Who we are
statementofwork.org is operated by Defining Work Limited, a company registered in England and Wales. The data controller for the purposes of UK and EU GDPR is Defining Work Limited.
What we collect
When you create an account
- First name and last name
- Work email address
- Acceptance of the Standard Use Agreement and this policy (recorded with your account)
- Products and topics you register interest in (for example certification tracks or subscription tiers)
- Marketing consent (if given), recorded with date and version
When you use the site
- Standard log information: IP address, browser type and version, operating system, pages visited, referrer, timestamps
- Cookies necessary to operate the site (see Cookies)
- Engagement metrics if you have opted into marketing communications: opens, clicks, unsubscribes
What we do not collect
- We do not collect special category data (health, religion, political opinions, biometric data, sexual orientation, etc.)
- We do not collect payment card data directly. Where applicable, payments are processed by our payment provider; we receive only confirmation that payment has been made.
- We do not collect data about anyone under 18.
Why we collect it
We process your personal data for the following purposes, on the legal bases stated:
- To deliver the SoW Standard (legal basis: performance of contract). Your account, download access, and notifications about the standard you have signed up for.
- To verify legitimate use (legitimate interest). Confirming that work email addresses correspond to real organisations and identifying misuse.
- To send product updates, new research, and webinar invites (consent). Only sent if you have explicitly opted in. You can withdraw consent at any time.
- To improve the standard and the website (legitimate interest). Aggregate analytics, usage trends, and feedback.
- To enforce our Standard Use Agreement (legitimate interest). Detecting and responding to breaches.
- To meet legal obligations (legal obligation). Tax, accounting, and regulatory record-keeping where required.
Who we share it with
We do not sell your personal data and we do not share it with marketing partners or third-party advertisers. We share it only with:
- Service providers who help us operate the site (hosting, email delivery, analytics, payment processing, learning management) under appropriate data processing agreements that limit their use of your data to delivering services to us
- Professional advisers (lawyers, accountants, auditors) where necessary
- Authorities, regulators, or law enforcement where required by law or to protect our rights
- An acquirer or successor in the event of a merger, acquisition, or sale of substantially all our assets, subject to the protections of this policy continuing to apply
Our current processors are:
- Clerk, Inc. (United States): authentication and account management. Your name, work email, and registered interests are stored with Clerk.
- Vercel Inc. (United States): website hosting and aggregate, cookie-free analytics.
Payment and learning platform providers will be added to this list when subscriptions and certification enrolment open in October 2026.
Where it is stored
Your personal data is stored on servers located in the UK and the European Economic Area where possible. Where our processors are based outside the UK or EEA, we ensure appropriate safeguards are in place, typically the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, together with additional measures where required by law.
How long we keep it
- Account data: while your account is active, plus 24 months after closure
- Marketing data: until you withdraw consent or after 24 months of inactivity, whichever is sooner
- Server log data: 12 months
- Records required by law: for as long as the law requires (typically 6-7 years for tax and accounting records)
Your rights
Under UK and EU GDPR, you have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate or incomplete data
- Request deletion of your data ("right to be forgotten"), where applicable
- Object to processing based on legitimate interest
- Restrict processing in certain circumstances
- Receive a portable copy of the data you have provided
- Withdraw consent for marketing communications at any time
- Lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or with your local supervisory authority in the EU
To exercise any of these rights, contact privacy@statementofwork.org. We will respond within one month.
Cookies
We use the minimum cookies necessary to operate the site:
- Strictly necessary cookies: session and security cookies set by our authentication provider (Clerk) to keep you signed in. These do not require consent.
Our analytics (Vercel Web Analytics) are aggregate and do not use cookies, so there is no cookie banner. We do not use advertising cookies, tracking pixels for marketing partners, or social-media re-targeting cookies.
Children
The SoW Standard is a B2B product. We do not knowingly collect data from anyone under 18. If you believe we have done so by accident, contact us and we will delete the data.
Updates to this policy
We may update this policy from time to time. Material changes will be notified to active account holders by email and posted on this page with a new effective date. The current version is shown at the top of this page.
Contact
For privacy questions, to exercise your rights, or to report a data protection concern, contact privacy@statementofwork.org.