Privacy Policy

1. Introduction

BuildMoat Ltd is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and safeguard your personal information when you visit our website, complete our SM&CR AI Accountability Assessment, or engage with our services.

We take our data protection obligations seriously. As a company that builds accountability infrastructure for regulated financial services firms, we hold ourselves to the same standard of documented, evidenceable governance that we ask of our clients.

2. Data Controller

The data controller responsible for your personal information is:

3. Information We Collect

We collect information you provide directly to us, including:

• Contact information: name, work email address, firm name, and job title or SMF designation.
• Assessment responses: your answers to the SM&CR AI Accountability Assessment, your overall score, your domain scores, and your risk classification.
• Enquiry information: the content of messages submitted via our contact form, including your description of your firm's current situation.
• Communication preferences: whether you have opted in to receive updates from BuildMoat.

We also collect technical information automatically when you visit our website, including IP address, browser type, device information, pages visited, and time spent on pages. This information is used for website performance analysis only.

For clients engaged under a Master Services Agreement, we collect additional information necessary to deliver the service. This is governed by a separate Data Processing Agreement.

4. Legal Basis for Processing

Under UK GDPR, we process your personal data on the following legal bases:

• Consent: when you complete the assessment or contact form and agree to receive your results and follow-up communications from BuildMoat.
• Contract: to deliver services you have requested, including the AI Accountability Mapping Review and managed service engagements.
• Legitimate interests: to respond to enquiries, improve our services, and conduct business development activities where these do not override your rights.
• Legal obligation: to comply with applicable laws and regulations.

5. How We Use Your Information

We use the information we collect to:

• Deliver assessment results and gap summaries to you by email.
• Respond to enquiries submitted via our contact form.
• Schedule and conduct mapping review sessions.
• Deliver BuildMoat managed services under an executed Master Services Agreement.
• Send service-related communications including onboarding materials, weekly digests, and quarterly governance packs where you are an active client.
• Send updates about BuildMoat services and regulatory developments where you have given consent.
• Analyse and improve the performance of our assessment tool and website.

We do not use your information for automated decision-making or profiling that produces legal or similarly significant effects.

6. Assessment Data

When you complete the SM&CR AI Accountability Assessment, your name, firm, role, email, overall score, domain scores, and risk classification are stored in our systems. This data is used to send your results, to follow up with you about BuildMoat services, and to improve the assessment tool.

Assessment results are not shared with third parties. They are not used to make any automated decisions about you.

You may request deletion of your assessment data at any time by contacting hello@buildmoat.co.uk.

7. Data Retention

We retain your personal information for as long as necessary for the purposes for which it was collected.

• Website enquiry and assessment data: retained for 24 months from the date of submission unless you become a client or request earlier deletion.
• Client data under a Master Services Agreement: retained for the duration of the engagement plus seven years to comply with legal and regulatory obligations.
• Marketing and communications data: retained until you withdraw consent.
• Financial records: retained for seven years in accordance with HMRC requirements.

8. Data Sharing

We do not sell, trade, or rent your personal information to third parties.

We share your information only with the following categories of service providers, all of whom are contractually required to maintain appropriate security measures and are prohibited from using your data for their own purposes:

• Email delivery: Resend, used to send assessment results, mapping review confirmations, and service communications.
• CRM and pipeline tracking: Google Sheets and associated Google Workspace tools, used to manage our prospect and client pipeline.
• Workflow automation: n8n, used to route assessment submissions and trigger email delivery.
• Website hosting: Replit and associated infrastructure, used to host the BuildMoat website and assessment tool.

We may also disclose your information where required by law, by court order, or to protect the legal rights of BuildMoat Ltd.

In the event of a merger, acquisition, or sale of BuildMoat Ltd, your data may be transferred to the acquiring entity. We will notify you of any such transfer and your rights in relation to it.

9. International Data Transfers

Some of our service providers operate infrastructure outside the UK. Where we transfer personal data internationally, we ensure appropriate safeguards are in place in accordance with UK GDPR requirements, including Standard Contractual Clauses where applicable.

All client compliance data processed under a Master Services Agreement is stored on UK-resident infrastructure. This is a contractual commitment to all BuildMoat clients.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction.

These measures include:

• Encrypted data transmission via HTTPS
• Access controls limiting data access to authorised BuildMoat personnel
• Regular review of our security practices
• Contractual security obligations imposed on all third-party service providers

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and will notify affected individuals without undue delay where required.

11. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of access: request a copy of the personal information we hold about you.
• Right to rectification: request correction of inaccurate or incomplete information.
• Right to erasure: request deletion of your personal data, subject to legal obligations.
• Right to restrict processing: request that we limit how we use your data.
• Right to data portability: receive your data in a structured, commonly used, machine-readable format.
• Right to object: object to processing based on legitimate interests or for direct marketing purposes.
• Rights related to automated decision-making: we do not carry out automated decision-making that produces legal or similarly significant effects.

To exercise any of these rights, contact us at hello@buildmoat.co.uk. We will respond within one calendar month of receiving your request. We will not charge a fee for reasonable requests.

12. Right to Lodge a Complaint

If you believe we have not handled your personal data in accordance with UK GDPR, you have the right to lodge a complaint with the Information Commissioner's Office.

We would ask that you contact us first at hello@buildmoat.co.uk so we have the opportunity to address your concern directly before you escalate to the ICO.

13. Cookies

We use essential cookies necessary for the website to function, including session management and security. We use analytical cookies to understand how visitors use our website and to improve our service.

You can control non-essential cookie settings through your browser preferences. We do not use advertising or tracking cookies.

A full cookie notice is available on our website.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or data handling practices. We will post the updated policy on this page with a revised effective date. For material changes, we will notify active clients by email.

15. Contact

For any questions about this Privacy Policy or how BuildMoat Ltd handles your personal information:

hello@buildmoat.co.uk

buildmoat.co.uk