Data Protection & GDPR

Last updated: 2026 · Complements our Privacy Policy.

We don’t claim to be “GDPR compliant” as a guarantee. Instead, we design SubReady with privacy and data protection in mind, take a data-minimisation approach, and keep improving.

Our principles

• Data minimisation — we aim to collect only what we need for record keeping and to respond to you.
• You stay in control — you choose which bank statements you upload and who can access your records at all times.
• Statement upload, not a bank connection — SubReady reads the bank statements you upload (PDF). It never connects to your bank, and does not move money or initiate payments.
• Permission-based sharing — records are shared with your accountant or partners only with your permission, and you can revoke access.
• No selling of data — we do not sell your personal data.
• Privacy-first forms — enquiry consent is separate from marketing consent, and marketing is always opt-in.

Roles

For personal data processed through our website and product, Aigenticura Ltd acts as the data controller and is registered with the ICO under registration number ZC180096. Service providers who process data on our behalf (for example, secure hosting and email) act as processors under appropriate agreements.

Lawful bases

Depending on the activity, we rely on your consent (for example, marketing), the performance of a contract (for example, providing the product), or our legitimate interests (for example, securing and improving the service). Where we rely on consent, you can withdraw it anytime.

International transfers

If any data is processed outside the UK by our providers, we take steps to ensure an appropriate level of protection, using recognised safeguards where required.

Your rights

You have the right to access, correct, delete, restrict or object to processing of your personal data, and to data portability. To exercise any right, email privacy@subready.co.uk. You also have the right to complain to the ICO.