Privacy Policy
Effective date: 20 October 2026
This Privacy Policy explains how Goodley Technology Limited collects, uses, stores and protects personal data when you visit our website, deal with us as a client or prospective client, or use the Goodley Platform. Goodley is committed to handling your personal data in an open and transparent way.
1Who we are and what this policy covers
Goodley Technology Limited (Goodley, we, us) provides a compliance platform that helps financial regulated firms identify, manage and evidence their regulatory obligations.
Our contact details
Goodley Technology Limited, company number 17087840
Flat 127 Swan Court, Chelsea Manor Street, London, England, SW3 5RY
Email: info@goodley.ai
Where we are the controller. For the personal data described in this Privacy Policy, Goodley is the data controller under the UK GDPR and the Data Protection Act 2018, meaning we decide how and why it is processed. This Privacy Policy applies to:
- visitors to our website;
- contacts at our clients and prospective clients; and
- individuals who have a login to the Goodley Platform (users), in relation to their account details and their use of the Goodley Platform.
Where our client is the controller. Our clients use the Goodley Platform to store and manage their own compliance records, which may include personal data about their employees, customers and other individuals. For such personal data, the client is the controller and Goodley acts only as its processor, under our Data Processing Agreement.
2Information we collect
Information you give us
- Account information. Your name, work email address, contact details, job title and the firm you work for.
- Billing information. Billing contact details and records of invoices and payments. Payments are made by bank transfer or Direct Debit, and we do not collect card details.
- Communications. Anything you send us by email or through the Goodley Platform, including feedback, support requests and correspondence.
Information we collect automatically
- Usage data. Information about how you use our website and Goodley Platform, including IP address, browser type, operating system, pages visited and features used.
- Cookies. We use cookies and similar technologies on our website and Goodley Platform. See section 9.
Information from other sources
- Your firm. The firm that gives you access to the Goodley Platform provides your name and work email so we can set up your login.
- Integrations. If your firm connects another service to the Goodley Platform, we may receive data from it, such as authentication details.
- Public sources. We may use public sources, such as the FCA Register, to confirm details about the firm you work for.
3How we use your information and our legal basis
| Purpose | Legal basis |
|---|---|
| Setting up and managing your login, and providing the Goodley Platform to your firm | Legitimate interests, necessary for performing our contract with your firm |
| Invoicing and collecting payment | Legitimate interests, and legal obligation for tax and accounting records |
| Providing support and responding to enquiries | Legitimate interests, necessary for performing our contract with your firm |
| Telling you about changes to the Goodley Platform, our terms and conditions or this Privacy Policy | Legitimate interests |
| Sending regulatory change alerts that are part of the service | Legitimate interests, necessary for performing our contract with your firm |
| Keeping the Goodley Platform secure and preventing fraud or misuse | Legitimate interests, legal obligation and necessary for performing our contract with your firm |
| Understanding how the Goodley Platform is used so we can improve it, using aggregated and anonymised statistics where possible | Legitimate interests |
| Sending newsletters and promotional content | Consent, which you can withdraw at any time |
| Responding to lawful requests from regulators, courts or law enforcement | Legal obligation |
Where we rely on legitimate interests to process personal data, we ensure they do not override your rights. You can object to this processing at any time (see section 8).
AI features. The Goodley Platform uses AI models to help generate outputs such as assessments and draft documents. We do not use the content your firm puts into the Goodley Platform to train AI models, and our AI providers are contractually prohibited from doing so.
Automated decisions. We do not make decisions about you based solely on automated processing of your personal data that have legal or similarly significant effects.
4Sharing your information
We do not sell or rent your personal data. We share it only in the circumstances below.
Service providers. We use trusted providers who process personal data on our behalf and only on our instructions, under contracts that require them to keep the personal data confidential and secure. Refer to our Sub-processors page for more details.
Your firm. Administrators at the firm that gave you access can see your account details and your activity in the Goodley Platform.
Legal and regulatory authorities. We may disclose your personal data to regulators, law enforcement or other public bodies where the law requires it, in response to valid legal process, or to protect our rights and the safety of others.
Business transfers. If Goodley is involved in a merger, acquisition or sale of all or part of its assets, your personal data may be transferred as part of that transaction. We will tell you about any such change and make sure your personal data remains protected to an equivalent standard.
5International data transfers
Personal data held in the Goodley Platform is stored and processed within the United Kingdom and the European Economic Area.
Some providers we use for our own business operations, such as email and support tools, may process limited account and contact data outside the UK and EEA. Where that happens, we make sure appropriate safeguards are in place, such as:
- a UK adequacy decision covering the destination country;
- the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses; or
- another safeguard permitted under the UK GDPR.
You can ask us for more information about these safeguards at info@goodley.ai.
6Data retention
We keep personal data only for as long as we need it for the purposes it was collected for, including legal, accounting and reporting requirements.
| Data | How long we keep it |
|---|---|
| Account information | While your login is active. After your firm's agreement with us ends, we keep contract and contact records for six (6) years for legal and accounting reasons |
| Billing information | Six (6) years, to meet tax, audit and financial reporting requirements |
| Communications | As long as needed to resolve your enquiry and keep a record of our communications with you |
| Usage data | Identifiable usage data is deleted or anonymised within two (2) years. We may keep anonymised or aggregated data for analytics |
These periods apply to the personal data covered by this Privacy Policy. The compliance records clients store in the Goodley Platform are deleted after that firm's agreement with you ceases in accordance with the timetable in our Data Processing Agreement.
7Data security
We use appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction, including:
- Encryption. TLS 1.2 or higher for data in transit and AES-256 for data at rest.
- Access controls. Access to personal data is limited to authorised personnel who need it for their work.
- Secure infrastructure. The Goodley Platform is hosted on Amazon Web Services in the United Kingdom (London, eu-west-2).
- Security testing. We regularly test and review our security measures and fix what the testing finds.
- Training. Our staff receive regular training on data protection and security.
No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects your personal data, we will tell you and the regulator where the law requires it.
8Your rights
Under the UK GDPR and the Data Protection Act 2018, you have the right to:
- Access. Ask for a copy of the personal data we hold about you and information about how we process it.
- Rectification. Ask us to correct inaccurate or incomplete personal data.
- Erasure. Ask us to delete your personal data in certain circumstances, such as when it is no longer needed or you withdraw consent.
- Restriction. Ask us to limit processing in certain situations, such as while we check its accuracy.
- Portability. Ask for your personal data in a structured, machine-readable format.
- Object. Object to processing based on legitimate interests, and to direct marketing at any time.
- Withdraw consent. Where we rely on consent, withdraw it at any time. This does not affect processing that has already taken place.
To exercise any of these rights please email info@goodley.ai. We shall endeavour to respond within one (1) month, however we may extend this by up to two (2) months for complex requests.
9Cookies
We use cookies and similar technologies on our website and Goodley Platform.
- Essential cookies. Needed for the Goodley Platform to work, including sign-in and security.
- Functional cookies. Remember your preferences and settings.
- Analytics cookies. Help us understand how our website and Goodley Platform are used so we can improve them. We set these only with your consent.
We do not use advertising cookies. Our Cookie Policy lists the cookies we use and explains how to manage them.
10Changes to this policy
We may update this Privacy Policy to reflect changes in how we process data, in the law or in our business. We will tell you about significant changes by email or through a notice on the Goodley Platform.
11Contact us and complaints
If you have a question, concern or request about this policy or how we handle your data, please contact us:
Goodley Technology Limited, Flat 127 Swan Court, Chelsea Manor Street, London, England, SW3 5RY
Email: info@goodley.ai
If you are unhappy with how we have handled your data, you have the right to complain to the Information Commissioner's Office:
Website: ico.org.uk
Phone: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF