GDPR & Data Rights Statement

Last updated: 29 July 2026

This page sets out our position as a data controller under the UK GDPR and Data Protection Act 2018, and explains in full the rights you have over your personal data and how to use them. It supplements, and should be read alongside, our Privacy Policy.

1. Who is the data controller

[Company Name] Limited (company number [00000000], registered office [registered address]) is the data controller for personal data processed through revision.inventait.com.

We haven't appointed a formal Data Protection Officer, as we're not required to under UK GDPR given the nature and scale of our processing. Data protection queries should be sent to [privacy@inventait.com].

2. Our lawful basis for processing

Processing	Lawful basis
Creating your account, sending sign-in links, providing the subscribed content	Performance of a contract with you (Art. 6(1)(b))
Billing and subscription management via Stripe	Performance of a contract; legal obligation for tax/accounting records (Art. 6(1)(b) and (c))
Tracking your study progress	Performance of a contract — this is a core feature of the Service you've subscribed to
Security, fraud prevention, server logs	Legitimate interest in keeping the Service secure and reliable

3. International transfers

Our payment processor, Stripe, may process data outside the UK/EU as part of its global infrastructure. Where this happens, it relies on legally-recognised safeguards (such as Standard Contractual Clauses) — see stripe.com/privacy for details. We don't otherwise transfer your personal data outside the UK/EU.

4. Your rights in full

Under UK GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your personal data (also known as the "right to be forgotten"), subject to certain legal exceptions (e.g. billing records we must keep for tax purposes).
• Restriction — ask us to limit how we use your data in certain circumstances.
• Data portability — request your data in a structured, commonly-used, machine-readable format, to move to another service.
• Object — object to processing based on legitimate interest.
• Withdraw consent — where we rely on consent for anything, withdraw it at any time (this won't affect processing already carried out).
• Not be subject to solely automated decisions with legal or similarly significant effect — we don't currently make any such decisions about you.

5. How to exercise your rights

Email [privacy@inventait.com] from the address linked to your account, telling us which right you'd like to exercise. We'll respond within one month, as required by law (this can be extended by a further two months for complex requests, in which case we'll tell you why). There's no charge for a standard request.

We may need to verify your identity before acting on a request, to make sure we don't hand over or delete the wrong person's data.

6. Deleting your account

You can request account deletion at any time by emailing [privacy@inventait.com]. We'll cancel any active subscription, delete your personal data and study progress, and confirm once it's done — except billing records we're legally required to retain (see our Privacy Policy for retention periods).

7. Data breaches

If a personal data breach occurs that's likely to result in a risk to your rights and freedoms, we'll notify the Information Commissioner's Office within 72 hours of becoming aware of it, and notify you directly without undue delay where the breach is likely to result in a high risk to you.

8. Complaints

If you're unhappy with how we've handled your data, please contact us first so we can try to put it right. You also have the right to complain directly to the UK's supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
ico.org.uk · 0303 123 1113

9. Contact

[privacy@inventait.com]