Privacy policy

Second Act is a trading name of Windfall Intelligence Ltd, registered in England and Wales (company number [COMPANY NUMBER]), which is the data controller for everything described here. Contact: hello@getsecondact.com.

The short version: we collect what we need to write your assessment, we show it to nobody, we never use your photographs for marketing, and we delete them on a fixed schedule. The detail follows.

What we collect, and why

• Questionnaire answers (your situation, goals and preferences) - used to write your assessment and, if you give it mid-questionnaire before paying, your name and email so we can hold your progress and contact you about the assessment you started. Legal basis: taking steps to enter into a contract, and our legitimate interest in following up an assessment you began.
• Your photographs- used solely to prepare your written assessment. Legal basis: performance of the contract. They are never used in advertising, marketing or as “before/after” examples, and are never sold or shared with third parties beyond the storage providers below.
• Payment details - taken and held by Stripe; we never see your card number. We receive your email and the fact of payment.
• Basic analytics - we use the Meta pixel to measure whether our advertising works (page views, quiz starts, purchases). Legal basis: consent where required. We do not send Meta your photographs or questionnaire answers.

Who sees your information

Your photographs and answers are seen by the reviewer preparing your assessment, and no one else. We use a small number of processors to run the service: Stripe (payment), Tally (the photo upload form), Vercel (website hosting) and our email provider. Each holds data only to provide its service to us.

How long we keep things

• Photographs: deleted from our systems 60 days after your assessment is delivered, unless you join the 90-day programme (where they’re kept for re-measurement until the programme ends) or ask us to keep them for a future re-assessment. You can ask us to delete them sooner at any time and we will, within 7 days.
• Questionnaire answers and your report: kept for up to 24 months so we can stand behind the work, then deleted.
• Payment records: kept for 6 years as required by UK tax law.

Your rights

Under UK GDPR you can ask for a copy of what we hold about you, ask us to correct or delete it, object to or restrict processing, and take your data elsewhere. Email hello@getsecondact.com and we’ll act within one month. If you’re unhappy with how we’ve handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk.

Where data lives

Our providers may store data outside the UK (for example in the EU or US). Where they do, transfers are protected by UK-approved safeguards such as the UK International Data Transfer Agreement or adequacy regulations.

Changes

If we change this policy in a way that matters, we’ll email active clients before it takes effect.