Website Privacy Notice

1. Who we are

Recieved is a trading name operated by Bianca Schwartz, a sole trader based in Scotland. For personal information used for our own website, founding pilot, sales, account administration, billing, security and legal obligations, Recieved is the data controller.

Contact: bianca@recieved.co. Our business postal address and ICO registration position will be added before this notice is finalised.

When a business uses the Recieved platform to manage its own enquiries, onboarding and related operational information, that business will normally be the controller and Recieved will normally act as its processor under written instructions. In those circumstances, the business's own privacy notice should explain how it uses the information.

2. Information we collect

Depending on how you interact with us, we may collect:

Please do not provide special category data, criminal offence data or information that is not needed for your enquiry or use of the service.

• Identity and contact information, such as your name, email address, telephone number and business name.
• Founding pilot and enquiry information, such as your role, business type, team size, interests, questions and communication preferences.
• Account and commercial information, such as authorised users, subscription package, invoices, payment status and support history.
• Technical and usage information, such as IP address, device and browser details, pages viewed, timestamps, security logs and cookie or similar technology identifiers.
• Communications, including emails, support messages, feedback and records of your choices.
• Platform information processed for a client, which may include people, enquiries, onboarding steps, responsibilities, tasks, due dates, reminders, activity and related communications or documents.

3. How we collect information

We collect information directly from you when you apply for the founding pilot, contact us, create or use an account, provide feedback or communicate with us. We may also receive information from:

• A business that uses Recieved and has entered your details into its workspace.
• Authorised users within that business.
• Services a client chooses to use alongside Recieved.
• Technical and security services used to operate and protect the website and platform.
• Public business sources where it is lawful and reasonable to use them.

4. Why we use information and our lawful bases

We use personal information only where we have a lawful basis. Depending on the activity, this may include:

We do not use client operational content to train general-purpose AI models unless a separate purpose, lawful basis, contract and clear notice have been approved.

• To respond to enquiries, record waitlist interest and keep you updated about Recieved's development and availability.
• To provide accounts, subscriptions, onboarding, support and requested services where processing is necessary for a contract.
• To operate, secure, troubleshoot and improve our website and service where this is necessary for our legitimate interests, provided your rights do not override those interests.
• To manage billing, tax, accounting, fraud prevention, regulatory requests and other legal duties where necessary to meet a legal obligation.
• To send waitlist updates that you have requested. Joining the waitlist is not treated as consent to unrelated marketing. You can opt out at any time.
• To use optional analytics or advertising technologies only if introduced later and after any required consent has been obtained.
• To process client operational data on the documented instructions of the client controller.

5. Waitlist communications

Joining the waitlist is simply a record of your interest. It allows us to keep you posted about Recieved's development, availability and launch. It does not confirm pricing, entry, acceptance into a pilot, access to the service or a guaranteed place. Joining the waitlist is not consent to unrelated marketing. You can opt out at any time by contacting bianca@recieved.co.

Operational replies to an enquiry or account are not necessarily marketing. We will not add promotional content to a service message in a way that avoids applicable marketing rules.

6. Cookies and similar technologies

The website does not currently use analytics, advertising pixels or other non-essential tracking technologies. It may use essential storage and access technologies required for security, navigation, form submission and basic operation. If non-essential tracking is introduced later, this notice and the website controls will be updated before use and consent will be requested where required.

No non-essential cookie consent banner is required while no non-essential tracking technologies are in use. If this changes, a cookie notice and consent control will identify the technologies, providers, purposes and lifetimes, and rejecting them will be as straightforward as accepting them.

7. Who we share information with

Where necessary and lawful, we may share information with:

Suppliers may act as processors, sub-processors or independent controllers depending on their service and terms. A current sub-processor list will be published or made available before production use.

• Hosting, database, authentication, email, support, monitoring and security providers.
• Professional advisers, insurers, auditors and potential investors or purchasers subject to appropriate confidentiality and due diligence.
• Courts, regulators, law enforcement or public authorities where disclosure is required or permitted by law.
• A client controller and its authorised users where we process information on that client's behalf.

8. International transfers

Some suppliers may process information outside the United Kingdom. Before making a restricted transfer, we will use an appropriate safeguard recognised under UK data protection law and assess whether additional measures are needed. Further information about relevant safeguards will be available on request.

9. How long we keep information

We keep personal information only for as long as needed for the purpose for which it was collected, including legal, accounting, security and dispute requirements. Subject to final approval of the retention schedule:

We may keep minimal suppression information so that we can respect an opt-out.

• Waitlist and prospect information: until you withdraw or for up to 24 months after our last meaningful contact.
• Enquiry and support records: for up to 24 months after closure, unless needed for an active account or dispute.
• Customer account, contract and billing records: for the contract period and then for the period required by tax, accounting and legal rules.
• Security and audit records: for a proportionate period based on risk and investigation needs.
• Client operational data: according to the client agreement, documented instructions and approved retention settings.
• Backup copies: removed through the applicable backup expiry cycle.

10. Security

We use proportionate technical and organisational measures designed to protect personal information. These include access controls, tenant separation, encryption in transit and at rest, secure authentication, least privilege, monitoring, backups, supplier checks and incident procedures. No online service can guarantee absolute security.

11. Your rights

Depending on the circumstances and lawful basis, you may have rights to:

The right to object to direct marketing is absolute. You can object at any time and we will stop using your information for that purpose.

To exercise a right, contact bianca@recieved.co. We may need to verify your identity. If Recieved is processing your information only for a client business, we may direct the request to that controller and assist it.

• Ask for access to your personal information.
• Ask us to correct inaccurate or incomplete information.
• Ask us to erase information.
• Ask us to restrict how information is used.
• Object to processing, including direct marketing.
• Receive certain information in a portable format.
• Withdraw consent at any time where consent is the lawful basis.
• Ask for human review where a decision with legal or similarly significant effect is made solely by automated means.

12. Complaints

Please contact us first so that we can try to resolve your concern. You also have the right to complain to the Information Commissioner's Office. Guidance and contact options are available from the ICO website.

13. Children

The website and service are intended for business users aged 18 or over. They are not designed for children, and we do not knowingly collect children's information for our own purposes through the waitlist.

14. Automated processing and AI

The planned service may assist authorised users with classification, recommendations or drafting. The MVP does not permit autonomous high-impact decisions. Relevant outputs should be reviewable and subject to human oversight. If Recieved introduces solely automated decisions that produce legal or similarly significant effects, this notice and the product controls will be updated before use.

15. Changes to this notice

We may update this notice when our service, suppliers or legal obligations change. We will publish the updated version and clearly identify the effective date. Where a change materially affects people, we will take reasonable steps to draw attention to it.