Scope
This statement applies to personal data processed through the Ready2Submit marketing website and, when generally available, the Ready2Submit product. Product-specific terms are issued separately as part of customer onboarding.
Controller and processor roles
Ready2Submit acts as a data controller for personal data of website visitors and account holders — for example, contact details submitted through forms or used to create an account.
Ready2Submit acts as a data processor for personal data contained within customer tenant content (RFPs, supporting documents, knowledge base material, and generated responses). The customer is the controller of that content and instructs Ready2Submit on its processing.
Lawful bases for processing
Processing is carried out under one or more of the following lawful bases: performance of a contract, legitimate interests, consent (for cookies and non-essential processing), and compliance with legal obligations.
Data subject rights
Data subjects may request access to, rectification of, erasure of, restriction of, or portability of their personal data, and may object to processing. Requests can be sent through the contact form. Ready2Submit will respond within the timeframes set by GDPR.
Data subjects also have the right to lodge a complaint with their national supervisory authority.
Data Processing Agreement
A Data Processing Agreement (DPA) covering tenant content is available on request to prospective and active customers. Requests can be submitted through the contact form.
Sub-processors
Ready2Submit relies on a limited set of sub-processors for hosting, content delivery, email, and similar infrastructure functions. A current sub-processor list will be published and maintained as part of the product release. Customers will be notified of material changes in line with the DPA.
Customers who connect their own large-language-model provider (BYOK) remain in a direct relationship with that provider. Content submitted to the customer’s chosen LLM is governed by the customer’s contract with that provider; Ready2Submit facilitates the connection but is not party to that processing.
International transfers
Where personal data is transferred outside the European Economic Area, Ready2Submit relies on transfer mechanisms recognised under GDPR, including the European Commission’s Standard Contractual Clauses and, where applicable, adequacy decisions. Supplementary measures are applied where required.
Retention
Personal data is retained for as long as needed for the purposes described in the Privacy Policy and to meet legal obligations. Retention windows for specific data categories will be documented as the product moves toward general availability.
Security
Ready2Submit applies tenant isolation, encryption in transit and at rest, and audit logging to personal data under its control. Technical and organisational measures will be detailed in the DPA.
Contact
Privacy and GDPR-related requests can be sent through the contact form. Requests will be routed to the team responsible for data protection.
Last updated: 2026-05-17. This document is provided for reference; binding terms are contained in the applicable Data Processing Agreement.