GDPR Policy

1. Scope and controller details

This policy applies to personal data processed in connection with theChalkline Reports website where the UK GDPR, EU GDPR, or related EEA data-protection laws apply.

• Controller: Design Glyphe Limited operating Chalkline Reports
• Privacy contact: privacy@chalklinereports.xyz
• GDPR contact: gdpr@chalklinereports.xyz

2. Categories of personal data in scope

For GDPR-covered users, the categories of personal data in scope generally include:

• contact details and business identifiers you submit through the diagnostic;
• diagnostic answers and generated report content;
• message history related to your diagnostic request;
• technical request data and short-lived browser-session data used to deliver the site.

3. Lawful bases for processing

4. Legitimate interests statement

Where we rely on legitimate interests, those interests generally include operating the site safely, responding to a direct B2B inquiry, preventing abuse, preserving evidence for disputes, and maintaining a workable record of a diagnostic request.

We do not use legitimate interests as a blanket substitute for consent where consent is the better legal basis, such as an optional notes subscription.

5. International transfers

Chalkline Reports serves multiple regions, and personal data may be processed outside the UK, EEA, or EU. Where applicable law requires transfer safeguards, we intend to rely on appropriate mechanisms such as contractual safeguards, vendor commitments, or other lawful transfer tools that fit the current processing arrangement.

The hosted-report environment is currently designed for operational simplicity rather than region-specific data residency.

A hosted report link stays available for as long as the report record exists. It is not withdrawn on a timer. Anyone holding the link can open the report, so it should only be passed to people you intend to have access. You can ask us to close a link at any time, and it stops opening the report from that moment.

6. Your GDPR rights

If GDPR applies to you, you may have the right to:

• request access to your personal data;
• request rectification of inaccurate or incomplete data;
• request erasure, where applicable;
• request restriction of processing;
• object to processing based on legitimate interests;
• request portability of data you provided to us; and
• withdraw consent where consent is the basis for processing.

Requests should be sent to gdpr@chalklinereports.xyz or privacy@chalklinereports.xyz. We may ask for information reasonably necessary to verify your identity and the scope of your request.

7. Complaints

If you believe our handling of your personal data infringes applicable GDPR rules, you may complain to the supervisory authority in the place where you live, work, or where the alleged infringement occurred.

We would, however, appreciate the opportunity to address your concern directly first through gdpr@chalklinereports.xyz.

8. Retention under the current launch model

The retention approach described in the Privacy Policy also applies here. The key practical point is the one stated there: records are held in a hosted database and kept until they are no longer needed for the purpose they were collected for, or until removal is requested. They are not discarded on a timer, and you should not assume a record has gone simply because time has passed.

9. Contact

• GDPR contact: gdpr@chalklinereports.xyz
• Privacy contact: privacy@chalklinereports.xyz