How we look after your personal data — in plain language.
Last updated: 10 August 2026
RiskKit is risk assessment software, provided by PSA Studio (operated by Paul Smith, a sole trader based in Ayrshire, Scotland). In this policy, “we” and “us” mean PSA Studio. If you have any question about your data, email privacy@psastudio.org.
We are registered with the Information Commissioner’s Office (registration number to be added here).
Data protection works differently depending on how you are using RiskKit:
Where we are the controller. Your name, work email, employer, job role and the content of any message you send us when you request a demo, make an enquiry or hold an account. For account holders we also keep sign-in records and audit logs of actions taken in the system.
Where we are a processor. On behalf of customer organisations, the system holds your account details and the assessments your organisation writes. We handle it only on the organisation’s documented instructions.
We also keep basic technical logs — the pages requested and rough timing — so we can keep the service working and spot abuse. We do not sell anything to anyone, ever, and we do not use your data to train AI models.
To run the service you signed up for. Our UK GDPR Article 6 lawful bases are:
Where we are a processor, we do not choose the purpose of the processing and do not rely on our own lawful basis for the organisation’s records. It identifies its own basis, and we act only on its documented instructions under our agreement.
We use a small number of suppliers, each engaged under written data protection terms that meet Article 28 of the UK GDPR:
They act on our instructions and are not permitted to use your data for their own purposes. We will tell customer organisations in advance if we intend to add or change a supplier that handles their data, so they have a chance to object.
We take the technical and organisational measures required by Article 32 of the UK GDPR. In practice that means data encrypted in transit and at rest, access limited to named individuals on a least-privilege basis and protected by multi-factor authentication, row-level access rules so one organisation can never see another’s data, audit logging, regular backups held in the same regions as the live data, and dependency and patch monitoring.
If a breach happens that puts your rights at risk, we will report it to the ICO within 72 hours of becoming aware of it, and tell you directly where the law requires it. Where we act as a processor, we will notify the organisation without undue delay so it can meet its own 72-hour deadline.
Enquiry correspondence is kept for 24 months from our last contact with you, then deleted. If the enquiry becomes a piece of work, the related records are kept for 6 years after it ends, because tax and contract law expect that. Technical logs are kept for 90 days. Account records are kept for as long as the account is open and for 12 months afterwards. Mailing list entries are kept until you unsubscribe.
Records held on behalf of an organisation are kept for as long as that organisation instructs us to keep them, in line with the retention schedule in our agreement. When the agreement ends, we delete or return that data at its choice.
If you ask us to delete data we hold about you, we will do so within one month unless we are required to keep it by law.
Your data is stored in the United Kingdom or the European Economic Area.
One exception: Stripe, Anthropic may process a request in the United States. That is a restricted transfer, and we rely on the ICO’s International Data Transfer Addendum to the EU Standard Contractual Clauses as the safeguard, together with a transfer risk assessment. If we ever move any other processing outside the UK or EEA, we will update this page before we do it.
You can ask us for a copy of your data, to correct it, to delete it, to restrict how we use it, to receive it in a portable format, or to object to our use of it. Where we rely on consent, you can withdraw it at any time. We do not make any decision about you by automated means alone.
Email privacy@psastudio.org and we will reply within one month. If the request is complex we may extend that by up to two further months and will tell you why.
If your request is about records held by an organisation using RiskKit, please contact that organisation — they are the controller for those records. If you send the request to us we will pass it on promptly and help them answer it.
If you are not happy with our answer you can complain to the Information Commissioner’s Office at ico.org.uk. We would appreciate the chance to put things right first.
We use only what is strictly necessary to keep you signed in and to keep the service secure. We do not use advertising, analytics or tracking cookies, so we do not ask for cookie consent.
If we change this policy we will update the date at the top. If the change is significant we will tell you directly.
PSA Studio (operated by Paul Smith, a sole trader based in Ayrshire, Scotland)
privacy@psastudio.org