Auto RAMS

Privacy Policy

Last updated: 30 September 2026

1. Who we are

AutoRAMS is a trading name of Ambler Group Limited, company number 12568344, whose registered office is at 167–169 Great Portland Street, Fifth Floor, London, W1W 5PF, United Kingdom. We provide a web app that helps companies in the trades produce RAMS (Risk Assessments and Method Statements).

Our ICO registration number is ZC268153. You can contact us at office@autorams.com or on 0345 548 5451.

This policy explains how we handle personal data under the UK GDPR and the Data Protection Act 2018. There are two different roles, explained next.

2. Our two roles

  • Controller. For your account, billing and website contact data, we decide how and why the data is used. We are the controller, and this policy applies directly.
  • Processor. For your clients' and staff information that customers enter into RAMS, the customer is the controller and we are the processor, acting on the customer's instructions. This is covered by section 7 of our Terms of Service. If you are a client or worker named on a RAMS and want to use your rights, please contact the AutoRAMS customer that created it first. We will help them to respond.

3. What we collect and why

Account data (we are the controller)

  • Company details, and the names and email addresses of users, with their role (company admin or staff), login details (passwords are stored hashed) and the trades chosen.
  • We use this to create and run your account, provide the service and contact you about it.

Billing data (we are the controller)

  • Your plan, invoices, payment status and payment history. Payments are made by Bacs Direct Debit through Stripe. We never see your bank details; Stripe collects and holds them.
  • We use this to take payment, manage failed payments and keep financial records.

Website contact data (we are the controller)

  • Names, email addresses and messages you send us through the website, by email or by phone.
  • We use this to reply to you and provide support.

Customer content (we are the processor)

  • Client names and site addresses, staff names on RAMS, site photos, logos and the generated PDFs.
  • We use this only to provide the service to the customer.

Support access

Our office staff can see account and billing information by default. They can see a specific RAMS only if your company admin shares it with us for a support request.

4. Our lawful bases

  • Contract: where we need to use your data to provide the service you signed up for, such as running your account and taking payment.
  • Legitimate interests: for running and securing our business, keeping the service safe, preventing misuse, responding to enquiries and keeping our records. We balance these against your rights and interests.
  • Legal obligation: where the law requires us to keep or share data, for example keeping billing and accounting records.

5. Who we share data with

We do not sell personal data. We share it only with the providers that help us run the service (our sub-processors), and where the law requires:

  • Stripe, for payments and the customer portal.
  • Our email delivery provider (Resend or Postmark), to send account, billing and service emails.
  • Our cloud hosting provider, which hosts the service and its data ([hosting location]).

We may also share data with our professional advisers, or with authorities or courts if the law requires it. We have data protection terms in place with our providers.

6. International transfers

Stripe and our email provider may transfer or process personal data outside the UK. Where that happens, we make sure appropriate safeguards are in place, such as the UK's approved international data transfer agreement or addendum, or an adequacy decision that allows the transfer. Our hosting location is [hosting location].

7. How long we keep data

  • Account data: kept while the account is active.
  • After cancellation: your data is kept for 90 days and then deleted, unless the law requires us to keep it.
  • Billing records: kept for 6 years.
  • Backups: deleted data rolls off our backups within 35 days.

8. Security

We take reasonable steps to protect personal data. Data is encrypted in transit using HTTPS. Passwords are hashed. Each company's data is kept separate from other companies' data. We take daily backups. No system is completely secure, but if there is a personal data breach that affects you, we will follow the law on telling the people who need to know, including customers whose data we process, without undue delay.

9. Cookies

We use one essential session cookie. It keeps you logged in and is needed for the service to work, so it does not need your consent. We do not currently use advertising or analytics cookies. If that changes, we will update this policy and ask for consent where the law requires it.

If you arrive through a partner's link (an address ending in ?ref= and a code), your browser keeps that code on your device so the discount can be applied when you sign up; you can clear it by clearing this site's stored data. We also count the visit for the partner. This uses a short-lived, one-way value made from your connection details, which we cannot turn back into your identity or use to follow you to other sites, and we do not store your IP address for it. Partners are told only how many visits, sign-ups and payments their link produced, never who the customers are.

10. Your rights

Under the UK GDPR you have the right to:

  • be told how your data is used (this policy);
  • access a copy of your data;
  • have inaccurate data corrected;
  • have your data erased, in some cases;
  • restrict how your data is used, in some cases;
  • object to use of your data based on legitimate interests;
  • receive your data in a portable format, where the right applies; and
  • complain to the regulator (see below).

To use a right, email office@autorams.com. We normally respond within one month. We may need to check your identity first. These rights are not absolute and some have exceptions.

11. Complaints

We would like the chance to sort out any concern first, so please contact us. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

12. Changes to this policy

We may update this policy from time to time. We will post the new version on our website with a new date and, if the changes are important, tell account holders by email.

13. Contact

Ambler Group Limited, trading as AutoRAMS
Registered office: 167–169 Great Portland Street, Fifth Floor, London, W1W 5PF, United Kingdom
Email: office@autorams.com
Phone: 0345 548 5451

See also our Terms of Service. Questions? Email office@autorams.com or call 0345 548 5451.