Privacy
Who we are
Drillroom is run by ItsMonkie Limited.
ItsMonkie Limited is a company registered in England and Wales, company number 17091942.
ItsMonkie Limited is registered with the Information Commissioner's Office, reference ZC200755.
Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.
For questions about your data, email contact@getdrillroom.com.
We decide how your account, your payments and the free evidence check are handled. For the people your organisation adds and what it records in an exercise, your organisation decides what goes in and why, and we handle it on your organisation's behalf, only to provide Drillroom.
What we hold
- About you, the account holder: your email address and password record, and your organisation's profile.
- About the people you add: their names, roles and email addresses.
- About each exercise: attendance, the timeline, logged entries, findings, actions and the evidence pack.
- Payment details go to our payment provider, which keeps payment records as the law requires.
Why
To run your exercises, produce your evidence packs, and send the emails the service needs: sign-in, reminders and account notices. Each reminder to a person named on an action carries a link to stop them.
Who holds it
Your participants, logged entries and evidence packs are kept in your Drillroom account. We use a few service providers to run it, for hosting, sign-in, email, payments and AI, and they are listed below.
When you ask Drillroom to draft findings after a session, it sends your logged entries to our AI provider. When you ask for suggested wording for a scenario before a session, it sends your corrections and the parts of the scenario they change. The provider does not train on either and deletes them within 30 days, except where it must keep them for misuse checks or by law. Nothing is sent to it while a session is running.
| Service | What it holds | Where |
|---|---|---|
| Cloud hosting and database | Everything in your account | UK (London) |
| Website hosting | Nothing in your account; it serves the pages, so it sees your IP address and the pages you open, and it counts visits to our public pages without cookies. Our server code there runs in London | UK (London) and US |
| Sign-in | Your email address and password record | US |
| Copies of the emails we send, for up to 30 days, including reminders that name an action's owner and quote the action and its logged entry | US | |
| AI model | Logged entries when you ask for drafted findings, your corrections and the parts of the scenario they change when you ask for suggested wording, and our own wording for your organiser pack, with every name, date and place taken out, when you ask for it to be polished. All deleted within 30 days | US |
| Payments | Your payment details and payment records | Outside the UK, including the US |
How long
| When | What happens |
|---|---|
| You cancel the licence | Renewal stops, and you keep full access until the end of the period you paid for. |
| Twelve months after that period ends | Your packs stay downloadable until then. We email you a month and a week before, then delete the account and everything in it, and our backups of it within a further 15 weeks. |
| You close the account | You have seven days to change your mind. Then we delete everything within 30 days of your request, and our backups of it within a further 15 weeks. |
| You ask us to delete your data | Closing the account is how you ask, and it deletes everything we hold, as above, except a one-way code of any address that asked to stop reminders, so we never send it one again. |
If your organiser added you to an exercise
Your organisation uses Drillroom to run incident response exercises. We hold the personal and contact details your organiser gave us, to keep a record of the exercise and to remind you about any actions assigned to you. We keep them while your organisation has a Drillroom account, and in our backups for up to 15 weeks after that. To stop reminders, use the link in any email. To ask for your details to be removed, ask your organiser.
The free evidence check
What we keep. When you finish the check we keep your answers and the result they produce. If you give an email address we keep that too, along with the month and type of audit or renewal if you gave one, and whether you asked for the two emails before that date. We do not ask for your name or your organisation's name.
What the address is for. We use it to send you the PDF of your result. If you gave a date and ticked the box, we also use it to send two emails before that date. We do not use it for anything else.
Who else handles it. We send email through our email provider. Our email provider receives your address, the PDF and the text of the message so that it can deliver them. Our email provider's own records of delivering our messages are kept under its terms, and we cannot delete them for you.
Your result link. Anyone who has the link to your result can open it. The page shows the result. It does not show your email address or the date you gave.
How long we keep it. We delete your email address and the date twelve months after that date, or eighteen months after you finished the check if you did not give a date, and our backups of them within a further 15 weeks. We keep the answers and the result without them, so that your result link keeps working and so that we can count completions.
Stopping the emails. Every email has a one-click unsubscribe link. Using it stops our emails to that address. It is not permanent. If you do the check again later and give your address, we send you that check's PDF. If you also tick the box, we send the two emails before your new date as well.
Deleting what we hold. Every email also has a link to delete what we hold about your address. It removes your email address and the date you gave from every check you did with that address, straight away rather than when they would otherwise expire, and from our backups within 15 weeks. Your answers and the result stay, with nothing linking them to you, so a result link you shared still works. If you no longer have any of our emails, write to contact@getdrillroom.com and we will do it for you.
Your rights, the lawful basis, and how to complain
Why we are allowed to use each kind of data:
- The account holder's sign-in details and the account emails: our legitimate interest in providing the service your organisation signed up for.
- Payments and payment records: the contract with your organisation, and the legal duty to keep financial records.
- The people your organisation adds, what it records in its exercises, and the reminders sent to them: your organisation's basis, since it decides to use Drillroom and what goes in. We use it only to provide Drillroom to your organisation.
- The list of addresses that asked us to stop reminders: our legitimate interest in not emailing someone who asked us to stop. We keep a scrambled form of the address, not the address itself, and keep it after an account is deleted so the request still holds.
- The free evidence check: our legitimate interest in sending you the result you asked for, and your consent for the two emails before your date, which you give by ticking the box for them.
- Counting visits to our public pages: our legitimate interest in knowing which pages people read. Our website host counts them without cookies. It tells one visit from another by a code made from your browser's request, which it deletes after 24 hours, so it cannot follow you from one day to the next or across other sites. With each page view it records the page, the site you came from, your rough location, and your type of device and browser. Nothing inside your account is counted.
Some of our providers hold data in the US. Each one's own data processing terms name how it is protected there.
Our sign-in and payment providers rely on the UK Extension to the EU-US Data Privacy Framework, with the EU Standard Contractual Clauses and the UK International Data Transfer Addendum behind it.
Our email, AI and website hosting providers rely on the EU Standard Contractual Clauses with the UK International Data Transfer Addendum, and our email provider is also certified under the UK Extension.
You can ask us for a copy of these safeguards at contact@getdrillroom.com.
You can ask us for a copy of what we hold about you, to correct it, to delete it, or to restrict or object to how we use it.
Where we rely on your consent, you can withdraw it at any time: for the free evidence check's emails, the link in every one does that.
If an organisation added you, ask it first, because it decides what is held about you. Taking you off its list stops your reminders and keeps you out of its future exercises. Records of exercises already run keep your name, as part of its evidence, until its account is deleted. You can also write to us.
To use any of these rights, email contact@getdrillroom.com.
If you are unhappy with how we handle your data, tell us first at contact@getdrillroom.com.
You can also complain to the Information Commissioner's Office, the UK regulator, at ico.org.uk.