Privacy notice
Last updated: 9 September 2026
This privacy notice tells you what to expect us to do with your personal information. Good Standing is software provided by Good Standing Software Ltd.
Contents
- Contact details
- What information we collect, use and why
- Lawful bases and data protection rights
- Where we get personal information from
- How long we keep information
- Who we share information with
- Sharing information outside the UK
- How to complain
Contact details
Good Standing Software Ltd
Registered in England and Wales. Company no. 17423889
Post: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom
Email: info@goodstanding.co.uk
We are registered with the Information Commissioner's Office. ICO registration number: ZC233855
What information we collect, use and why
We collect or use the following information to provide our software:
- Names and contact details
- Addresses
- Date of birth
- Purchase or account history
- Account information
- Membership standing and fee status
We collect or use the following information for the operation of customer accounts:
- Names and contact details
- Addresses
- Purchase or account history
- Account information, including registration details
- Information used for security purposes
We collect or use the following information for dealing with queries, complaints or claims:
- Names and contact details
- Addresses
- Account information
- Purchase or service history
- Customer accounts and records
- Correspondence
We collect or use the following information to run a product-research survey and related research emails about how UK professional membership bodies manage members, fees and standing:
- Names and contact details
- Organisation and role
We collect or use the following information for website analytics on this site:
- Page views
- Referrer (the site that linked here, if any)
- Browser, operating system, device type and country
This site uses Umami for privacy-friendly website analytics (page views). For this site, Umami Cloud runs on Umami's EU hosting. No analytics data for this site is held on US servers. The tracking script does not use cookies. It does not identify you and does not track you across other websites.
Lawful bases and data protection rights
Under UK data protection law, we must have a "lawful basis" for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO's website.
Which lawful basis we rely on may affect your data protection rights, which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO's website:
- Your right of access: You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for.
- Your right to rectification: You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
- Your right to erasure: You have the right to ask us to delete your personal information.
- Your right to restriction of processing: You have the right to ask us to limit how we can use your personal information.
- Your right to object to processing: You have the right to object to the processing of your personal information.
- Your right to data portability: You have the right to ask that we transfer the personal information you gave us to another organisation, or to you.
- Your right to withdraw consent: When we use consent as our lawful basis you have the right to withdraw your consent at any time.
If you make a request, we must respond to you without undue delay and in any event within one month.
To make a data protection rights request, please contact us using the contact details at the top of this privacy notice, or email privacy@goodstanding.co.uk.
Our lawful bases
Our lawful basis for collecting or using personal information to provide our software is:
- Contract: we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
Our lawful basis for collecting or using personal information for the operation of customer accounts is:
- Contract: we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:
- Contract: we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
- Legitimate interests: we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are: we use contact details, account records and correspondence so we can answer enquiries and handle complaints or claims about our software. The person benefits by getting a response and a resolution. The risk is low because we only use the details they gave us for that conversation and related records, and we do not use them for unrelated purposes.
Our lawful basis for collecting or using personal information to run a product-research survey and related research emails about how UK professional membership bodies manage members, fees and standing is:
- Legitimate interests: we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are: we use names, contact details, organisation and role to send a short product-research survey and related research emails about how UK professional membership bodies manage members, fees and standing. This helps us understand that work and lets the person take part or reply 'stop'. The risk is low: we send a small number of research emails, include a clear stop instruction, and do not add people to a marketing list.
Our lawful basis for collecting or using personal information for website analytics on this site is:
- Legitimate interests: we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are: we use Umami Cloud to count page views and understand how this website is used. The risk is low because the tracking script does not use cookies, does not identify you, and does not track you across other websites.
For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.
Where we get personal information from
- Directly from you
- Your web browser, when you visit this website
- Publicly available sources
- Third parties: customer membership bodies, for their member records
When a membership body uses our software, they are the controller of their members' information. We process it on their instructions.
How long we keep information
We keep personal information only as long as we need it for the purpose we collected it.
- Survey and research emails: until the research is finished, then 12 months
- Enquiries and complaints: 2 years after the last reply
- Customer accounts: while the account is live, then 6 years (the usual UK limitation period for contracts)
- Payment status we hold with the account: the same 6 years. Stripe holds payment details, not us
- Member records we process for a membership body: only as long as that body instructs
- Website analytics: while we use Umami Cloud to count visits to this site
Who we share information with
Data processors
These organisations handle personal information for us:
- Google Workspace provides our email and files
- Tally hosts the research survey
- Auth0 provides sign-in and customer accounts
- Stripe collects payments
- Umami Cloud provides website analytics (EU hosting for this site)
Others we share personal information with
- Relevant regulatory authorities
- Organisations we're legally obliged to share personal information with
Sharing information outside the UK
Where necessary, our data processors may share personal information outside the UK. When doing so, they comply with the UK GDPR, making sure appropriate safeguards are in place.
Auth0, Inc.
- Category of recipient: identity and access management
- Country the personal information is sent to: United States
- How the transfer complies with UK data protection law: addendum to the EU Standard Contractual Clauses (SCCs)
Stripe, Inc.
- Category of recipient: payment processing
- Country the personal information is sent to: United States
- How the transfer complies with UK data protection law: the country has been assessed as providing adequate protection (UK adequacy regulations / UK–US data bridge)
Google LLC
- Category of recipient: cloud email and file storage
- Country the personal information is sent to: United States
- How the transfer complies with UK data protection law: the country has been assessed as providing adequate protection (UK adequacy regulations / UK–US data bridge)
Umami Software, Inc.
- Category of recipient: website analytics
- Country the personal information is sent to: European Union (this site uses Umami Cloud's EU hosting; no analytics data for this site is held on US servers)
- How the transfer complies with UK data protection law: the country has been assessed as providing adequate protection (UK adequacy regulations)
Tally BV
- Category of recipient: research survey hosting
- Country the personal information is sent to: European Union / Belgium (form response data stored in Europe)
- How the transfer complies with UK data protection law: the country has been assessed as providing adequate protection (UK adequacy regulations)
How to complain
If you have any concerns about our use of your personal information, you can make a data protection complaint to us:
Email: privacy@goodstanding.co.uk
Post: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom
If you remain unhappy with how we've used your data after raising a complaint with us, you can also complain to the ICO.
The ICO's address:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113