This page covers this website. It is not a software licence or a description of processing inside the Risk Studio product — see Security & data handling for that. Last updated 19 July 2026.
This site is operated by Risk Studio Ltd, the company behind SOMA Risk Studio. Risk Studio Ltd is the controller for personal data collected directly through this site.
We don't run advertising pixels, session-replay tools, or third‑party trackers. If it isn't listed below, this site doesn't do it.
What: name, organisation, work email, what you're exploring, and your message — whatever you type into the contact form.
Purpose: replying to your enquiry.
Legal basis: our legitimate interest in responding to enquiries about our own product — you've contacted us expecting a reply, and we don't use the details for anything else.
Retention: for as long as the enquiry needs, and for up to 24 months afterwards (so we can pick a thread back up if you get back in touch) — then deleted.
Processor: when the form's backend is active, the message is sent via Resend (a transactional email delivery service) to our inbox. Resend processes and stores the message in the United States; that transfer is placed under the UK's international data transfer safeguards (an IDTA or the UK Addendum to the EU SCCs) before the backend is activated. Until then, the form falls back to opening your own email client, so the message goes directly to us with no processor in between.
What: this site does not embed or contact Cal.com automatically. The booking page offers an external link. Cal.com receives data only after you choose to open that separate service and submit information there.
Purpose: arranging a call.
Legal basis: our legitimate interest in scheduling a meeting you've asked for.
Separate service: Cal.com describes itself as a controller for its service and says it uses cookies and similar technologies and may transfer information to the United States. Review Cal.com's privacy policy before opening the scheduler.
Current state: website analytics is not enabled. The configured analytics identifiers are empty, so this site makes no analytics request.
Future changes: analytics will not be activated until the provider, event list, lawful basis, storage/access behaviour, retention and access controls are approved and this notice is updated.
What: standard web-server logs (IP address, requested page, timestamp, user agent) — generated automatically by Cloudflare Pages, our hosting provider, for every site on the internet that serves pages over HTTP.
Purpose: keeping the site running securely — abuse prevention, fault diagnosis.
Retention: governed by Cloudflare's own log-retention policy, not something we configure per visitor.
The current build does not set first-party cookies or auto-load third-party booking or analytics scripts. Following the Cal.com link takes you to a separate service with its own cookies and similar technologies. If this site's behaviour changes, we will update the implementation and this notice before activation.
We don't sell enquiry data or share it for third-party marketing. Resend may deliver contact-form messages when the backend is configured, processing them in the United States under the transfer safeguards described in section 02(a). Cal.com is reached only through an external link and handles information under its own notice after you choose to use it. Cloudflare hosts and protects the site.
Email [email protected] to exercise any of these. We'll respond within one calendar month.
If you're unhappy with how we've handled your data, you also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk. We'd rather you told us first so we can put it right.
This is a plain-English policy, kept honest about what the site actually does rather than what a template says it might. As the site adds or removes a processor (for example, switching the booking scheduler or analytics on), we update this page in step — not after the fact.
Email us directly — the person who replies is the person who runs the site.
