order ID, product, net amount, buyer email) from Paddle.
- Support correspondence. If you email us (for example, to ask a question or request a refund), we hold that correspondence and your email address for as long as needed to deal with it.
- Theme preference. If you toggle the site to dark mode, your choice is stored in your browser's localStorage. This is local to your device and never sent to us.
This site does not run analytics, advertising pixels, or behavioural tracking, and it does not set cookies. It does load two web fonts from third-party CDNs, which is described in section 5.
4. Why we collect it (legal basis under UK GDPR)
| Data | Purpose | Legal basis |
|---|---|---|
| Purchase data (held by Paddle) | To complete the sale, issue an invoice, and process refunds | Performance of a contract |
| Summary order data | To support buyers and meet accounting obligations | Legitimate interest, and legal obligation for accounting records |
| Support correspondence | To answer your question or process your request | Legitimate interest in supporting buyers |
5. Third parties who process data for us
We use the following processors and partners. Each is bound by a data-processing agreement and by Standard Contractual Clauses where international transfers are involved.
- Paddle (Paddle.com Market Limited), United Kingdom. Merchant of record for toolkit purchases. Paddle is a separate data controller, not a processor on our behalf. Its privacy policy is at paddle.com/legal/privacy.
- GitHub Pages (GitHub Inc.), United States. Static hosting for the site itself. GitHub processes server logs (IP, timestamp, user-agent) for security purposes. Standard Contractual Clauses apply.
- Web fonts: Fontshare (Indian Type Foundry Pvt Ltd), India, and Google Fonts (Google LLC), United States. The site loads two display typefaces from these CDNs purely for typography. When your browser fetches the font files, your IP address is shared with the CDN for that request. Neither CDN is used to track you across sites, and we receive no data from them. If you would prefer to avoid the CDN entirely, you can block third-party requests in your browser; the site will fall back to your system fonts. Standard Contractual Clauses apply to the US and Indian transfers.
6. Cookies and local storage
This site sets no cookies. The only thing stored on your device is your dark/light theme preference, kept in localStorage and never transmitted off-device. To clear it, clear site data for boardreadyit.com in your browser.
7. How long we keep your data
- Purchase records. Paddle retains the full transaction record per its own policy. We receive summary order data which we retain for accounting purposes for 6 years from the end of the financial year, as required by UK statutory record-keeping obligations.
- Support correspondence. Kept while needed to deal with your request, and then deleted within 12 months unless it relates to an ongoing matter.
8. Your rights under UK GDPR
You have the right to access the personal data we hold about you, to have inaccurate data corrected, to have your data erased (subject to our legal record-keeping obligations), to restrict processing, to receive your data in a portable format, and to object to processing based on legitimate interest.
To exercise any of these rights, email hello@boardreadyit.com. We will respond within one month and confirm what action we have taken.
9. Complaints
If you are unhappy with how we have handled your personal data, you have the right to complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint. We would prefer the chance to put things right first, so please contact us before escalating if you can.
10. Changes to this policy
We may update this policy from time to time. The current version is always at this URL, and the "Last updated" date below will change.