Privacy Policy

1. Introduction

Welcome to Sprint Ready LTD ("we", "our", or "us"). We are committed to protecting and respecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed.

2. Information We Collect

We may collect and process the following data about you:

• Identity Data: First name, last name, and job title.
• Contact Data: Email address (e.g., when you request a Proof of Concept).
• Technical Data: Internet protocol (IP) address, browser type and version, time zone setting, operating system, and information gathered via cookies.
• Document Data: Information contained within specification documents you voluntarily submit for the purpose of our 48-Hour Audit. Note: Any submitted documents are treated with strict commercial confidentiality and are permanently deleted after the audit process unless otherwise agreed.

3. How We Use Your Data

We use your personal data on the following lawful bases:

• Contractual Necessity: To provide you with the information, products, or services that you request from us (e.g., executing the 48-Hour PoC Audit).
• Legitimate Interests: To improve our website, troubleshoot technical issues, and manage our relationship with you.
• Consent: Where you have explicitly agreed to our use of cookies or marketing communications.
• Public records used as examples: Some pages show results produced from engineering records a third party has published (the Apache Kafka project's public design document and tickets). We replace people's names with labels; if any personal data remains, we process it on the basis of our legitimate interest in demonstrating our software on public material, keep it to the minimum and remove it on request (email stu@sprintready.dev). See section 16 of our terms.

4. Cookies

Our website uses cookies to distinguish you from other users. This helps us to provide you with a good experience when you browse our website and allows us to improve our site. You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies.

5. Data Security & Retention

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way. We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. When we delete personal data, copies in our encrypted backups are deleted within a further 70 days.

6. Your Legal Rights

Under the UK GDPR, you have the right to:

• Request access to your personal data.
• Request correction of the personal data that we hold about you.
• Request erasure of your personal data.
• Object to or restrict the processing of your personal data.

If you wish to exercise any of the rights set out above, please contact us at the details below. You can also complain to the Information Commissioner's Office (ico.org.uk), though we'd be grateful for the chance to put things right first.

7. If we've emailed you about SprintReady

We write to a small number of people at medical device and health software companies whose work SprintReady is relevant to: usually engineering, product or company leaders.

What we hold: your name, job title, work email address and company; public information about your company (for example a device clearance, a registration or a job advert); and the emails we exchange.

How we found you: through our own research on the internet, using company websites and public records such as the US FDA device database, the EU EUDAMED and UK MHRA registers, Companies House, and job adverts and news your company has published; and through paid business-contact databases, Apollo.io and Icypeas.com, which hold work contact details and check that work email addresses are valid. Sometimes we work out a work address from your company's usual email format and check it. We pay for individual look-ups; we don't buy mailing lists, and we never use personal email addresses, home addresses or personal phone numbers.

If you'd rather not be listed in those databases, you can ask each one to remove you, free of charge, through their own privacy pages.

Why, and our lawful basis: to introduce a relevant business service to professionals whose work it concerns. Our lawful basis is legitimate interests (UK GDPR Article 6(1)(f)). Under the Privacy and Electronic Communications Regulations, emails to people at companies (corporate subscribers) don't need prior consent, but every email says who we are, how we found you and lets you opt out. We use an AI model to help research companies and draft emails; it makes no decision with legal or similarly significant effects on anyone.

Who handles it for us: Hostinger (our email service) and Amazon Web Services in the EU (hosting and the AI model), acting only on our instructions. When we look someone up in Apollo.io or Icypeas, we share only the company's name or website and the person's name or job title. We don't sell your details.

How long we keep it: only while it's relevant to our outreach, and no longer than two years after our last contact unless your company becomes a customer. If you ask us to stop, we delete everything else about you within 30 days and keep only your email address on a do-not-contact list, so you're never contacted again. Deletion is automatic, and backup copies go within a further 70 days.

To stop: reply "unsubscribe" to any email, use the unsubscribe link in it, or email stu@sprintready.dev. We stop straight away, whatever the source.

8. The partner programme

If you're a partner: we hold the details you give us when you join at partners.sprintready.dev (name, email, company, country, website and who you work with), your password (only as a one-way hash), the bank details you give us for payments (encrypted), your VAT number if you give one, the companies credited to you, the commission they earn you and the payments we make to you. We use them to run your partner account and pay you, under our contract with you (UK GDPR Article 6(1)(b)), and keep payment records for six years after the end of the tax year they relate to because tax law requires it (Article 6(1)(c)). If you were in touch with us through our partner outreach, we link your partner account to that record and stop that outreach.

If a partner referred your company: we tell that partner your company's name, its plan, when it started paying and the payments their commission is worked out from. We never share your documents, your users or anything inside your account. You can see the partner's code on the sign-up form and remove it before you sign up.

If a partner introduced you to us: they may give us your name and work email so we can follow up, but only if you've agreed. We keep these details for at most 180 days, while the introduction is open, and then delete them.

9. Contact Information

Sprint Ready LTD is a company registered in England & Wales (Registration No. 17375471).

For any privacy-specific concerns, please email us at: stu@sprintready.dev.