Data, security and legal wording · 11 Proof and guardrails

Data rights you may describe (GREEN)#

"Download everything Maktura holds about you, or delete your account, from Settings."
"Admins can erase someone on request, and download what's held about them."
"Cookie and analytics consent you can accept, withdraw and review."
"UK time zones and UK data rights are built in."
"Sign in with a one-time code sent to your email."

The published legal pack#

The site publishes a privacy policy, cookie policy, website terms of use, acceptable use policy and data processing agreement (effective 1 August 2026, maktura.com/legal). Sellers never send the legal pack and never summarise it. John sends it once Karl has confirmed it (D27). For data handling, retention, security or location, say: "I'll get you our data processing terms and the current position in writing from our team."

The data processing agreement lists security measures and an export-then-delete window, not all confirmed for the launch build. Never restate them yourself. If a buyer quotes one, say you'll confirm in writing and pass it to John. The acceptable use policy bars surveillance, protest monitoring and profiling on protected characteristics: GREEN against "will this watch my staff?".

Watch out

The legal documents refer to platform Terms of Service. Before taking any payment, check with John that the Terms of Service are published. If they are not, do not take payment. Never describe the terms, or send a buyer to them, until John confirms they are live.

Security and certification answers#

Question	What to say
"Are you SOC 2 / ISO 27001 / Cyber Essentials certified?"	"No, we're not certified, and I'd rather tell you that plainly than have you find it in a questionnaire. John will send our data processing agreement once our legal team has confirmed it, and our team will answer a security questionnaire in writing."
"Have you had a penetration test?"	"I'll get you a written answer on that."
"Is it enterprise grade / bank grade?"	Never those phrases. Describe real features (approvals, roles, activity log, one-time code sign-in); the documents come from John.
"Where is our data hosted?"	"I'll get you our data processing terms and the current position in writing from our team." Never a location, a provider, or a provider's certification as ours.
A security questionnaire arrives	Send it to John the same day. John routes it; Karl Foster approves the answers before anything goes back. Never fill one in yourself.
"Are you GDPR compliant / ICO approved / AI Act compliant?"	"We take data protection seriously and our data processing agreement sets out how. For anything you need in writing, our legal team will answer."
"Will our data train your model?"	A2 and A3, spoken, then offer the written answer.
"Are you insured?"	"I'll get John to answer that."

Staff monitoring#

Each person connects their own LinkedIn and sees their own compliance record (R5); Maktura does not watch what anyone posts outside it. Never describe the compliance view as keeping tabs on staff.