Privacy Notice

This notice explains how Philip George Advisory ("we", "us") collects and uses personal data when you use the Policy Generator, in line with the EU GDPR and the Irish Data Protection Act 2018. Your data is hosted in the EU/EEA.

1. Who we are and our roles

Philip George Ltd is the controller for your account and billing data, and a processor for the content you put into the service (your answers, tool register and generated policies), which you control. Contact: privacy@pgadvisory.io.

2. What we collect

• Account data — your email address and sign-in records.
• Organisation data — organisation name, sector and size.
• Service content — your questionnaire answers, tool register and generated documents.
• Billing data — handled by Stripe; we store a payment reference, not your card details.
• Free AI Risk Snapshot — if you ask us to email your result, we keep your email address and the answers you gave (sector, size, and yes/no answers about how AI is used). There is no free text, and you can see your result without giving us an address at all.
• Technical data — minimal logs needed to run and secure the service.
• Usage data — aggregated, cookieless page analytics (which pages are viewed, roughly where from). No cookies, no cross-site tracking, and no profile of you as an individual.

3. Why we use it and our lawful basis

• To provide the service and your account — performance of a contract.
• To take payment and keep records — contract and legal obligation.
• To secure the service and prevent misuse — legitimate interests.
• To understand how the service is used and improve it — legitimate interests, using aggregated analytics that do not identify you.
• To send service-related notices — legitimate interests; marketing only with consent.
• To email you the Snapshot result you asked for, and to carry your answers into your account if you go on to create one so you are not asked the same questions twice — consent, which you give by entering your address, and which you can withdraw at any time.

4. Who we share it with

We do not sell your data. We use a small set of subprocessors under written data processing agreements — see our subprocessor list. All are used only to run the service.

5. International transfers

We host your data in the EU/EEA. Where a subprocessor involves a transfer outside the EEA, we rely on an adequacy decision or Standard Contractual Clauses. See the subprocessor list for details.

6. Retention

We keep account and service content for as long as your account is active, and delete it within a defined period after account closure unless we must retain records for legal or accounting reasons. We retain only what regeneration requires.

Snapshot results are kept for 12 months and then deleted. If you create an account, the answers become part of your account content and follow the rule above instead. Ask us at any time and we will delete a Snapshot sooner.

7. Your rights

You have the right to access, correct, delete, restrict, port and object to the processing of your data, and to withdraw consent where we rely on it. You can export or delete your account data from your Settings, or contact us at privacy@pgadvisory.io. We respond within one month.

8. Complaints

Please contact us first. You also have the right to complain to the Irish Data Protection Commission at www.dataprotection.ie.