A customer asked for your GDPR documents. Send them today.

You upload the spreadsheet they sent (xlsx, xlsm or csv) or paste the questions. Rowpa shows you how it read the columns and waits for you to confirm. It then drafts every row it can evidence from your own record, with the source beside each answer, and marks the rest as rows only you can answer. In a general vendor security assessment the data protection rows are usually around a tenth of the sheet; the rest is MFA, backups, patching and the like. Those come from your security posture profile: thirty-six questions about your IT, answered once as yes, partly, no or not sure, which Rowpa drafts from and never embellishes. What is left is the specifics only you know, such as a penetration test summary or an insurance limit. You approve, edit or skip each row, and the approved answers are written back into their file in their layout.

A cover addressed to whoever asked, then: how you handle personal data, what you do with it, sub-processors and suppliers with DPA status, international transfers, AI tools in use, security measures, what happens if something goes wrong, complaints, data subject rights, policies and procedures, how the record is kept current, and an attestation by a named person. Every section comes from your record; nothing is written for the pack alone. You can leave sections out. It goes out as a link you can revoke, with or without asking the reader for their email, or as a PDF.

Yes. The demo shows a finished pack and a questionnaire mid-review on a fictional company, and the supplier pack page walks through every section of a sample. Nothing in either belongs to a real business.

A Pack Pass is 39 pounds once: one pack for one customer, regenerated as often as you like for a year, share link included. A Questionnaire Pass is 79 pounds once: one questionnaire of up to 300 questions, written back into the file they sent. No card is kept on file and there is nothing to cancel. If you subscribe within 30 days of buying a pass, the pass comes off your first payment.

Setup is designed to be completed in under an hour. The AI drafts everything from your website scan; you review each processing activity, confirm vendors, and add any tools we missed.

If you collect or use personal data from people in the UK or EU, yes. That includes customer emails, employee records, website analytics, contact forms, and payment details. It applies to businesses of any size, not just large companies.

The core requirements are: keep a record of what personal data you process and why (your ROPA), have written agreements with any tools or services that handle that data (DPAs), publish a privacy policy, and respond to data requests within 30 days. Rowpa drafts these materials from the information you provide; you review and confirm them.

In practice, what happens first is that a customer asks. A procurement team wants your record of processing, a signed DPA and answers to a security questionnaire before they will sign, and the deal waits until you send them. That is the moment Rowpa is built for: the record you keep here is what the pack and the questionnaire answers are drawn from.

A cookie banner handles one small part of GDPR. You also need a Record of Processing Activities, valid legal bases for every way you use data, agreements with your vendors, and a process for handling data requests. Rowpa helps organize these workflows, but it does not make a legal determination for you.

No. Enter your business name and website, and our AI does the rest. You review what we find and confirm. No legal or technical knowledge required.

Our AI starts from a curated taxonomy and vendor records with source URLs and confidence signals. It can be wrong or incomplete, so uncertain items stay visible for your review and confirmation.

No. Outputs are AI-generated drafts for your review. We are not a law firm and no solicitor-client relationship is created. See our Terms of Service.

You can add any tool manually. We will include it in your ROPA with a note that the DPA status needs manual verification.

Yes. The product covers both UK GDPR and EU GDPR. The core obligations are virtually identical. Our vendor library includes transfer mechanisms for both UK and EU adequacy decisions, and we flag where the two regimes differ.

The current storage region and service providers are shown in our privacy information and depend on the production configuration. We describe provider retention and transfer safeguards only where they are confirmed. Connections are encrypted in transit and data is protected at rest by the configured infrastructure.

Yes. We use row-level security so each business can only access its own data. All connections are encrypted with TLS. Authentication uses magic links - there are no passwords to leak.

Yes. You can export your ROPA as PDF, CSV, or JSON at any time, including after cancellation (for 30 days). Your data is yours and we make it easy to take with you.

It is a single public page that shows your compliance posture: ROPA summary, sub-processor list with DPA links, security overview, privacy policy, DSR submission form, and optionally any breach disclosures. You share one URL with people who check before they ask. When someone wants a document to file, you send them a supplier pack instead.

Yes. The Data Use and Access Act 2025 requires every UK organisation to have an accessible complaints procedure (in force since 19 June 2026). Rowpa generates one from your business profile, gives you a public intake form with automatic reference numbers, and tracks the 30-day acknowledgement deadline for each complaint.