RiskRoster privacy notice
Version 19 October 2026 · Cross Compliance Training Limited
Who is responsible?
Cross Compliance Training Limited operates RiskRoster and is controller of account, billing-contact, support and service-administration data. Your employer or the organisation operating your workspace is controller of workforce records; we process those records on its instructions under the data processing agreement. This notice is specific to RiskRoster.
Information and purposes
We receive account email and identity details, company and team details, subscription status, payment references, support correspondence and technical service information. We use these to create access, deliver and secure the service, collect payment, answer questions and meet legal obligations. Our bases are contractual necessity for individual subscribers, legitimate interests in administering organisational accounts, preventing misuse and handling support, and legal obligations for required financial records. We do not use employee training records for our own advertising.
Who receives data?
Supabase provides authentication, database and file services; Cloudflare hosts the application; Stripe handles payment details and billing. Stripe processes payment-card information directly; RiskRoster uses payment references and subscription status rather than storing complete card numbers. Necessary service providers, professional advisers and authorities may receive relevant information for their functions or where required by law.
Locations and retention
Providers may process information outside the UK. The configured storage region, full provider processing locations and applicable transfer safeguards still require confirmation; we do not claim UK-only or EU-only storage. Contact us for the operational processing schedule.
Account and support information is kept while needed to provide the service, resolve issues and meet applicable legal requirements. Required financial records may remain after account closure. Workforce retention is instructed by the customer under the data processing agreement. Exact provider backup-retention periods have not yet been confirmed for publication; contact us about deletion and remaining copies.
Browser storage
RiskRoster uses browser local storage to retain the signed-in session and support account access. Protect shared devices and sign out after use. This notice does not authorise optional analytics or advertising tracking; any such tracking requires separate information and consent where required.
Your rights and complaints
Depending on the circumstances, you may request access, correction, deletion, restriction or portability, object to processing based on legitimate interests, and withdraw any consent you have given. Contact info@crossct.co.uk. For workforce records, contact your employer or workspace controller first; we assist it with requests. You may complain to the Information Commissioner’s Office. Providing information required for account access or billing is necessary to supply the relevant service. We do not make solely automated decisions with legal or similarly significant effects about individuals through this administration service.
Updates
We will update this notice when processing changes and communicate material changes through appropriate account or service channels.
Registered in England and Wales, number 12076785. Registered office: 82 Pascal Close, Corby, Northamptonshire, NN17 4AG.