Privacy Statement & Policy

1. Introduction

This Privacy Statement explains how personal information is collected, used, stored, protected and disclosed through our digital compliance management system, associated websites, mobile applications and related services.

Our system is designed principally to support organisations in managing, demonstrating and evidencing compliance with applicable legal, regulatory, contractual, health and safety, environmental, competency and operational requirements.

The system may be used across head offices, offices, manufacturing facilities, construction sites and other fixed, mobile or peripatetic working environments.

Because the system is designed to create and maintain records that may subsequently be required as evidence of compliance, the processing of personal information through the system may differ substantially from that associated with a conventional customer relationship management or general-purpose business application.

We recognise the importance of protecting personal information and process it in accordance with applicable UK and European data protection legislation, including the UK Data Protection Act 2018 and UK GDPR, and, where applicable, the EU General Data Protection Regulation (EU GDPR).

2. Our Digital Compliance Management System

Our digital management system provides a structured environment through which organisations can collect, manage, record, monitor and retrieve information relating to their workforce, contractors, activities and compliance obligations.

Depending upon the services implemented for a particular client, the system may include:

• workforce registration and identification;
• user authentication and account management;
• attendance and site-entry information;
• login and logout records;
• recording of working activities and duties;
• competency and training records;
• training certificates and evidence;
• right-to-work and other legal-status information;
• health and safety information;
• risk assessments and method statements;
• acknowledgement or acceptance of RAMS and other compliance documentation;
• accident and incident information;
• investigation records;
• performance and compliance reporting;
• management-system records;
• plans, drawings, diagrams and designs;
• photographs and other documentary evidence;
• electronic forms and signatures or acknowledgements;
• management-system records
• information required to demonstrate compliance to clients, auditors, regulators, insurers or other legitimately authorised parties.

The precise information processed will depend on the client's requirements and the particular modules and services implemented.

3. Who Determines How Personal Information Is Processed

3.1 Client as Data Controller

Where our system is operated on behalf of a client to manage information relating to that client's employees, workers, contractors or other individuals, the client will generally determine:

• why the information is collected;
• what information is required;
• how it is used;
• how long it needs to be retained;
• who is authorised to access it.

3.2 Our Independent Processing

We may also process personal information for purposes for which we are ourselves a Data Controller.

This may include information concerning: our own employees and personnel; customer and prospective customer contacts; contractual administration; billing and financial administration; legal and regulatory obligations applying directly to us; information-security management; prevention and investigation of misuse of our systems; system administration; technical support; maintenance and protection of the platform; management of our contractual relationships; and establishing, exercising or defending legal claims.

4. Personal Information We May Process

The system is currently intended to use mobile telephone-based authentication for the mobile application. The system does not currently use biometric identification.

5. Why We Process Personal Information

• provide and administer the digital compliance management system;
• enable clients to manage their legal, regulatory, contractual, health and safety, environmental and operational obligations;
• establish whether individuals have the appropriate competence, training, qualifications or authorisations for particular activities;
• manage workforce and contractor attendance;
• provide appropriate access to workplaces, sites, activities or systems;
• record acknowledgement of risk assessments, method statements and other instructions;
• create reliable records demonstrating that required processes have been undertaken;
• investigate accidents, incidents, unsafe conditions and other events;
• monitor compliance and performance;
• produce management, audit and regulatory reports;
• maintain records required by law or regulation;
• provide evidence to clients, auditors, regulators, insurers, legal advisers or other legitimately authorised parties;
• administer user accounts and maintain system security;
• investigate suspected misuse, unauthorised access, fraud or security incidents;
• provide technical support and maintain the integrity and availability of the system;
• meet our contractual obligations;
• comply with legal obligations applying to us or our clients;
• establish, exercise or defend legal claims.

6. Lawful Basis for Processing

The lawful basis for processing will depend upon the particular processing activity and the organisation responsible for determining its purpose.

Depending upon the circumstances, processing may rely upon: compliance with a legal obligation; performance of a contract; legitimate interests; protection of vital interests; consent, where consent is an appropriate legal basis; or another lawful basis available under applicable data protection legislation.

Where special category personal data is processed, an additional condition under the applicable data protection legislation will also be required.

We do not rely upon consent as a universal basis for processing workforce compliance information. In many circumstances, we process compliance information because it is necessary to meet legal, regulatory, contractual, health and safety, or legitimate business requirements.

7. Compliance and Evidential Records

A significant characteristic of our system is its ability to create an auditable record of compliance.

Some information may therefore need to remain available after an individual has ceased working for a client or after a particular project has ended.

This is particularly relevant where records may subsequently be required by a regulator; during an audit; following an accident or incident; by an insurer; during an investigation; in connection with a legal claim; to establish what information, instruction, training or assessment existed at a particular time; or to demonstrate that an organisation had discharged its legal or contractual responsibilities.

We therefore distinguish between ordinary operational information and information which forms part of a continuing compliance or evidential record.

8. Health and Incident Information

Accident and incident records may contain information concerning an individual's physical or mental health.

Such information will only be processed where an applicable special-category condition and other legal requirements are satisfied.

The retention of certain incident and health-related evidence may need to extend significantly beyond the period in which an individual is actively engaged with a client.

This is because the full consequences of an injury, illness or traumatic event may not always be immediately apparent. In appropriate circumstances, records may therefore need to be retained for an extended period where they may be required to establish the circumstances of an event, demonstrate compliance, support an investigation, meet insurance requirements or establish, exercise or defend legal claims.

An extended retention period will not automatically apply to every item of health information. Retention will be determined according to the nature, purpose and continuing evidential significance of the record.

9. Retention of Personal Information

We retain personal information only for as long as there is a legitimate and documented reason to do so.

The applicable retention period may be determined by legislation or regulatory requirements; contractual requirements; the nature of the compliance record; health and safety considerations; insurance requirements; limitation periods; the possibility of future investigation or legal proceedings; the continuing evidential value of the record; and legitimate operational requirements.

Certain compliance and evidential records may consequently require retention for periods extending to six, ten, fifteen or twenty years, depending upon their nature and the requirements applying to the particular record.

This does not mean that every item of personal information is retained for twenty years.

We maintain, or will maintain, a documented retention schedule identifying appropriate retention periods for different categories of information.

Where a retention period expires and there is no continuing lawful reason to retain the information, it will be securely deleted, anonymised or otherwise disposed of in accordance with applicable requirements.

10. Mobile Application

Our mobile application has been developed independently by our employees as part of the digital compliance management system.

The application may process information including name; email address; mobile telephone number; user account and authentication information; login and logout times; attendance information; site or workplace information; compliance and operational records; training and competency information; information entered into forms; photographs or other evidence where the applicable system functionality permits this.

The application is distributed through recognised mobile application platforms, including the Apple App Store and Google Play.

Apple and Google may process information independently in connection with the operation, security, distribution and administration of their respective platforms. Their processing is governed by their own privacy arrangements and terms.

We do not currently use biometric identification for access to the application.

If biometric identification is introduced in the future, it will not be implemented merely by changing the application. The proposed processing will first be subject to appropriate data protection assessment, including consideration of whether a Data Protection Impact Assessment and additional safeguards are required.

11. Third-Party Technology Providers

Our digital compliance management system uses specialist technology providers to provide the underlying technical infrastructure and associated services.

Salesforce provides the principal hosted platform and technical architecture upon which the management system operates. Depending upon the particular processing activity, Salesforce may process personal information as a technology service provider or processor/subprocessor acting in support of the services we provide.

Formstack / Intellistack technology is used in connection with forms, PDF data flows, document generation, document handling and associated printing or output processes.

SharinPix technology is used to create, manage and associate documents and images with information held within the Salesforce environment.

Additional technology providers may be introduced where necessary to provide, maintain, secure or improve particular elements of the service.

We maintain a technology-provider and subprocessor record identifying, as applicable: the provider; the service provided; the categories of information processed; the processing purpose; the contractual relationship; applicable data protection terms; the location of processing; international transfer arrangements; and relevant security arrangements.

Provider-specific information will be reviewed and updated as contractual and technical information becomes available.

12. International Processing and Transfers

Because our system relies upon cloud-based technology providers, personal information may be processed, stored or accessed in countries outside the United Kingdom and, where applicable, outside the European Economic Area.

Where personal information is transferred internationally, we will ensure that the transfer is undertaken in accordance with applicable data protection legislation.

Depending upon the circumstances, this may include: a relevant adequacy decision or adequacy regulation; appropriate contractual safeguards; Standard Contractual Clauses; UK International Data Transfer Agreements or Addendums; approved certification or recognised transfer mechanisms; or another lawful transfer mechanism.

We do not represent that all information is physically stored exclusively within the United Kingdom.

We will maintain the international processing position of our technology providers in our internal provider/sub processor register and review it when services, contractual arrangements, or applicable law change.

13. Security of Personal Information

We recognise that the confidentiality, integrity and availability of personal information are essential to the operation of a compliance management system.

We therefore apply appropriate technical and organisational measures intended to protect personal information against unauthorised access; unauthorised disclosure; accidental loss; destruction; alteration; misuse; and other forms of unlawful processing.

Security measures may include: controlled user access; individual user accounts; authentication controls; role-based permissions; access restriction on a need-to-know basis; system logging; secure cloud infrastructure; controlled administration privileges; monitoring and management of system access; backup and recovery arrangements; technical security controls; procedures for dealing with information-security incidents; and contractual controls over relevant service providers.

No electronic system can be guaranteed to be completely secure. We nevertheless seek to ensure that security controls are proportionate to the nature and sensitivity of the information being processed and the risks associated with the service.

14. Access to Personal Information

Access to personal information within the system is controlled according to authorised business requirements.

Users should only have access to information necessary for their role.

Depending upon the system configuration, access may be restricted according to organisation; client; project; site; role; responsibility; permission level; or other defined access criteria.

Access rights may be reviewed and amended when an individual joins, changes role or leaves an organisation.

System activity may also be logged to assist with security, accountability and investigation.

15. Disclosure of Personal Information

Personal information may be made available to authorised parties where this is necessary and lawful.

Depending upon the circumstances, these parties may include: the relevant client organisation; authorised employees and managers; contractors or other authorised workforce personnel; auditors; regulators; enforcement or investigating authorities where legally required; insurers; professional advisers; legal advisers; courts or tribunals; technology providers and subprocessors; and other parties where disclosure is necessary for a lawful purpose.

We do not sell personal information.

16. Individual Data Protection Rights

Subject to applicable legal conditions and exemptions, individuals may have rights including: the right to be informed; the right of access; the right to rectification; the right to erasure; the right to restriction of processing; the right to data portability; the right to object to certain processing; rights relating to automated decision-making and profiling; and the right to withdraw consent where processing is based upon consent.

These rights are not absolute and may be subject to legal exemptions, particularly where information must be retained to comply with legal obligations, establish or defend legal claims, protect the rights of others or maintain required regulatory or evidential records.

Where we process information on behalf of a client, requests concerning that client's workforce information may need to be referred to the relevant client as Data Controller.

17. Data Protection Requests

If an individual wishes to exercise their data protection rights, they should normally contact the organisation responsible for determining why their personal information is being processed.

Where we act as a Data Processor, we will provide reasonable assistance to the relevant Data Controller in accordance with our contractual and legal obligations.

Where we are the Data Controller, requests should be made using the contact details provided in this Privacy Statement or the applicable service documentation.

We may need to verify an individual's identity before responding to a request.

18. Data Protection Incidents

We maintain arrangements for identifying, managing and responding to actual or suspected personal data breaches and information-security incidents.

Where a personal data breach occurs, we will assess the nature and extent of the incident and take appropriate action in accordance with applicable law and our contractual obligations.

Where we act as a Data Processor, we will notify the relevant Data Controller in accordance with the applicable contractual arrangements and legal requirements.

19. Children's Information

The digital compliance management system is primarily intended for use in employment, contracting, construction, manufacturing, professional and organisational environments.

It is not generally intended to collect information from children.

Where information concerning a child is nevertheless processed because this is necessary for a legitimate client purpose, the processing will be subject to appropriate safeguards and applicable data protection requirements.

20. Changes to This Privacy Statement

This Privacy Statement may be updated from time to time to reflect changes in legislation; regulatory guidance; changes to our services; changes to the technology architecture; changes to our technology providers; changes in international processing arrangements; the introduction of new application functionality; or improvements to our privacy and security arrangements.

Material changes will be appropriately communicated where required.

The current version will be identified by its version number and effective date.

21. Contact

For questions concerning this Privacy Statement, the processing of personal information or the exercise of data protection rights, please contact:

Where applicable, individuals may also have the right to complain to the relevant data protection supervisory authority.

For processing undertaken under UK data protection legislation, the relevant supervisory authority is the Information Commissioner's Office (ICO).

22. Document Control

Appendix 1 – Technology Provider and Subprocessor Schedule

The following schedule should be maintained separately from this Privacy Statement so that provider information can be updated without unnecessarily revising the principal Privacy Statement.

Appendix 2 – Principal Categories of Personal Information

Appendix 3 – Retention Principles

• statutory retention requirements;
• regulatory requirements;
• contractual requirements;
• health and safety records;
• accident and incident records;
• insurance requirements;
• legal limitation periods;
• potential future claims;
• regulatory investigations;
• the evidential value of historical compliance records.

Retention periods should be determined according to the nature and continuing purpose of the information.

The retention schedule should identify the specific period applicable to each category rather than applying a single blanket retention period to all personal information.

Appendix 4 – Review and Assurance

This Privacy Statement and its associated supporting records should be reviewed when:

• the system architecture changes;
• a new technology provider is introduced;
• processing purposes change;
• new categories of personal information are collected;
• special category information is introduced or materially changed;
• biometric processing is proposed;
• international processing arrangements change;
• a significant data-security incident occurs;
• relevant legislation or regulatory guidance changes;
• the organisation expands its services into additional jurisdictions.

A Data Protection Impact Assessment should be undertaken where proposed processing is likely to result in a high risk to individuals' rights and freedoms, including where required in connection with new or materially changed technologies or processing activities.