Last updated: 29 July 2026
This website is operated by SERRAQ HQ Limited, a private company limited by guarantee registered in England and Wales (company number 10563404), which trades as the Risk Accounting Standards Board (“RASB”, “we”, “us”). SERRAQ HQ Limited is the data controller for personal data collected through rasb.org.
Registered office: Bishopstone, 36 Crescent Road, Worthing, West Sussex, BN11 1RL, England.
This statement explains what we collect, why, how long we keep it, and the rights you have over it.
If you have any question about this statement or wish to exercise your rights, contact us at info@rasb.org.
What we collect and why
When you contact us
Our contact form asks for your name, email address, an optional phone number, and your message. We use this solely to respond to your enquiry and to maintain a record of the correspondence. The lawful basis is our legitimate interest in responding to people who approach us.
When you subscribe to our newsletter
We collect your name and email address, and we record whether our emails are opened and which links are clicked, so that we can tell whether our communications are useful. Our newsletter is delivered using MailPoet. The lawful basis is your consent, which you may withdraw at any time using the unsubscribe link in any email, or by writing to us.
When you download a whitepaper or the Constitution
Downloads are served through Download Monitor, which records the date, the file requested, and the IP address making the request, and sets a cookie to track download activity. We use this to understand which research is being used. The lawful basis is our legitimate interest in measuring the reach of our publications.
When you browse the site
With your consent, we use Google Analytics 4 to understand how visitors find and use the site. Analytics cookies are not set unless you accept them via our cookie banner. You can change or withdraw your choice at any time from the cookie settings link in the site footer.
Our web server and our security plugin (Wordfence) keep access and security logs that include IP addresses, for the purpose of detecting and blocking attacks. The lawful basis is our legitimate interest in keeping the site secure.
Cookies
A full, automatically maintained list of the cookies this site uses — including their purpose and how long each lasts — is set out in our Cookie Policy. Non-essential cookies are only set after you consent.
Third parties who process data on our behalf
We use the following services. Each may receive limited personal data (typically your IP address) in the course of providing its function:
- Google Analytics — website statistics. Loaded only with your consent.
- Google reCAPTCHA — protects our contact form from automated abuse. Subject to Google’s privacy policy and terms.
- Google Fonts — typefaces used in the site design.
- MailPoet — newsletter delivery and statistics.
- Vimeo — video hosting, where video is embedded in a page.
- Gravatar — profile images, where applicable.
- Our hosting provider — stores the website and its database, and keeps server logs and backups.
Some of these providers are established outside the European Economic Area. Where personal data is transferred outside the EEA, that transfer relies on the safeguards those providers have put in place, such as the EU–US Data Privacy Framework or Standard Contractual Clauses.
How long we keep it
- Contact form enquiries — kept for as long as needed to deal with the enquiry and any follow-up, and then for up to two years.
- Newsletter subscriptions — kept until you unsubscribe.
- Download records — kept for up to two years.
- Analytics data — retained according to our Google Analytics configuration, and no longer than 14 months.
- Security and server logs — kept for a short period, typically no more than 12 months.
Your rights
Under the General Data Protection Regulation you have the right to:
- ask what personal data we hold about you, and receive a copy;
- have inaccurate data corrected;
- have your data erased, where we have no overriding reason to keep it;
- restrict or object to how we use your data;
- receive data you gave us in a portable format;
- withdraw consent at any time, where our use relies on consent.
To exercise any of these, write to info@rasb.org. We will respond within one month.
If you are not satisfied with how we have handled your data, you have the right to complain to a supervisory authority — in the United Kingdom, the Information Commissioner’s Office (ico.org.uk); in the European Union, the data protection authority for your country.
Automated decision-making
We do not use your personal data for automated decision-making or profiling.
Changes to this statement
We may update this statement as the site changes. The date at the top shows when it was last revised.