Privacy Policy

1. Who we are

Good2Govern is a governance and compliance platform for charities, CICs, clubs and community organisations. References to "we", "us" or "our" in this policy refer to Good2Govern. For data protection purposes, we are the Data Controller for personal data you provide to us. You can contact us at: info@good2govern.co.uk.

2. What data we collect

We collect the following types of personal data:

• Account data: your name, email address, and organisation details when you register.
• Assessment data: answers and responses you provide during the readiness assessment.
• Contact form submissions: name, email, organisation and any message you send.
• Payment data: billing information processed securely by Stripe. We do not store card details.
• Usage data: how you use the platform (e.g. pages visited, features used) via anonymous analytics.

3. How we use your data

We use your data to:

• Provide, operate and improve the Good2Govern platform and services.
• Send you your readiness assessment report and related communications.
• Process subscription payments and manage your account.
• Respond to enquiries and support requests.
• Send product updates and relevant governance guidance (you can unsubscribe at any time).
• Meet our legal and regulatory obligations.

4. Our legal basis for processing

Under UK GDPR, we rely on the following legal bases:

• Contract: processing necessary to provide the services you have signed up for.
• Legitimate interests: improving our platform, preventing fraud, and direct marketing to existing customers.
• Consent: where you have explicitly agreed, such as signing up via the contact form.
• Legal obligation: where we are required by law to process your data.

5. How long we keep your data

Assessment submissions are retained for 30 days unless you create an account. Account data is retained for the duration of your subscription plus 12 months. Contact form submissions are retained for 24 months. You can request deletion at any time (see Section 8).

6. Who we share data with

We do not sell your personal data. We share data only with trusted third-party processors, including:

• Stripe — payment processing. International transfers use Stripe's current UK GDPR mechanisms (adequacy decisions and/or Standard Contractual Clauses / UK IDTA as applicable). Privacy Shield is no longer a valid transfer framework.
• Base44 — our platform infrastructure and hosting provider.
• OpenAI / AI providers — for generating AI-powered narrative content within your report (anonymised).

All processors are required to handle your data in accordance with UK GDPR.

7. Cookies

We use essential cookies to operate the platform and analytics cookies to understand how visitors use our site. You can control cookies through your browser settings. We do not use advertising or tracking cookies.

8. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Erase your data ("right to be forgotten").
• Restrict or object to processing.
• Data portability — receive your data in a structured format.
• Withdraw consent at any time where consent is our legal basis.

To exercise any of these rights, please email us at info@good2govern.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the ICO (Information Commissioner's Office).

9. Changes to this policy

We may update this policy from time to time. We will notify registered users of significant changes by email. The latest version will always be available on this page.

10. Contact us

For any privacy-related queries, please contact us at info@good2govern.co.uk.