Privacy notice
Effective 16 October 2026.
This notice explains how Helix Platforms Ltd (“we”) uses personal data when you use RAMSPack. We are the controller for that data under the UK GDPR and the Data Protection Act 2018.
Who we are
Helix Platforms Ltd, registered in England and Wales, company no. 17032196. Registered office: Unit 2 Lions Barn, Langham Lane, Colchester, CO4 5HY. We trade as RAMSPack.
Contact us about this notice or your data at support@ramspack.com. We have not appointed a data protection officer. We are established in the United Kingdom, so we do not appoint a UK representative.
The data we collect, and why
| Data | Why we use it | Lawful basis |
|---|---|---|
| Account: your name, email address, and a password hash. | To create the account, sign you in, and contact you about the service. | Contract. |
| Company profile: business name, address, phone, email, and a logo if you upload one. | To show your business on the RAMS you export. | Contract. |
| Operatives: names, roles, qualifications, card numbers, and expiry dates. | To include the people you name on a RAMS. This is personal data about those people. Include them only if you have a proper reason to do so. | Contract, because you ask us to put them in the document you ordered. |
| Site and document details: site address, client, contacts, the hazards you select, and the text you edit. | To draft, store, and export the RAMS. | Contract. |
| Payment data, via Stripe. We do not store your full card number. We keep a Stripe customer id, the plan, the status, the amount, and the currency. | To take payment, run a subscription, and keep accounting records. | Contract, and legal obligation for the records we must keep. |
| Analytics, via Google Analytics 4, and only if you accept analytics cookies. | To see how the site is used, including that a RAMS was started, exported, or taken to checkout, and that a purchase completed, with the amount and currency. | Consent. Advertising storage stays off. |
| Emails: messages you send us, service emails we send you, and product emails where the rules below allow them. | To run the account, confirm a deletion, and (where allowed) tell you about RAMSPack and similar products. | Contract for service emails. Legitimate interests for product emails to paying customers, with the soft opt-in below. Consent for marketing to people who have not paid. |
| Template downloads: the email you type, the template, whether you ticked marketing consent, and the time of that choice. | To send the file you asked for. We email tips only if you tick the box. The download does not depend on that box. | Legitimate interests for the download you requested. Consent for marketing. |
| Checkout acknowledgement: that you asked for immediate access, whether you opted out of product emails, the purchase, and the time. | To show that a consumer agreed to receive the digital content straight away, and to honour an opt-out. | Legal obligation, and legitimate interests in keeping evidence of that agreement. |
Product emails
If you pay for a subscription or a document, we may email you about RAMSPack and similar products. That is the soft opt-in in the Privacy and Electronic Communications Regulations 2003. The checkout page has an unticked box you can use to opt out before you pay. Every email we send includes a way to opt out. You can also use the unsubscribe page or email support@ramspack.com.
If you have not paid — for example you only downloaded a free template — we email you about products only if you tick the consent box. That box is unticked to start with. You can withdraw consent at any time, and we will stop those emails.
The choice you make at a later checkout replaces the product-email preference we hold for that email address. A service email, such as a deletion confirmation, is not a product email, but it still contains the opt-out link.
Who processes data for us
- Railway hosts the application and the database in the EU (Amsterdam).
- Stripe takes card payments and stores the card details.
- Resend sends email when email is configured.
- OpenAI is the AI provider. When a draft is generated, the inputs you have entered — including site details and operative names you included — and the selected library text are sent to OpenAI to draft the wording. Do not put information into a RAMS if you are not allowed to share it for that purpose.
- Google Analytics receives usage events only after you accept analytics cookies.
We do not sell personal data.
International transfers
Railway processes data in the EEA (Amsterdam). Transfers from the UK to the EEA are covered by the UK adequacy regulations.
Stripe, Resend, OpenAI, and Google may process personal data outside the UK, including in the United States. Where a UK adequacy regulation applies, we rely on it. That includes the UK Extension to the EU-US Data Privacy Framework where the recipient is certified under it. Otherwise we use the International Data Transfer Agreement, or the UK Addendum to the European Commission’s standard contractual clauses, together with the provider’s transfer terms.
How long we keep it
- Account, company profile, operatives, and RAMS documents stay until you delete them, or until you delete the account.
- Delete my data, on the account page, removes the user, password, company profile, logo, operatives, client folders, memberships, and RAMS documents stored against that user. We keep an anonymous deletion record of the time only, with no name or email, so we can see that a deletion ran.
- The checkout acknowledgement (immediate access, the opt-out choice, the purchase, and the time) is kept for six years so we can show that the 14-day cancellation right ended when the document was generated. Deleting the account does not delete that acknowledgement. The email on it is the address we held at checkout.
- Accounting and payment records that the law requires us to keep are kept for six years. Stripe keeps card and billing records under its own rules.
- A product-email opt-out is kept so we do not email that address again. Template-download records are kept for three years after the download, or until you ask us to delete them if that is sooner. We keep a suppression record if you have opted out.
- The analytics choice is stored in a first-party cookie named ramspack_analytics for about six months. Google’s own retention follows the Google Analytics 4 property settings.
Your rights
You can ask for access, correction, erasure, restriction, or a copy of the data you provided, and you can object to processing based on legitimate interests, including product emails. Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect processing that has already happened.
Signed-in users can erase their account data with Delete my data. For any other request, email support@ramspack.com. We will respond within one month. We may ask you to confirm that the address is yours. Some records are kept where the law requires it, or where we need them to show the cancellation acknowledgement or to honour an opt-out, as set out above.
You can complain to the Information Commissioner’s Office at ico.org.uk, or on 0303 123 1113. We would like the chance to put things right first.
Cookies
- A session cookie keeps you signed in. It is strictly necessary for the account.
- A cookie named ramspack_currency remembers the currency you chose. It is strictly necessary to show the price you selected.
- A cookie named ramspack_analytics remembers whether you accepted or rejected analytics, for about six months. Analytics cookies, including Google Analytics cookies, are set only if you accept. Advertising cookies are not used.
Reject is as available as accept. Cookie settings in the footer lets you change the choice.
Children
RAMSPack is not aimed at children. Do not create an account if you are under 18.
Changes
We will post any change to this notice on this page and update the effective date. This version is effective 16 October 2026.