Privacy notice

Last updated: 14 August 2026

Who we are

Cawood Innovation Ltd ("Cawood", "we", "us") provides the digital maturity and digital skills assessments, reports and learning pathways at cawood.io. We are the data controller for the personal information described in this notice, except where we act as a processor for an organisation (see Organisations below).

Registered office: The Old Tearooms, Walton on Trent, DE12 8NL.
Contact: [email protected].

The short version

We collect what we need to run your account, score your assessments and build your pathway. We do not sell your personal information, and we do not add you to a marketing list when you register. Your assessment answers are yours; if you join an organisation through an invitation, that organisation may be able to see your results alongside your name, and we tell you so in the invitation before you accept. You can delete your account and your data from inside the product at any time.

What we collect

Information you give us

Your name and email address when you create an account.
Your job title, if you choose to provide one.
Your answers to any assessment you take, and the scores calculated from them.
Your pathway activity: the check-ins you receive, the answers you give to knowledge checks, your confidence ratings, and whether you marked a step as done, not yet, or not relevant.
Anything you type into a contact form or send us by email.

Information we generate or collect automatically

Account and session records, including a session cookie so you stay signed in.
A security and audit log of significant account events (registration, sign in, failed sign in, sign out, account deletion), which records your IP address, your browser's user agent string and the time.
Your assessment report files (a PDF and a results file), stored so you can download them again later.
Website analytics, described under Cookies and analytics.

Information we deliberately do not hold

Card details. Payments are taken by Stripe on their own pages. We never see or store your card number.
Your password. It is stored only as a cryptographic hash, which cannot be reversed to reveal the password.
In parts of our database we store a one way hash of your email address rather than the address itself, so that records can be matched without holding the address twice.

Why we use it, and our lawful basis

What we do	Lawful basis
Create and run your account, score your assessments, generate your report, deliver your pathway, take payment and provide support	Performance of our contract with you
Keep the service secure, investigate abuse, keep an audit log, limit request rates	Our legitimate interests in protecting the service and its users
Understand how the site is used so we can improve it	Our legitimate interests in improving the service. See Cookies and analytics for how to object
Show an organisation the results of the people who belong to it	The organisation's legitimate interests in developing its workforce, with us acting as its processor. See Organisations
Produce anonymous, aggregated statistics about digital maturity, and publish them as benchmarks and research (see Benchmarks and research)	Our legitimate interests in understanding and describing digital maturity across sectors. You may object at any time
Keep records we are required to keep, such as records relating to payments and tax	Compliance with a legal obligation
Send you a marketing email, if we ever do	Your consent, which you may withdraw at any time. We do not add you to a marketing list when you register

Who we share it with

We use the following service providers. Each processes personal information on our instructions, under a contract, and only for the purpose given.

Provider	What they do for us	What they receive
Cloudflare	Hosts our application, database and file storage, and protects the site	All account, assessment and pathway data; network information such as your IP address
Kinsta	Hosts the cawood.io website	Web server logs, including your IP address
HubSpot	Our customer relationship records and contact forms	Your name, email address, organisation and assessment scores
Stripe	Takes payment and manages subscriptions and invoices	Your email address and payment details, which you give directly to Stripe
Resend	Sends our service emails, such as verification, password reset, invitations and pathway check-ins	Your email address and the content of the message
Anthropic	Generates the written personalisation in your pathway and in organisation summaries	A pseudonymous summary of scores and activity. We do not send your name, your email address or any account identifier. See Written personalisation
Google	Optional sign in with Google, website fonts, and website analytics	For sign in, your Google account email and name. For fonts and analytics, your IP address and usage information

We may also disclose personal information if we are required to by law, or to establish or defend legal claims. If our business is sold or transferred, personal information may transfer with it, and we will tell you before that happens.

We do not sell personal information, and we do not share it with advertising networks.

Written personalisation

Some of the text in your pathway is written for you rather than picked from a fixed list. When that happens we send a summary of the relevant signals, such as your domain scores, how many steps you have completed and which skill you are working on, to Anthropic's Claude models. We do not send your name, your email address or any identifier that points back to your account, and the output is stored once and reused rather than regenerated each time you look at it. Your organisation can switch this off for everyone in it, in which case your pathway is assembled entirely from our own content with no external processing.

Benchmarks and research

We use the assessments people complete to build a picture of digital maturity in general, and we publish parts of that picture as benchmarks and research, so that organisations can see how their own results compare with others.

Everything we publish this way is anonymous and aggregated. It describes groups, never individuals. Specifically:

We never name a person, and we never publish anything that describes one person's results.
We never name an organisation, and we never publish figures for a single organisation.
We publish figures by sector, by organisation size, by department type and by assessment domain. We do not combine those in a way that would let a reader work out which organisation, department or person a figure came from.
We only publish a figure when enough separate organisations, and enough separate people, sit behind it. Where a group is too small, it is either merged into a wider group or left out.
Once information has been aggregated in this way it can no longer identify anyone, so it is no longer personal information and this notice no longer applies to it.

If you would prefer your results were not used even in this anonymous form, email [email protected] and we will exclude them. Because published statistics cannot be traced back to an individual, we cannot remove a contribution from something already published, but we can exclude you from everything produced afterwards.

Organisations

You can use Cawood entirely on your own. If you join an organisation, some things change, and this section explains them.

You join an organisation by accepting an invitation. The invitation email states plainly what the organisation will be able to see before you accept.
Whether your organisation sees your results alongside your name is a setting the organisation controls, not an individual choice. When it is switched off, administrators see counts and averages only. When it is switched on, administrators and your department manager can see your name with your scores and your pathway activity.
Only assessments you complete after you join can ever be shown with your name. Anything you did before you joined stays private to you, although it may contribute to anonymous totals for the organisation.
Results are only ever shown to an organisation in a group of four or more people, except for simple participation counts and for the named view described above.
If you leave the organisation, or an administrator removes you, your data is disconnected from it and stops appearing in its reporting.

Where we show your information to your employer in this way, your employer is the data controller and we act as its processor. If you want to change what your employer can see, please speak to your administrator. You can also leave the organisation, or delete your account entirely.

Cookies and analytics

We use a small number of cookies and similar technologies.

Essential. A session cookie keeps you signed in across cawood.io and our application. It lasts up to seven days and cannot be switched off without making the product unusable. We also store a small flag in your browser so the page can show the right navigation before it finishes loading.
Analytics. We use Google Analytics to understand how the site is used, and HubSpot's tracking to link enquiries to the pages that produced them.

You can block or delete cookies in your browser settings, and you can opt out of Google Analytics using Google's browser add-on. We are reviewing our approach to consent for analytics cookies and expect to add a cookie control shortly.

How long we keep it

Account information: for as long as your account is open.
Assessment answers, scores, reports and pathway activity: for as long as your account is open, so your history and progress remain available to you.
Security and audit records: 90 days, then deleted automatically.
Payment and invoice records: as long as tax and accounting law requires, currently six years after the end of the relevant financial year.
Anonymous, aggregated statistics: indefinitely. They contain nothing that identifies anyone, so there is nothing in them to delete, and benchmarks are only useful if they can be compared over time.
After you delete your account: your account, sessions, pathway, invitations and report files are deleted, and your contact record in HubSpot is archived. Your assessment answers are disconnected from you rather than deleted, so that they remain in anonymous totals with nothing linking them to you.

Where your information is held

Our application, database and files are hosted by Cloudflare, which processes data across a global network. HubSpot holds our records in the European Union. Stripe, Resend, Anthropic and Google may process personal information in the United States. Where information leaves the UK or European Economic Area, it is protected by the UK International Data Transfer Agreement or the European Commission's standard contractual clauses, together with the provider's own safeguards.

Your rights

You have the right to ask us to:

give you a copy of the personal information we hold about you;
correct anything that is wrong;
delete your personal information;
restrict or object to how we use it, including objecting to processing based on our legitimate interests;
provide your information in a portable format; and
withdraw your consent, where we relied on consent.

You can delete your account and your data yourself, at any time, from the Security section of your account. For anything else, email [email protected] and we will respond within one month.

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, or by calling 0303 123 1113.

Security

Traffic to and from cawood.io is encrypted. Passwords are stored as hashes and never in readable form. Access to production systems is limited to those who need it. Significant account events are logged. No service can promise perfect security, but if a breach affects your rights we will tell you and the Information Commissioner's Office as the law requires.

Children

Cawood is intended for people in work and is not aimed at children. We do not knowingly collect information from anyone under 16. If you believe a child has given us their information, please contact us and we will delete it.

Changes to this notice

If we change this notice we will update the date at the top. Where a change materially affects how we use your information, we will tell you by email or in the product before it takes effect.