Legal
Privacy notice
Draft
This privacy notice has been checked against UK GDPR but has not yet been reviewed by a solicitor. It may change.
This notice explains what personal data Forwardcycle collects, why, how long we keep it and your rights. We collect as little as we need, and we never sell it.
Who we are
Forwardcycle Ltd, a company registered in England and Wales, number 14091381. Registered office: Kemp House, 160 City Road, London EC1V 2NX. We are the data controller for the personal data described here.
We are registered with the Information Commissioner's Office as a data controller, registration number ZC206274. You can check this on the ICO's public register at ico.org.uk.
For any privacy question or request, email info@forwardcycle.co.uk. We are not required to appoint a Data Protection Officer and have not done so.
What we collect and why
| When | What | Why | Lawful basis | How long |
|---|---|---|---|---|
| Free assessment | Name, email address, company, role, staff numbers, sector, your answers and your score | To send you your report and, if you agree, to follow up | Consent | 12 months, unless you become a client |
| Contact form | Name, email address, company, your message, how you would like us to get back to you, your phone number (only if you ask for a call) and times that suit you | To reply to your enquiry | Legitimate interests (replying to you) | 12 months |
| Client portal | Name, email address, organisation, and the documents, comments and records shared during an engagement | To deliver the work we have agreed | Contract | 6 years after the engagement ends |
| Security records | Who viewed or changed a record and when, never the content | To keep client information secure and accountable | Legitimate interests (security) | 2 years |
Where we rely on legitimate interests, our interest is replying to people who contact us and keeping client information secure. We have weighed this against your privacy and consider the use expected and proportionate.
You do not have to give us any personal data. If you do not, we will not be able to send your assessment report, reply to your message or provide our services.
Details of people at client organisations who use our client portal are usually given to us by their employer, as part of an engagement.
We do not collect payment details, government identifiers or special category data through this website. The site is not aimed at children.
Automated decisions
The assessment calculates a readiness score and indicative savings automatically from your answers. This gives you information only. We do not make any decision about you that has legal or similarly significant effects by automated means.
AI services
We do not send your personal data, your assessment answers or client information to any AI service. If that ever changes, we will update this notice first and ask for your agreement where the law requires it.
Who we share it with
We use a small number of trusted providers to run the site. They act as our processors, under written terms, and only on our instructions.
- Supabase: Database, sign-in and file storage (London, UK)
- Netlify: Website hosting (Global network)
- Resend: Sending emails such as sign-in links (Ireland, EU)
Some of these providers are companies based outside the UK, so their staff may be able to access data from other countries. Where that happens we rely on UK adequacy regulations or on the safeguards in their data processing terms, such as the International Data Transfer Addendum issued by the ICO. You can ask us for details.
We do not sell personal data, and we only share it with others where the law requires us to.
How we protect it
Our database and files are stored in the UK and protected by access controls: each person can see only what their role allows. Files are kept in private storage and shared through short-lived links. We keep a record of who views or changes client records.
Your rights
You have the right to:
- ask for a copy of the personal data we hold about you
- ask us to correct it if it is wrong
- ask us to delete it
- ask us to restrict how we use it
- object to how we use it, where we rely on legitimate interests
- ask for your data in a format you can take elsewhere
- withdraw your consent at any time, where we rely on consent
Email info@forwardcycle.co.uk. We will reply within one month.
If you are unhappy with how we have handled your data, please tell us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.
Cookies
We only use essential cookies. See the cookie policy.
Changes to this notice
We will update this notice if anything changes. Last updated 8 October 2026.