Privacy policy

1. Who we are

Fire Safety & Compliance Ltd (company number 14086764), registered at 111 Gloucester Road, Bishopston, Bristol BS7 8AT, United Kingdom, is the data controller for personal data processed through Safety Partnership Hub.

You can contact us about anything in this policy at enquiries@firesafety-compliance.co.uk.

2. What we collect

We collect only what we need to run your account and keep compliance records:

• Account details: name, email address, password (stored only as an encrypted hash), job role and the organisation you belong to.
• Organisation details: company name, sites, logo and billing information.
• Safety records: checks you complete, answers, pass/fail outcomes, actions, comments and the date and time of each entry along with the name of the person who made it.
• Files you upload: photos, certificates, policies, procedures and other documents.
• Contractor evidence: insurance, qualification and accreditation documents, including expiry dates, for contractors in our vetted directory.
• Support messages: questions you send to the in-app assistant and any request escalated to our team.
• Technical data: IP address, browser type, and basic logs needed for security and troubleshooting.

3. Why we use it and our lawful basis

Under the UK GDPR and the EU GDPR we rely on the following lawful bases:

• Performance of a contract — creating and running your account, storing your safety records, delivering checks, actions and documents, and processing quotes between clients and contractors.
• Legitimate interests — keeping the service secure, preventing misuse, providing support, and improving how the service works. We balance this against your rights and only use the minimum data needed.
• Consent — non-essential cookies and any marketing emails. You can withdraw consent at any time.
• Legal obligation — keeping accounting records and responding to lawful requests.

4. Who we share it with

We never sell your data. We share it only with service providers who process it on our instructions under a written contract:

• Our hosting, database and file storage provider, which runs the service and stores your records and uploads.
• Our email delivery provider, which sends account, notification and reminder emails.
• Our payment processor, which handles subscription and set-up fee payments. We do not store your card details.
• Our AI provider, which powers the in-app assistant. Assistant conversations are not used to train third-party models.
• Contractors and clients: when a quote is requested, the contact details and job information needed for that quote are shared between the parties involved.
• Professional advisers, insurers or authorities where we are legally required to disclose.

5. International transfers

Where a provider processes data outside the UK or European Economic Area, we rely on UK and EU standard contractual clauses (including the UK International Data Transfer Addendum) or an adequacy decision, so your data keeps the same level of protection.

6. How long we keep it

• Account and organisation data: for as long as the account is active, then up to 12 months after closure.
• Safety check and action records: retained for 6 years, as these are compliance records that may be needed for legal or insurance purposes.
• Uploaded files: deleted when you delete them, or when the account is closed and the retention period above has passed.
• Billing records: 6 years, as required by tax law.
• Support and assistant messages: 12 months.

7. Your rights

You have the right to:

• Ask for a copy of the personal data we hold about you.
• Have inaccurate data corrected.
• Ask us to delete data, where we are not required to keep it.
• Ask us to restrict how we use it, or object to processing based on legitimate interests.
• Receive your data in a portable format.
• Withdraw consent at any time, without affecting anything done before you withdrew it.
• Complain to a supervisory authority. In the UK this is the Information Commissioner's Office (ico.org.uk, 0303 123 1113). In the EU, it is your local data protection authority.

8. How to exercise your rights

Email enquiries@firesafety-compliance.co.uk with the words "data request" in the subject line. We will respond within one month. If your request is complex we may extend this by two further months and will tell you if we do. There is no charge.

If you belong to a client organisation, some requests may need to be handled with your organisation's administrator, as they control the records held in their account.

9. How we protect your data

• Each organisation's records are separated so that one organisation cannot see another's data.
• Data is encrypted in transit and at rest.
• Documents are served through short-lived, signed links rather than public URLs.
• Access is limited by role — admin, manager, contractor and employee — so people only see what they need.
• Uploads are size-limited and compressed to reduce stored data.

10. Children

The service is intended for workplace use and is not designed for anyone under 18. We do not knowingly collect data from children.

11. Changes to this policy

If we make a material change we will update the version and date at the top of this page and ask you to review and accept the updated policy the next time you sign in.