Privacy notice

Who this notice covers

This notice is published by the organisation operating this GovernPath workspace ("we"). It explains how we handle personal data of workspace users. Where you upload programme data containing personal data about others, you are the controller and we act as processor on your documented instructions.

What we collect

• Account data: name, work email, authentication identifiers, organisation membership and role.
• Workspace content: programmes, projects, RAID entries, gate decisions, narratives and approvals you create.
• Audit data: who approved or published a narrative, and when.
• Technical data: session cookies, IP address and error diagnostics required to run the service securely.

Lawful bases

• Contract — providing the workspace to you and your organisation.
• Legitimate interests — service security, abuse prevention and product reliability.
• Consent — optional analytics cookies only, withdrawable at any time.

AI processing

Assurance narratives are drafted by a large language model using only the programme evidence in your own tenant. Drafts are never published automatically: a named human must review and approve them. Do not paste special category personal data into narrative prompts.

Data location and retention

Workspace data is hosted in the United Kingdom (eu-west-2). We retain workspace content for as long as your organisation keeps its account, and delete or return it within 30 days of a verified deletion request, subject to legal retention obligations.

Sharing

We share data only with the infrastructure and AI subprocessors listed on our subprocessors page, each under a written processing agreement. We do not sell personal data or use your programme content to train third-party models.

Your rights

You may request access, rectification, erasure, restriction, portability, or object to processing, and withdraw consent at any time. Contact the workspace owner using the address configured in Settings. You may also complain to the Information Commissioner's Office (ico.org.uk).