GDPR Compliance
How Readylert handles your data under UK and EU GDPR
Our GDPR commitments
We only collect data we genuinely need to provide the service
Customer sessions contain no personal data — only a random UUID and order status
We never sell data to third parties
We never use your data for advertising or behavioural profiling
Data is encrypted in transit (TLS 1.3) and at rest (AES-256)
We respond to GDPR requests within 30 days
We are registered with the UK Information Commissioner's Office (ICO)
We notify affected users within 72 hours of any data breach
Who is the data controller?
Readylert Ltd is the data controller for vendor personal data (names, emails, business information). Readylert Ltd is registered with the UK Information Commissioner's Office (ICO). Our ICO registration number is available on request.
For customer session data, Readylert Ltd acts as a data processor on behalf of the vendor (the data controller), as the vendor determines what order notifications are sent and to whom.
Data we process
Vendors: Name, email, business name, business address, hashed password, Stripe customer ID. Lawful basis: Contract performance (Article 6(1)(b)).
Customer sessions: Session UUID, order number, order status, timestamps. No personal data is collected. Lawful basis: Legitimate interests of the vendor in notifying their customer (Article 6(1)(f)).
Server logs: IP addresses and user agents. Lawful basis: Legitimate interests in security monitoring (Article 6(1)(f)). Retained for 30 days.
International data transfers
Readylert's infrastructure is hosted on Replit Inc. servers in the United States. Data transfers to the US are covered by Standard Contractual Clauses (SCCs) as adopted by the European Commission.
Stripe, our payment processor, also operates in the US and multiple other jurisdictions. Stripe maintains its own adequacy agreements and SCCs. See Stripe's GDPR documentation for details.
Data retention
Vendor account data is retained for the duration of the contract plus 2 years. Customer session data is retained for a period configured by the vendor (default 30 days). Server logs are retained for 30 days. Payment records are retained for 7 years to comply with UK tax law.
Your rights under GDPR
Right of access (Article 15)
You can request a copy of all personal data we hold about you. We will provide this within 30 days at no charge.
How: Email privacy@readylert.com with the subject 'Subject Access Request'
Right to rectification (Article 16)
If any data we hold about you is inaccurate or incomplete, you have the right to have it corrected.
How: Update your account details in Settings, or contact us at privacy@readylert.com
Right to erasure (Article 17)
You can request that we delete all personal data we hold about you ('right to be forgotten'), subject to legal obligations to retain certain records.
How: Email privacy@readylert.com with the subject 'Data Deletion Request'
Right to restriction of processing (Article 18)
In certain circumstances, you can ask us to restrict how we process your data.
How: Contact privacy@readylert.com
Right to data portability (Article 20)
You can request a machine-readable export of your personal data in JSON or CSV format.
How: Email privacy@readylert.com with the subject 'Data Export Request'
Right to object (Article 21)
You have the right to object to processing based on legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds.
How: Contact privacy@readylert.com
Complaints
If you believe we have mishandled your personal data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk, or with your local EU supervisory authority if you are based in the EU.
We encourage you to contact us first at privacy@readylert.com so we can try to resolve the issue directly.
GDPR enquiries
Our Data Protection contact is available for any GDPR-related questions or requests.