GDPR Compliance

www.knowndesign.ai
Version 1.0 | Prepared: 26 May 2026 | Next Review: 26 May 2027
UK GDPR · Data Protection Act 2018 · Data (Use and Access) Act 2025 · PECR 2003

Governing Law: This Framework and all matters arising from it are governed by the laws of England and Wales. Known Design AI Ltd is a company registered in England and Wales. The applicable data protection legislation is the UK GDPR (retained under the European Union (Withdrawal) Act 2018), the Data Protection Act 2018, the Data (Use and Access) Act 2025, and PECR 2003. EU GDPR (Regulation 2016/679) does not apply.

1. Purpose and Scope

This UK GDPR Compliance Framework is an internal governance and accountability document for Known Design AI Ltd. It documents our approach to UK data protection compliance; satisfies the accountability obligation under Article 5(2) UK GDPR; maintains the Records of Processing Activities (RoPA) required by Article 30 UK GDPR; records Data Processing Agreements with sub-processors under Article 28 UK GDPR; provides breach response procedures, DPIA guidance, and subject rights handling procedures; and serves as evidence of compliance in the event of an ICO investigation, audit, or enforcement action.

2. UK Data Protection Legal Framework

2.1 Applicable Legislation

Legislation	Status	Key Provisions	Enforced By
UK General Data Protection Regulation (UK GDPR)	In force. Retained EU law. Amended by DUAA 2025.	Seven principles (Art. 5); lawful bases (Art. 6); data subject rights (Arts. 15–22); processor requirements (Art. 28); breach notification (Arts. 33–34); DPIAs (Art. 35); accountability (Art. 5(2)).	ICO. Max fine: £17.5m or 4% of global annual turnover.
Data Protection Act 2018 (DPA 2018)	In force. Supplemented by DUAA 2025.	Supplements UK GDPR. Provides derogations, Schedule 2 exemptions, special category conditions, enforcement, and ICO powers.	ICO. Criminal offences under Part 3 for failure to register and other violations.
Data (Use and Access) Act 2025 (DUAA 2025)	Royal Assent: 19 June 2025. Part 5 in force: 5 February 2026.	Introduces Recognised Legitimate Interest (RLI) basis. Updates cookie consent rules (aggregate analytics exemption). Requires formal data protection complaints process. Restructures ICO. Increases PECR fines.	ICO with expanded investigatory and enforcement powers.
Privacy and Electronic Communications Regulations 2003 (PECR)	In force. Amended by DUAA 2025.	Cookie consent (Reg. 6). Electronic marketing. Data breach notification. DUAA 2025 increases max PECR fine to £17.5m / 4% turnover.	ICO. Current max fine: £500,000 pending commencement of DUAA 2025 increased penalty provisions.

NOTE: Known Design AI Ltd is a UK company subject to UK law only. EU GDPR (Regulation 2016/679) is not part of UK law and is not applicable. This Framework does not address EU GDPR compliance. All users of the Service contract on the basis of English law.

2.2 Key DUAA 2025 Changes — Operational Impact

DUAA 2025 Change	Commencement	Impact	Action Required
Part 5 data protection amendments	5 February 2026	Core amendments to UK GDPR and DPA 2018 now operative. Includes new RLI basis and updated automated decision-making rules.	Review processing activities against updated UK GDPR.
Recognised Legitimate Interest (RLI) — new lawful basis	5 February 2026	Pre-approved categories of processing not requiring a balancing test. Unlikely to apply to Known Design AI Ltd's commercial processing — standard Art. 6(1)(f) continues for most activities.	Monitor ICO guidance on qualifying RLI categories. No immediate action for existing processing.
Updated cookie / storage technology rules	5 February 2026; ICO guidance: 29 April 2026	Aggregate analytics cookies may not require consent where data is not linked to individuals. Conditions apply.	Verify CMP configuration. Ensure aggregate analytics are genuinely non-identifiable.
Formal data protection complaints process — mandatory	Deadline: 19 June 2026	Known Design AI Ltd must operate and publish a formal complaints process accessible to data subjects.	Draft, publish, and operationalise complaints procedure — see Section 9.3.
ICO restructured with expanded enforcement powers	Phased — 2025/26	ICO can require third-party specialist reports during investigations. Stronger enforcement expected on AI and children's data.	Ensure internal documentation (including this Framework) is current and complete.

3. Data Controller Details and Key Personnel

3.1 Data Controller

Field	Details
Organisation Name	Known Design AI Ltd
Registered in	England and Wales
Registered Office	71 – 75 Shelton Street, Covent Garden, London WC2H 9JQ
Company Registration Number	16965307
Nature of Processing	Controller — determines the purposes and means of processing personal data of users, subscribers, and website visitors
Website	www.knowndesign.ai
ICO Registration Number	ZC082723
ICO Annual Fee Band	Tier 1
ICO Registration Renewal Date	21 January 2027
Date This Document Was Prepared	27 May 2026
Scheduled Next Review Date	26 May 2027

3.2 Key Data Protection Personnel

Role	Name	Contact Email	Responsibilities
Data Controller / Accountable Owner	Roger Raad	privacy@knowndesign.ai	Ultimate accountability for UK GDPR compliance. Signs off on DPIAs, major processing decisions, and this Framework.
Data Protection Lead	Roger Raad	hello@knowndesign.ai	Day-to-day management of compliance, breach response, subject access requests, staff training, and maintenance of this Framework.
Data Protection Officer (DPO)	Roger Raad	roger@knowndesign.ai	Advises on compliance, monitors adherence to UK GDPR, acts as ICO contact point. Where appointed, must be registered on ICO's DPO register.
IT / Security Lead	Deep Sojitra	deep@knowndesign.ai	Implements and maintains technical security measures. Manages breach detection and sub-processor technical controls.

4. The Seven Data Protection Principles — Article 5 UK GDPR

Principle	Legal Requirement	Known Design AI Ltd Implementation	Evidence
1. Lawfulness, Fairness and Transparency Art. 5(1)(a)	Processed lawfully, fairly, and transparently	Lawful bases in RoPA (Section 5). Privacy Notice on website. Cookie consent via CMP. Users informed at point of collection.	Privacy Notice; Cookie Policy; RoPA Section 5; CMP consent records
2. Purpose Limitation Art. 5(1)(b)	Collected for specified, explicit, legitimate purposes; not further processed incompatibly	Processing purposes defined in RoPA. Co-pilot recordings not used for AI training. Data not sold or used for undisclosed purposes.	RoPA Section 5; Controller to Processor agreement - TenWeb Inc. (10Web DPA); UK IDTA or UK Addendum; Privacy Notice Section 4
3. Data Minimisation Art. 5(1)(c)	Adequate, relevant, and limited to what is necessary	Registration collects name and email only. Optional fields clearly marked. Co-pilot recordings limited to website changes only.	Account registration form; Controller to Processor agreement - TenWeb Inc. (10Web DPA); UK IDTA or UK Addendum; Privacy Notice Section 3
4. Accuracy Art. 5(1)(d)	Accurate and kept up to date	Users update account data via dashboard. Rectification requests handled per SAR procedure.	Account dashboard; SAR procedure Section 9
5. Storage Limitation Art. 5(1)(e)	Kept no longer than necessary	Retention schedule in Privacy Notice Section 7 and RoPA. Co-pilot recordings deleted after 1 month. Accounts deleted 60 days after closure.	Privacy Notice Section 7; RoPA; Controller to Processor agreement - TenWeb Inc. (10Web DPA); UK IDTA or UK Addendum
6. Integrity and Confidentiality Art. 5(1)(f)	Appropriate security against unauthorised processing and accidental loss	TLS encryption in transit. Encryption at rest on Google Cloud / AWS. MFA on admin accounts. Stripe PCI DSS. Breach procedure Section 11.	Security measures Section 12; Controller to Processor agreement - TenWeb Inc. (10Web DPA); UK IDTA or UK Addendum; breach procedure Section 11
7. Accountability Art. 5(2)	Controller must demonstrate compliance with all above principles	This UK GDPR Compliance Framework. ICO registration. Privacy Notice. DPA with 10Web. Staff training records. Annual review schedule.	This Framework; all policy documents; ICO registration; Controller to Processor agreement - TenWeb Inc. (10Web DPA); UK IDTA or UK Addendum

5. Records of Processing Activities (RoPA) — Article 30 UK GDPR

Article 30 UK GDPR requires Known Design AI Ltd to maintain a written record of all processing activities. This RoPA constitutes that record. It must be kept up to date and made available to the ICO on request.

Processing Activity	Data Subjects	Personal Data	Purpose	Lawful Basis	Special Cat?	Processors	Transfer Mechanism	Retention
Account Registration and Management	Registered users / subscribers	Name, email, hashed password, business name, website URL, account preferences	Creating and maintaining user accounts; enabling login and platform access	Art. 6(1)(b) — Contract	No	TenWeb, Inc. (10Web)	USA: UK IDTA or UK Addendum to EU SCCs	Account duration + 7 years post-closure
Subscription and Payment Processing	Paying subscribers	Subscription plan and history; Stripe transaction reference, last 4 card digits, billing country (we do not receive or store card numbers)	Processing subscription payments; managing billing lifecycle	Art. 6(1)(b) — Contract	No	Stripe, Inc.; TenWeb, Inc. — subscription management	UK Extension to EU-US DPF (primary), UK Addendum to EU SCCs (fallback); USA: UK IDTA or UK Addendum to EU SCCs	7 years from transaction (HMRC / Companies Act 2006)
AI Website Builder — Content Creation	Registered users	User-created website content: text, images, designs, AI prompts and inputs	Delivering the AI website building service; enabling creation, editing, and publishing of WordPress-based websites	Art. 6(1)(b) — Contract	No — unless user inputs personal data of third parties (user's sole responsibility)	TenWeb, Inc. (10Web); Microsoft Azure OpenAI (via 10Web)	USA: UK IDTA or UK Addendum to EU SCCs;	Account duration + 60 days post-closure
Website Hosting and Publishing	Users and their website visitors	Hosted website content; visitor IP addresses (server logs)	Hosting and publishing users' completed WordPress websites	Art. 6(1)(b) — Contract (users); Art. 6(1)(f) — Legitimate interests (visitor IP security logging)	No	TenWeb, Inc. (10Web) — Google Cloud / AWS; Cloudflare, Inc.	USA and EU regions: UK IDTA or UK Addendum; EU regions: UK adequacy regulations	Hosted content: account duration. Server logs: max 12 months
AI Co-Pilot Session Recordings	Registered users using co-pilot	Video recording of website changes during co-pilot sessions; Microsoft Clarity data including anonymised IP	Troubleshooting and service improvement only. NOT used for AI model training.	Art. 6(1)(f) — Legitimate interests. LIA required — see Section 6.	No	TenWeb, Inc. (10Web); Microsoft Corporation (Clarity)	USA: UK IDTA or UK Addendum	1 month — automatically deleted by Microsoft Clarity
Customer Support and Complaints	Users contacting support	Name, email, account details, content of support messages and complaints	Responding to support requests and formal complaints per DUAA 2025 complaints process	Art. 6(1)(b) — Contract; Art. 6(1)(f) — Legitimate interests	No	Xneelo (Pty) Ltd	RSA: Protection Of Personal Information Act (POPIA); GDPR EU/EEA	3 years from date of last contact
Website Analytics — Behavioural (consent-based)	Visitors accepting analytics cookies	IP address (anonymised in GA4), browser type, device, pages visited, session duration, referral source	Understanding how visitors use the website; improving the Service	Art. 6(1)(a) — Consent (via Cookie Preference Centre)	No	Google LLC (Google Analytics 4)	USA: UK Extension to EU-US DPF / UK IDTA	Up to 2 years (configurable in GA4)
Website Analytics — Aggregate (DUAA 2025 exemption)	All website visitors	Aggregate, non-identifiable statistics: total visits, page impressions, traffic sources. No individual identifiers.	Understanding overall website traffic volume and popular content	Art. 6(1)(f) — Legitimate interests / RLI under DUAA 2025. Opt-out must be available.	No	Google LLC (GA4 aggregate mode) or Google Analytics	UK Extension to EU-US DPF / UK IDTA	Aggregate data: retained in anonymised form — no personal data retention issue
Email Marketing	Opted-in users	Name, email, marketing preferences, email engagement data (opens, clicks)	Sending marketing emails, newsletters, and product updates	Art. 6(1)(a) — Consent. Opt-in required. Unsubscribe required in every email per PECR 2003.	No	Mailchimp	UK Extension to EU-US DPF / UK IDTA or UK Addendum	Until withdrawn + 3 years (suppression list maintained)
Transactional Email	All registered users	Name, email address	Sending account-related emails: welcome, billing, password reset, security alerts	Art. 6(1)(b) — Contract	No	Xneelo (Pty) Ltd	RSA: Protection Of Personal Information Act (POPIA); GDPR EU/EEA	Duration of account
Cookie Consent Management	All website visitors	Cookie consent choice, timestamp, policy version, session identifier	Recording cookie consent per PECR 2003 and UK GDPR Art. 7. ICO guidance requires 12-month retention.	Art. 6(1)(c) — Legal obligation (PECR 2003; ICO guidance)	No	CookieYes	UK Extension to EU-US DPF / UK IDTA or UK Addendum	Minimum 12 months
Domain Registration (via 10Web / GoDaddy)	Users purchasing domains	Name, email, domain registrant details (WHOIS — publicly accessible unless privacy protection enabled)	Registering and managing custom domain names on behalf of users	Art. 6(1)(b) — Contract	No	TenWeb, Inc. (10Web); GoDaddy.com LLC	USA: UK IDTA; UK Extension to EU-US DPF / UK IDTA or UK Addendum	Duration of domain registration + as required by registrar
Security Monitoring and Fraud Prevention	All users and website visitors	IP address, login attempt records, session data, Stripe fraud signals, Cloudflare security data	Protecting the platform against fraud, abuse, and security threats	Art. 6(1)(f) — Legitimate interests. LIA required.	No	TenWeb, Inc. (10Web); Stripe, Inc.; Cloudflare, Inc.	USA: UK IDTA or UK Addendum; UK Extension to EU-US DPF / UK IDTA or UK Addendum	Max 12 months
Business Records and Legal Compliance	Directors, employees, advisers, counterparties	Business contact names, email addresses, contractual documentation, financial records	Managing contracts; maintaining GDPR accountability records; complying with Companies Act 2006 and HMRC	Art. 6(1)(c) — Legal obligation; Art. 6(1)(f) — Legitimate interests	No	Internal only; professional advisers under confidentiality obligations as required	N/A within UK	Contract duration + 7 years (Companies Act / Limitation Act 1980)

6. Lawful Bases and Legitimate Interests Assessments

6.1 Lawful Bases in Use

Lawful Basis	Processing Activities	Key Conditions	Right to Object?
Art. 6(1)(a) — Consent	Marketing emails; behavioural analytics cookies; functional / preference cookies; marketing / targeting cookies	Must be freely given, specific, informed, and unambiguous. Documented. As easy to withdraw as to give. Cannot be bundled with T&Cs.	Yes — and we must stop immediately on withdrawal
Art. 6(1)(b) — Contract	Account registration; AI Builder delivery; hosting; payment processing; transactional emails; domain registration	Processing must be objectively necessary to perform the contract. Cannot be used for processing beyond what is required.	No right to object — but user may terminate the contract
Art. 6(1)(c) — Legal Obligation	HMRC financial records; ICO and authority requests; PECR cookie consent records	Specific legal obligation must be identifiable and documented. Must be a UK law obligation.	No right to object
Art. 6(1)(f) — Legitimate Interests	Security monitoring; fraud prevention; service improvement; co-pilot recordings; support retention; aggregate analytics (where not RLI); business records	Three-part Legitimate Interests Assessment (LIA) required: (1) Purpose test; (2) Necessity test; (3) Balancing test. Must be documented.	Yes — data subject may object. Must cease unless compelling legitimate grounds override their interests.
Recognised Legitimate Interest (RLI) — DUAA 2025	Aggregate analytics (where qualifying under DUAA 2025 / ICO April 2026 guidance)	Must fall within a category recognised under DUAA 2025. No balancing test required. Opt-out must be available. ICO guidance applies.	Yes — opt-out mechanism must be provided

7. Processors and Data Processing Agreements

Article 28 UK GDPR requires a written Data Processing Agreement (DPA) with every processor before processing begins.

7.1 Processor Register

Processor	Country	Personal Data Processed	Purpose	DPA in Place?	UK Transfer Mechanism
TenWeb, Inc. (10Web) — Primary Sub-Processor	USA (servers: USA + EU regions)	Account data, website content, co-pilot recordings, usage data, domain registration data	Core platform infrastructure: AI Builder engine, managed WordPress hosting, dashboard, backups, co-pilot feature	YES – 10Web Reseller Data Processing Addendum.	UK IDTA or UK Addendum to EU SCCs
Stripe, Inc.	USA	Payment transaction data (card data sent directly browser-to-Stripe; we receive last 4 digits, country, transaction reference only)	Secure payment processing. PCI DSS Level 1 compliant.	YES – Stripe Data Processing Addendum.	UK IDTA / UK Addendum
Google LLC (Analytics)	USA	Anonymised website analytics (IP anonymised by default in GA4)	Google Analytics 4 — website traffic and usage analysis	YES – Google Ads Data Processing Terms.	UK Extension to EU-US Data Privacy Framework
Google LLC / Amazon Web Services (via 10Web)	USA / EU regions	Platform infrastructure data	Cloud hosting infrastructure underlying 10Web's platform	Covered under 10Web DPA	UK IDTA / UK Addendum (under 10Web DPA)
Microsoft Corporation (Azure OpenAI, via 10Web)	USA / EU	AI co-pilot interaction data	Powering AI features in the website builder	Covered under 10Web DPA; Microsoft publishes its own DPA.	UK IDTA / UK Addendum (under 10Web DPA)
Microsoft Corporation (Clarity, via 10Web)	USA	Anonymised IP, browser info, co-pilot session recordings (deleted after 1 month)	Session recording for co-pilot troubleshooting	Covered under 10Web DPA; Microsoft DPA.	UK IDTA / UK Addendum
Cloudflare, Inc.	USA / Global	IP addresses, HTTP request metadata	CDN, DDoS protection, and bot management	YES – Cloudflare Data Processing Addendum.	UK IDTA / UK Addendum
GoDaddy.com LLC (via 10Web)	USA	Domain registrant details	Domain name registration for custom domains	Covered under 10Web DPA.	UK IDTA (under 10Web DPA)
Xneelo (Pty) Ltd	South Africa	Name and email address	Hosting, storing, and maintaining the infrastructure that supports our website, applications, databases, and email services	YES – Xneelo Data Processing Agreement.	RSA: Protection Of Personal Information Act (POPIA); GDPR EU/EEA
CookieYes	UK	Cookie consent records	Cookie consent management under PECR 2003	YES – CookieYes DPA.	N/A (UK-registered company; no international transfer)

8. International Data Transfers

All transfers of personal data outside the UK must comply with Chapter V of the UK GDPR and DPA 2018 using one of the following ICO-approved mechanisms:

Transfer Mechanism	Legal Basis	When to Use	Status for Known Design AI Ltd
UK Adequacy Regulations	Art. 45 UK GDPR — UK Secretary of State designation	Transfers to countries designated adequate by the UK (including EU/EEA)	EU/EEA hosted data (some 10Web servers): no additional mechanism required. EU/EEA is adequate for UK transfers.
UK International Data Transfer Agreement (UK IDTA)	Section 119A DPA 2018 — ICO approved March 2022	Transfers to non-adequate countries (primarily USA). The UK's mechanism for international transfers.	Primary mechanism for transfers to USA (10Web, Stripe, Google, Microsoft, Cloudflare). Must be incorporated into each DPA.
UK Addendum to EU Standard Contractual Clauses	ICO approved March 2022	Where a processor uses the EU 2021 SCCs, the UK Addendum applies UK law. Alternative to UK IDTA.	Alternative to UK IDTA where processor already uses EU SCCs.
UK Extension to EU-US Data Privacy Framework	UK-US adequacy for DPF-certified companies	Transfers to US companies certified under the EU-US Data Privacy Framework (UK Extension). Google LLC participates.	Applicable to Google LLC (Analytics). Verify certification at dataprivacyframework.gov.

9. Data Subject Rights – Handling Procedures

The UK GDPR (Articles 15–22) grants individuals eight rights in relation to their personal data. Known Design AI Ltd must respond to all valid rights requests within statutory timeframes.

9.1 Rights Summary and Response Deadlines

Right	Art.	Deadline	Known Design AI Ltd Procedure	Key Exemptions / Notes
Right of Access (SAR)	Art. 15	1 month (extendable by 2 months with notice)	Request received at (privacy@knowndesign.ai). Identity verified. All personal data compiled from account records, support history, billing records, analytics (where identifiable), consent records. Response in accessible format.	Manifestly unfounded or excessive: may charge fee or refuse. DPA 2018 Schedule 2 exemptions may apply. Data adversely affecting others' rights may be withheld.
Right to Rectification	Art. 16	1 month	User updates account data via dashboard. Other corrections actioned within 1 month. Recipients of corrected data notified where required.	Only applies to inaccurate or incomplete data.
Right to Erasure	Art. 17	1 month	Grounds assessed. Where valid: account deleted; 10Web instructed to delete hosted content (60-day window); other processors notified; erasure confirmed to user.	Exceptions: legal obligation (7-year financial records); legal claims; Limitation Act 1980 periods. Cannot guarantee immediate backup deletion.
Right to Restriction	Art. 18	1 month	Account flagged as restricted. Active processing suspended beyond storage. User notified when restriction lifted.	Applies where accuracy is disputed, processing unlawful but user opposes erasure, or user has objected pending LIA.
Right to Portability	Art. 20	1 month	Data provided in structured, machine-readable format (JSON or CSV). Website content export available via dashboard.	Does not apply to data processed under legitimate interests. Does not cover inferred or derived data.
Right to Object	Art. 21	Marketing: immediately. Legitimate interests: 1 month.	Marketing: unsubscribe immediately; update suppression list. Legitimate interests: assess whether compelling grounds exist. If not, cease processing.	No right to refuse objection to direct marketing. For legitimate interests: can continue only if compelling grounds override data subject's rights.
Rights re Automated Decisions	Art. 22	1 month	Known Design AI Ltd does not currently make solely automated decisions with significant legal or similar effects. If introduced: implement human review process.	Applies only to solely automated decisions with significant legal or similar effects.
Right to Withdraw Consent	Art. 7(3)	Immediately	Marketing: unsubscribe link actioned immediately. Cookies: Cookie Preference Centre. Document withdrawal and suppress further processing immediately.	Does not affect lawfulness of processing prior to withdrawal.

9.2 Subject Access Request (SAR) – Step-by-Step Procedure

Receive the request – email to privacy@knowndesign.ai, verbally, or in writing. Log date and time immediately.
Note: a request is valid if it is clear that the individual is asking for their own personal data – they do not need to use specific wording or refer to legislation.
Log the request – assign a unique reference number; record identity of requester, nature of request, and the date received.
Verify identity (clock does not start until this is complete) – request sufficient identification promptly. Do not require disproportionate documentation. You should request ID documents promptly.
Clarify scope if needed – if you process a large amount of information about an individual, you may ask them to specify the information or processing activities their request relates to if it is not clear. The time limit is paused until you receive clarification.
Acknowledge the request – confirm receipt, reference number, and expected response date (one month from the date identity was confirmed / clarification received).
Scope assessment – compile all personal data from account records, support tickets, billing data, analytics (if identifiable), and consent records.
Apply exemptions – consider DPA 2018 Schedule 2 exemptions on a case-by-case basis. Seek legal advice if needed.
Consider extension – if the request is complex, you may extend by a further two months. Notify the requester within the first month, stating reasons.
Prepare a response – a clear, comprehensive statement of data held, purpose, lawful basis, retention period, recipients, and data subject rights.
Respond within one month of receipt (or extended deadline) in a commonly used electronic format where the request was made electronically. No charge unless manifestly unfounded or excessive.
Record keeping – log outcome, response date, exemptions applied, and any extension invoked. Retain for a minimum of 3 years.

9.3 Data Protection Complaints Process (DUAA 2025 – Required by 19 June 2026)

The Data (Use and Access) Act 2025 (s.103, inserting s.164A DPA 2018) requires Known Design AI Ltd to operate a formal data protection complaints process accessible to all data subjects. This process must be in place by 19 June 2026. There are no exemptions – the obligation applies to all controllers regardless of size or sector.

Individuals are expected to raise complaints directly with Known Design AI Ltd before escalating to the ICO. This represents a fundamental change to the UK complaints landscape, creating an intermediate step between individuals experiencing concerns about their personal data and regulatory intervention.

The Four Statutory Obligations (Must)

Provide an accessible means of making a complaint Known Design AI Ltd must give individuals a clear and accessible way to submit a data protection complaint. Complaints must be accepted regardless of how they are submitted – including via email, online form, telephone, post, or social media. The dedicated contact point is privacy@knowndesign.ai. This right must be clearly described in our Privacy Notice, on our website, and in all responses to data subject rights requests.
Acknowledge receipt within 30 days All complaints must be formally acknowledged within 30 days of receipt. The acknowledgement must confirm: receipt of the complaint; a unique reference number; the name of the handler; and the next steps in the process. This is a hard statutory deadline – there is no provision to pause the clock.
Investigate without undue delay and keep the complainant informed Known Design AI Ltd must take appropriate steps to investigate and respond to the complaint without undue delay. This includes making appropriate enquiries, consulting processors where relevant, and providing progress updates to the complainant throughout the process. Processor contracts must require processors to notify and support Known Design AI Ltd where complaints are received that relate to their processing activities.
Notify the complainant of the outcome without undue delay Once the complaint is resolved, the complainant must be notified of the outcome clearly and with sufficient detail for them to understand how the conclusion was reached.

Additional Good Practice Requirements (Should/Could)

Record keeping Known Design AI Ltd should maintain records of: the date complaints are received; how and when they are acknowledged; the steps taken during the investigation; and the final outcome. The ICO may request these records at any time. Complaint records should be retained for a minimum of three years.
ICO escalation pathway The outcome notification should explicitly inform the complainant of their right to escalate to the ICO if they remain dissatisfied with the outcome or the handling of their complaint. The ICO can be contacted at ico.org.uk or by telephone on 0303 123 1113. This escalation right must be referenced in the outcome notification in every case.

10. Data Protection Impact Assessments (DPIAs) – Article 35 UK GDPR

A DPIA is required before carrying out processing likely to result in a high risk to the rights and freedoms of individuals. DPIAs are mandatory – not optional – where the ICO’s screening criteria are met.

10.1 DPIA Screening – Known Design AI Ltd

Processing Activity	High Risk Indicators Present?	DPIA Required?	Status
AI Website Builder – content creation using generative AI	Use of new AI technology; processing of user content at scale; AI output may affect business decisions	Possibly – depends on scale and nature of data processed. Review as user base grows or AI features expand. ICO's 2026 AI investigations signal enforcement focus on AI data processing.	DPIA Complete – Approved 8 June 2026. DPIA 2 of KDAI_05_DPIA_10Web. All residual risks rated Low. No ICO prior consultation required. Review triggers: user base milestones (1,000 / 10,000 / 100,000 users); material change to AI technology or provider; new ICO AI guidance; any breach involving AI Builder data. Next scheduled review: June 2027.
AI Co-Pilot Session Recordings via Microsoft Clarity	Session recording using third-party technology; potential for sensitive content; data flows to Microsoft (USA)	YES – session recording using new technology with third-party processor. Complete DPIA before enabling this feature.	DPIA Complete – Approved 8 June 2026. DPIA 1 of KDAI_05_DPIA_10Web_Complete. All residual risks rated Low. No ICO prior consultation required. Feature must not be enabled until all mitigation actions are implemented (in-platform warning before recording; opt-out mechanism; Microsoft Clarity cookies disclosed in Cookie Preference Centre). Next scheduled review: June 2027.
Behavioural Analytics (consent-based)	Tracking individual user behaviour across sessions	Possibly – assess if profiling or behavioural segmentation is introduced. Re-screen if scope changes.	DPIA Not Required At This stage – Monitor. Standard consent-based analytics without profiling or behavioural segmentation. No DPIA required at current scope. Re-screen if profiling, cross-site tracking, or behavioural segmentation is introduced. ICO 2026 AI enforcement focus noted – re-screen if AI-driven analytics added.
Website Hosting for Users' End Visitors	Processing of visitors' data on websites built with the platform	No for standard hosting. Yes if users process special category data at scale – users are responsible for their own DPIAs.	DPIA Complete – Approved 8 June 2026. Standard hosting. No DPIA required for Known Design AI Ltd in respect of this activity at current scope. Users who process special category data at scale on their hosted websites are responsible for their own DPIAs. KDAI Terms and Conditions (Clause 7.3) place this responsibility on the user.

10.2 DPIA Process

Screening – use ICO’s DPIA screening checklist to determine if a DPIA is required.
Describe the processing – document the nature, scope, context, and purposes of the processing.
Assess necessity and proportionality – is the processing necessary? Is it proportionate?
Identify and assess risks – document risks to the rights and freedoms of data subjects.
Identify mitigating measures – technical and organisational measures to reduce risks.
Consult DPO (if appointed) – the DPO must be consulted on all DPIAs.
Sign off – DPIA approved by Data Controller. Record date and approver.
Prior consultation with ICO – if residual high risk cannot be mitigated, consult ICO before processing begins (Art. 36 UK GDPR).
Review – review the DPIA when processing changes materially or at least every 3 years.

11. Personal Data Breach Response Procedure

A personal data breach is any security incident leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. Specific notification obligations apply under Articles 33 and 34 UK GDPR.

11.1 Breach Response Timeline

Timeframe	Action Required	Responsible Party
Immediately on discovery	Contain the breach. Preserve all evidence and logs – do not delete. Alert Data Protection Lead and IT Security Lead immediately.	Roger Raad – Director / Data Protection Lead; Deep Sojitra – IT Lead
0–24 hours	Assess severity. Categorise: (1) No risk – document internally only; (2) Risk to individuals – ICO notification within 72 hours; (3) High risk – ICO notification AND individual notification.	Roger Raad – Director / Data Protection Lead
Within 72 hours of awareness (Art. 33)	If risk to individuals: notify ICO via ico.org.uk/make-a-complaint/data-security-incident-report. Include: nature of breach; categories and numbers affected; likely consequences; measures taken. Update if information is incomplete.	Roger Raad – Director / Data Controller
Without undue delay (Art. 34)	If HIGH risk: notify affected data subjects directly in plain language. Include: nature of breach; contact point; likely consequences; measures taken or proposed.	Roger Raad – Director / Data Protection Lead
Within 30 days of breach	Complete internal breach investigation report. Root cause, impact, remediation, and measures to prevent recurrence. Update DPIA if relevant.	Roger Raad – Director / Data Protection Lead; Deep Sojitra – IT Lead
Ongoing	Review and update security measures. Consider whether DPIAs or this Framework require updating. Retain all breach documentation for minimum 5 years.	Roger Raad – Director / Data Controller

12. Technical and Organisational Security Measures (Article 32 UK GDPR)

12.1 Technical Measures

Measure	Implementation	Status
Encryption in transit	All data between users and www.knowndesign.ai encrypted using TLS 1.2 or higher	In place – TLS 1.2+ enforced across knowndesign.ai via 10Web / Cloudflare infrastructure
Encryption at rest	User data encrypted at rest on 10Web's Google Cloud Platform and AWS infrastructure	In place – confirmed via 10Web DPA (KDAI_05) and 10Web Reseller DPA; GCP and AWS encrypt data at rest
Access controls	Role-based access control (RBAC). Least-privilege principle applied to all staff and system access.	In place – role-based access control applied to reseller dashboard; least-privilege principle enforced
Multi-factor authentication (MFA)	MFA enforced for all administrative accounts and staff access to the platform and third-party services	Required – enforce MFA on all admin accounts and third-party service dashboards (10Web, Stripe, Google, Mailchimp) before launch
Password security	Passwords hashed using bcrypt or equivalent. Minimum complexity enforced. Secure password reset via email link.	In place – account credentials hashed (confirmed in TRA KDAI_06 and DPA); secure password reset via email link
Payment security	Card data processed directly by Stripe (PCI DSS Level 1). Known Design AI Ltd does not store, process, or transmit card numbers.	In place – Stripe PCI DSS Level 1. Known Design AI Ltd does not store, process, or transmit card numbers
Security scanning	Automated security scans of hosted sites for malware and vulnerabilities performed by 10Web	In place – automated security scanning performed by 10Web on hosted sites; confirmed in 10Web DPA
DDoS and bot protection	Cloudflare DDoS mitigation and bot management via 10Web infrastructure	In place – Cloudflare DDoS mitigation and bot management via 10Web infrastructure; confirmed in KDAI_05
Audit logging	Login attempts, admin actions, and security events logged. Retained for 12 months.	Login attempts and admin actions logged per 10Web platform; verify retention period is 12 months
Backup and recovery	Automated daily backups of user data and hosted websites via 10Web infrastructure	In place — automated daily backups via 10Web (GCP/AWS); confirmed in 10Web DPA Annex II

12.2 Organisational Measures

Measure	Implementation	Status
Data protection policies	Privacy Notice v3, Cookie Policy v1, Terms and Conditions v2, and this UK GDPR Compliance Framework	In place – Privacy Notice, Cookie Policy, Terms & Conditions, and this UK GDPR Compliance Framework complete. Publish before launch.
Staff training	All staff with access to personal data trained on UK GDPR obligations, security practices, and breach reporting before accessing live personal data	UK GDPR staff training implemented for all personnel with access to personal data.
Confidentiality obligations	All staff and contractors with access to personal data subject to contractual confidentiality obligations	All staff and contractors with access to personal data have signed confidentiality obligations before accessing live data.
Sub-processor due diligence	DPAs in place with all sub-processors. Sub-processor register maintained in Section 7.1.	10Web Reseller DPA, Stripe DPA, Google DPA, CookieYes DPA, Cloudflare DPA, Xneelo DPA in place.
Privacy by design and default	Data protection considerations incorporated into all new feature development and third-party integrations before implementation. Minimum data collection as default.	Data minimisation principle applied to all new features and integrations.
ICO registration	Known Design AI Ltd registered with ICO and annual data protection fee paid	In place – ICO Registration Number ZC082723 (confirmed in KDAI_05 DPIA documents)
Data protection complaints process (DUAA 2025)	Formal complaints procedure documented in Section 9.3 and published in Privacy Notice	In place – formal complaints procedure documented in Section 9.3 and to be published in Privacy Notice. Required by 19 June 2026.
Annual review	This Framework and all policy documents reviewed annually and on any material change to processing activities or applicable law	Next scheduled review: June 2027 (aligned with DPIA and TRA review dates).
Incident response testing	Breach response procedure tested and rehearsed at least annually	Breach response procedure to be tested before launch and then annually thereafter.

13. UK GDPR Pre-Launch Compliance Checklist

13.1 Legal Registration and Documentation

☐ Registered with ICO and paid data protection fee (www.ico.org.uk/registration – criminal offence to operate without registration.)

☐ Complete Privacy Notice.

☐ Complete Terms and Conditions.

☐ Complete Cookie Policy.

☐ Complete UK GDPR Compliance Framework.

☐ Signed Data Processing Agreement with TenWeb, Inc. (10Web).

☐ Accept Stripe Data Processing Addendum — via Stripe dashboard

☐ Accept Google Analytics Data Processing Terms — via GA4 admin console

☐ Sign DPAs with all remaining sub-processors: email provider, CMP provider, support platform

☐ Completed Transfer Impact Assessments (TIAs) for USA transfers.

13.2 Website and Technical

☐ Install and configure Consent Management Platform (CMP) — CookieYes or Cookiebot recommended for WordPress / 10Web

☐ Test cookie consent banner — no non-essential cookies set before consent; accept/reject equally prominent; no dark patterns

☐ Verify Cookie Preference Centre accessible from footer of every page

☐ Run live cookie scan using CookieYes or CookieServe — verify cookie register in Cookie Policy is accurate

☐ Privacy Notice linked in website footer — visible on all pages

☐ Terms and Conditions linked in website footer

☐ Cookie Policy linked in website footer

☐ Data rights request contact email or form accessible to users

☐ Data protection complaints process published and accessible on website

☐ TLS / SSL certificate active on www.knowndesign.ai

☐ MFA enforced on all admin and staff accounts

13.3 Governance and Process

☐ Data Protection Lead / DPO identified, briefed, and contact details recorded in Section 3.2

☐ Staff UK GDPR training completed for all personnel with access to personal data

☐ Breach response procedure understood by all relevant staff — emergency contact list prepared

☐ SAR handling procedure operational — designated email monitored

☐ Data protection complaints email operational — dedicated address monitored

☐ DPIA completed for AI co-pilot session recordings (required before enabling feature)

☐ Legitimate Interests Assessments (LIAs) drafted for all Art. 6(1)(f) processing activities

☐ Annual review date set in calendar for all policies and this Framework

☐ Internal breach log document created and stored securely

☐ Data protection complaints process published by 19 June 2026 (DUAA 2025 deadline)

14. Key Regulatory Contacts

Body	Role	Contact Details
Information Commissioner's Office (ICO)	UK supervisory authority for UK GDPR, DPA 2018, DUAA 2025, and PECR. Register here. Report breaches here.	ico.org.uk \| Helpline: 0303 123 1113 \| casework@ico.org.uk \| Breach reporting: ico.org.uk/make-a-complaint/data-security-incident-report \| Registration: ico.org.uk/registration
ICO DPO Register	Register your Data Protection Officer where appointment is mandatory or voluntary	ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/data-protection-officers/
ICO DPIA Guidance and Templates	Guidance and templates for DPIAs under Art. 35 UK GDPR	ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/data-protection-impact-assessments-dpias/
ICO UK IDTA and Transfer Guidance	UK International Data Transfer Agreements and TIA guidance	ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/
TenWeb, Inc. (10Web) — Privacy Contact	For matters relating to 10Web's processing as our data processor	privacy@10web.io \| 10web.io/legal/privacy-policy
Stripe, Inc. — Privacy Contact	For payment processing data matters	stripe.com/privacy \| privacy@stripe.com

15. Document Control

Field	Details
Document Title	Known Design AI Ltd — UK GDPR Compliance Framework
Document Owner	Director
Version	1.0
Date Prepared	26 May 2026
Prepared By	Roger Raad – Director
Approved By	Roger Raad – Director
Date of Last Review	June 2026
Date of Next Scheduled Review	June 2027
Classification	PUBLIC DISTRIBUTION
Storage Location	Secure shared drive with restricted access
Related Documents	Privacy Notice v3; Terms and Conditions v2; Cookie Policy v1; 10Web DPA; Stripe DPA; Google Analytics DPA; Breach Log; DPIA Register; LIA Register
Governing Law	England and Wales

LEGAL DISCLAIMER
This UK GDPR Compliance Framework is a template document for governance and accountability purposes only. UK data protection law, including the DUAA 2025, is subject to ongoing development – monitor ICO guidance for updates. Known Design AI (the AI service that generated this document) accepts no liability for reliance on this template. This document is governed by the laws of England and Wales.