At a glance
- NU WELLBEING LIMITED operates Risk Atlas. Contact us at info@risk-atlas.io.
- Your organisation controls its workspace information and decides who may access it.
- AI and external connections can involve other providers; review the arrangements before enabling them.
- You can ask about your data, exercise applicable rights or raise a privacy complaint.
The sections below explain the detail.
Who we are
NU WELLBEING LIMITED, trading as Risk Atlas
Company number 10447118 · Registered in England and Wales
Registered office: 483 Green Lanes, London, Surrey, England, N13 4BS
Email: info@risk-atlas.io
This statement covers the Risk Atlas website, account sign-in, enquiries and the platform. “We”, “us” and “our” mean NU WELLBEING LIMITED.
We are the data controller for information we use to run our business, manage accounts, answer enquiries and protect the service. This means we decide why and how that information is used.
For personal information a customer puts in its workspace, the customer will usually be the controller and we act as its processor, using the information on its instructions. If the customer itself acts for another organisation, our role may be that of a further processor. The applicable customer agreement must record those roles and processing instructions.
For questions about a record your employer or another customer has entered, contact that organisation first. You can also contact us and we will help route your request.
Information we handle
- Account and work contact details: your name, verified email, user identifier, organisation, membership status, permissions and, where entered, work phone number.
- Workspace content: entity structures and locations, risks, incidents, assessments, controls, policies, audit records, evidence files, actions, reviews, approvals and reports. These can identify employees, contractors, Board members or other people.
- Service records: sign-in events, changes to records, access decisions, alert recipients, delivery status, timestamps and technical error information.
- Enquiries and commercial records: information you send by email, quote requirements, correspondence and any agreed billing details. The website does not collect card details.
- Technical information: IP addresses and request information handled by hosting and security services, plus security identifiers used to limit repeated sign-in attempts.
Information comes from you, your organisation’s authorised users, connected systems and public sources used for external risk information. We do not require unrelated personal information to browse the public pages.
Only enter information you are authorised to share. Avoid unnecessary personal details in free text and evidence. Health information, criminal allegations, identity documents and other sensitive records need a specific lawful justification and suitable safeguards agreed with your organisation.
Why we use it
Where UK or EU data protection law applies, we need a lawful basis for each use. For information we control, the main purposes and bases are:
| Purpose | Lawful basis |
|---|---|
| Manage sign-in, accounts and business users | Our legitimate interests in providing a secure service to customers. Where you personally contract with us, performance of that contract. |
| Respond to enquiries and prepare quotes | Our legitimate interests in answering business enquiries; steps you ask us to take before a contract where you are the prospective contracting person. |
| Protect the service and investigate misuse | Our legitimate interests in preventing unauthorised access, fraud and harm, balanced against people’s rights. |
| Manage agreed charges and business records | Contract performance where applicable, legitimate interests in administering business relationships, and legal obligations for required accounting records. |
| Respond to rights requests and lawful demands | Legal obligations where applicable; legitimate interests in resolving disputes and establishing or defending legal claims. |
The customer determines the purposes and lawful basis for its workspace records, including employee information and alerts. Our processing of those records follows its documented instructions. A separate legal condition may be needed for sensitive or criminal-offence data.
We do not treat visiting the website, reading this statement or signing in as consent to unrelated marketing. If we ask for consent for a separate optional use, we will explain it and how to withdraw consent.
A verified email is necessary for email sign-in. Without it, we cannot provide that account access. Your organisation decides which other information is necessary for your role.
Access and service providers
Customer workspaces use access controls to separate their records. Within a workspace, the owner and authorised administrators set membership, roles, company access and Board access. A group or ownership relationship does not, by itself, give every employee access to every entity’s records.
Authorised people may view or export information within their permissions. Administrators must review access when people join, change roles or leave. Service operators and providers may need access to support, maintain, secure or lawfully administer the service; customer-facing permissions do not mean that infrastructure operators can never access data.
Providers used for the service include:
- OpenAI Sites and Cloudflare: website hosting, application delivery, database/file infrastructure and technical operations. Email sign-in is provided by Risk Atlas; it does not require a ChatGPT account.
- Cloudflare Email: verification emails and routing messages sent to our contact address.
- Microsoft email services: receiving and handling messages forwarded from our contact address.
- Optional connected providers: OpenAI API for AI analysis, Resend for risk-alert email and Twilio for SMS, when those services are configured and enabled. Customer-selected integrations have their own recipients and processing arrangements.
We may also share necessary information with professional advisers, competent authorities where legally required, or parties involved in a business transfer subject to appropriate safeguards. We do not sell personal information or share it for cross-context behavioural advertising.
Customer processing arrangements must identify authorised service providers and address confidentiality, security, assistance with rights and deletion or return of data. Contact us for the provider details relevant to your deployment.
AI, alerts and human decisions
AI analysis is optional. When it is connected, an authorised administrator must enable approved AI processing before using it. A request can send the user’s prompt, workspace metrics and selected risk, control, action, gap and public-signal fields to the configured OpenAI API. Those fields may contain names, descriptions and evidence text.
Minimise personal information before using AI. Provider retention and permitted use depend on the applicable provider terms and account settings; enabling AI is not a promise that the provider retains nothing. Confirm those arrangements before sharing restricted data.
AI analysis is saved for review. It does not itself approve risks or issue an audit opinion. Scores, reports and automated checks support people’s decisions. The platform is not intended to make solely automated decisions about individuals that have legal or similarly significant effects.
Email and SMS alerts, when enabled, use work contact details and include limited risk status or reference information. Delivery records and linked actions help explain who was notified, when and why. Email and SMS providers process delivery information, and delivery cannot be guaranteed. Your administrator controls recipients and should keep contact details current.
International processing
Risk Atlas is designed for organisations in different countries. Cloud and communications services may process information outside your country, including in the United States. This website does not promise that all information stays in the UK, the EEA or a single country.
Where data protection law restricts an international transfer, a lawful transfer mechanism is required. Depending on the transfer, this may be an applicable adequacy decision or approved contractual safeguards, such as EU Standard Contractual Clauses or the UK International Data Transfer Agreement or Addendum, with the required assessment and additional protections.
Customer agreements must confirm the relevant processing locations, providers and transfer arrangements before a deployment requiring specific residency or transfer restrictions is used. Contact info@risk-atlas.io for the arrangements applying to your data and how to obtain a copy of applicable safeguards, with confidential details protected where necessary.
Putting an entity’s country and city in the platform does not select where its data is stored.
How long information is kept
Retention depends on why the information is needed, the customer’s instructions and applicable legal obligations. We use these criteria:
- Verification and sessions: codes expire after 10 minutes. Sessions expire after eight hours, or after 30 minutes without qualifying activity. Expired authentication records are cleaned up in batches during later sign-in requests; expiry does not mean immediate removal of every server record.
- Account and membership details: while needed to provide access, manage the customer relationship and resolve outstanding security or contractual matters.
- Workspace records, evidence and audit history: for the customer’s agreed operational, regulatory and legal requirements. Signing out, suspending a user or removing their access does not erase the records or decisions they contributed.
- Enquiries, support and commercial records: for handling the matter and any necessary follow-up, accounting requirements or legal claims.
Workspace deletion and retention housekeeping require authorised administration; there is no universal automatic deletion period for all records. At the end of service, return or deletion must be arranged under the customer’s processing agreement. Any legally required retention, security records and provider backup cycles must be taken into account and explained when relevant.
Ask us or your organisation’s administrator about the period applying to a particular record or a deletion request. We will explain any lawful reason that prevents immediate deletion.
Security and international standards
The application uses HTTPS, email verification, server-side workspace and permission checks, restricted evidence downloads and recorded changes. Your organisation must also secure its email accounts and devices, assign appropriate permissions and handle downloaded copies safely.
This statement takes account of transparency, data minimisation, security, accountability and human oversight principles reflected in the UK GDPR, the UK Data Protection Act 2018 as amended, including applicable Data (Use and Access) Act 2025 changes, the EU GDPR where it applies, and relevant local data protection laws.
International reference points include ISO/IEC 27001 for information security management, ISO/IEC 27002 for security controls, ISO/IEC 27701 for privacy management and ISO/IEC 42001 for AI management.
These references are not a claim that Risk Atlas or NU WELLBEING LIMITED holds ISO certification, or that using the platform guarantees compliance. No online service can guarantee absolute security. Report suspected unauthorised access or a privacy incident to info@risk-atlas.io. Where required, we will notify affected customers, people or authorities within the applicable legal timescales.
Your choices and rights
Depending on the law and the circumstances, you may ask to access your information, correct it, delete it, restrict its use, receive a portable copy or object to processing. You may withdraw consent where processing relies on it, without affecting earlier lawful use. You may also have rights relating to automated decisions and additional rights under local law.
For information we control, email info@risk-atlas.io. Tell us the account or organisation involved and what you need. Do not send passwords or verification codes. We may need proportionate information to verify your identity and protect other people’s data.
We will respond within the applicable legal deadline, normally one month for UK/EU GDPR rights requests, and explain any permitted extension, exemption or refusal. Requests are normally free. For customer-controlled records, we will support the responsible customer in responding.
The service is for business and professional use and is not directed at children. Please contact us if you believe a child has supplied personal information without appropriate authority.
Questions and complaints
You can make a privacy complaint by emailing info@risk-atlas.io or writing to our registered office above. Explain what happened and the outcome you are seeking. We will acknowledge a data protection complaint within 30 days, investigate without undue delay, keep you informed and explain the outcome.
You can also complain to the UK Information Commissioner’s Office or the relevant regulator where you live or work. For the EEA, see the national data protection authorities; for the Isle of Man, see the Information Commissioner. Contacting us does not remove your right to approach a regulator.
Changes to this statement
We will update this page when the service or its processing arrangements materially change. The date and version at the top identify the current statement. Where a change requires additional notice or consent, we will provide it rather than relying only on a website update.
Further guidance: ICO transparency guidance · International transfers · Terms of Use