Privacy policy

1. Who we are

RiskOps is operated by KETLEX SOLUTIONS LTD, a company registered in England & Wales under company number 14233282 ("we", "us", "our"). We are the data controller for personal data processed through this platform, except where we act as a processor on behalf of a customer organisation (see section 3).

Privacy enquiries: privacy@riskops.co.uk

2. What personal data we process

• Account data — name, email address, organisation name and role, and authentication credentials handled by our authentication provider.
• Content you submit — organisation details, onboarding answers, risks, controls, tasks, vendor records, uploaded evidence and any personal data you choose to include in them.
• Technical data — IP address, device and browser information, and log records of requests to the service (including API requests), used for security and troubleshooting.
• Billing data — where you subscribe, subscription and transaction records handled by our payment provider. We do not store full card details.

3. Controller and processor roles

Where you use RiskOps as part of a customer organisation, that organisation decides what content is entered into the platform and is the controller of that content; we process it on their instructions as a processor. We are the controller for account, technical and billing data relating to the operation of the service.

4. Why we process it and our lawful bases

• Contract — to create and administer your account and provide the platform's features.
• Legitimate interests — to secure the service, prevent abuse, debug faults, and improve the product. We balance these against your rights.
• Legal obligation — to keep accounting records and to respond to lawful requests.
• Consent — for optional cookies and for marketing emails, where applicable. You can withdraw consent at any time.

5. AI features

Some features send the information you provide (for example onboarding answers, risk or vendor descriptions) to a third-party AI model provider to generate drafts and suggestions. Outputs are drafts for your review and are not professional advice. Please avoid entering personal data that is not necessary for the assessment you are carrying out.

6. Who we share data with

We share personal data only with service providers acting on our instructions, including hosting and database infrastructure, authentication, email delivery, AI model providers and payment processing. We also share data where required by law or to establish, exercise or defend legal claims. We do not sell personal data.

7. International transfers

Some providers may process data outside the UK. Where that happens we rely on UK adequacy regulations or on the International Data Transfer Agreement / the UK Addendum to the EU Standard Contractual Clauses, together with appropriate safeguards.

8. Retention

We keep account and content data for as long as your account is active and then for a limited period afterwards to allow recovery and to meet legal obligations. Request logs are kept for a short operational period. Accounting records are kept for six years as required by UK law. You can request deletion at any time (see section 10).

9. Security

Data is transmitted over encrypted connections and stored in access-controlled managed infrastructure, with organisation-level access rules so users can only reach their own organisation's records. No online service can be guaranteed completely secure; please use a strong, unique password.

10. Your rights

Under UK GDPR you have the right to access your data, to rectification, to erasure, to restrict or object to processing, to data portability, and to withdraw consent. To exercise any of these, email privacy@riskops.co.uk. We will respond within one month.

You can also complain to the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow SK9 5AF — ico.org.uk. We would appreciate the chance to address your concerns first.

11. Cookies

See our cookie policy for details of the cookies and similar technologies we use.

12. Changes

We may update this policy from time to time. Material changes will be notified in the product or by email, and the "last updated" date above will change.