Legal

Privacy Policy

Last updated 5 October 2026 (AI assistant added)

1. About this policy

This policy explains how Fortuna Pace Limited (company number 15496207, Strawberry Fields Digital Hub, Euxton Lane, Chorley, Lancashire PR7 1PS) handles personal data in Mandate at mandate.fortunapace.com. Our website at fortunapace.com has its own privacy policy.

2. Our role

Account data: for the people who sign up and sign in, we are the controller.
Customer data: for the information an organisation puts into Mandate or collects through it, such as agent owners, staff survey answers and directory scans, the organisation is the controller and we are its processor. We act only on its instructions, as set out in our terms.

3. What we collect

Account details: name, work email address, organisation name, role, and your password, which is stored only as a one-way hash. If you sign in with Microsoft or Google, we store the account identifier they give us, not your password for them.
Security data: two-step sign-in secrets and recovery codes (encrypted or hashed), sign-in sessions, and records of sign-in attempts.
Register data: the AI agents your organisation records and the people named as their owners, plus the history of changes and who made them.
Discovery data: if your administrator connects Microsoft 365 or Google Workspace, Mandate reads the list of apps and AI tools in your directory, the users linked to them, and whether those users' accounts are still active. Staff survey answers and spreadsheet imports are stored the same way.
Technical data: IP address, browser details and request times, kept in server logs to run and secure the service.

4. How we use it

To provide Mandate: signing you in, showing your register, running scans and producing reports (performing our contract with you).
To send service emails such as invitations, confirmations, password resets, security notices and the weekly summary, which you can turn off in your account (contract and legitimate interests).
To keep Mandate secure, prevent abuse and fix problems (legitimate interests).
To meet legal obligations, such as keeping invoices if you pay us.

We don't sell personal data, use it for advertising, or use your organisation's data to train AI models.

4a. The AI assistant

Mandate's AI assistant drafts role cards, sorts what discovery and the staff survey find, writes the overview briefing and drafts insurer answers. It runs on a language model on hardware we own and operate in the United Kingdom. Your data isn't sent to an outside AI provider, isn't kept by the model after it answers, and isn't used to train it. Everything the assistant writes is a suggestion: nothing changes in your register until a person saves it.

5. Where it's held and who helps us

Mandate runs on servers we operate in the United Kingdom, and its backups stay in the United Kingdom. We use these providers:

Microsoft sends Mandate's emails from mandate@fortunapace.com through Microsoft 365, and provides Microsoft sign-in.
Google provides Google sign-in, if you use it.
Stripe handles card payments for paid plans, if you choose one. We never see or store full card numbers.

Where a provider processes data outside the UK, it does so under safeguards recognised by UK law, such as the UK adequacy regulations or the International Data Transfer Addendum.

6. Cookies

Mandate uses one strictly necessary cookie to keep you signed in, plus short-lived cookies while you sign in with Microsoft or Google. We don't use analytics or advertising cookies, so we don't ask for cookie consent.

7. How long we keep it

Account and register data: while your organisation's account is open. When it closes, we delete it within 30 days, and backups expire 30 days after that.
Sign-up confirmations, invitations and reset links that aren't used expire within days.
Server logs: up to 30 days.
Billing records: as long as tax law requires (currently six years).

8. Security

Connections use HTTPS. Passwords are hashed, sensitive secrets are encrypted at rest, two-step sign-in is available and can be required across an organisation, and access to the servers is restricted. If a breach affects your personal data, we'll tell you and, where required, the Information Commissioner's Office.

9. Your rights

Under UK GDPR and the Data Protection Act 2018, you may have the right to access, correct, erase or export your personal data, and to restrict or object to how we use it. You can update your own details in your account. If your data is in Mandate because of your employer, contact them first, as they control it; we'll help them respond. You can also complain to the Information Commissioner's Office at ico.org.uk.

10. Children

Mandate is a business service and isn't intended for anyone under 16.

11. Changes and contact

We'll show the date of any update at the top, and we'll email account owners about significant changes. For questions or requests, use our contact page or call +44 1257 440600.