Privacy Policy

1. Who we are

SafetyHalo (“SafetyHalo”, “we”, “us” or “our”) provides a building safety risk management platform for UK higher-risk buildings. For the purposes of UK data protection law, SafetyHalo is the data controller for personal data we collect about our website visitors and account users.

SafetyHalo is operated by [legal entity name], a company registered in England and Wales under company number [company number], with its registered office at [registered address]. You can contact us about privacy at [email protected].

2. Controller and processor roles

Where you use SafetyHalo as a customer to manage your buildings, you remain the controller of the building, resident and personnel data you upload, and SafetyHalo acts as your processor, handling that data on your instructions under our customer agreement and a data processing addendum. This policy primarily concerns the personal data for which SafetyHalo is itself the controller, for example account and website data.

3. The personal data we collect

Information you give us

• Account data: name, work email address, job title, employer, and your password (stored only as a secure hash).
• Organisation data: company name and the details needed to set up your tenant and user roles.
• Communications: the content of enquiries, demo requests and support messages you send us.
• Billing data: where applicable, billing contact and payment details (card payments are handled by our payment provider; we do not store full card numbers).

Information we collect automatically

• Usage and device data: IP address, browser and device type, pages viewed, and actions taken, collected to keep the service secure and to improve it.
• Cookies: strictly necessary cookies required to run the application (for example to keep you signed in). See section 8.

4. How and why we use your data

We use personal data to:

• provide, maintain and secure the SafetyHalo platform and website;
• create and administer accounts and authenticate users;
• respond to enquiries, demo requests and support tickets;
• send service and security notices, and (with your consent or where permitted) relevant product updates;
• detect, investigate and prevent fraud, abuse and security incidents;
• comply with our legal and regulatory obligations.

5. Our lawful bases

We rely on the following lawful bases under the UK GDPR:

• Contract: to provide the service to you and your organisation and to manage your account.
• Legitimate interests: to run, secure and improve our business and the platform, where these interests are not overridden by your rights.
• Consent: for optional marketing communications, which you can withdraw at any time.
• Legal obligation: where we must process data to comply with the law.

6. Sharing your data

We do not sell your personal data. We share it only with:

• Service providers (processors) who help us run SafetyHalo, including cloud hosting and database infrastructure, email delivery, error monitoring and analytics, under contracts that require them to protect your data and use it only on our instructions;
• Professional advisers such as lawyers and accountants, where necessary;
• Authorities or third parties where required by law, regulation or legal process, or to protect our rights, users or the public.

A current list of our sub-processors is available on request at [email protected].

7. International transfers

We aim to host and process data in the UK or the European Economic Area. Where personal data is transferred outside the UK, we put in place appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, so your data receives an equivalent level of protection.

8. Cookies

We use only strictly necessary cookies needed to operate the platform and keep you signed in. We do not use advertising cookies. Where we use any optional analytics, we will ask for your consent first. You can control cookies through your browser settings, though disabling necessary cookies may stop parts of the service working.

9. How long we keep data

We keep personal data only for as long as necessary for the purposes set out above. Account data is retained for the life of the account and then deleted or anonymised within a reasonable period, unless we must keep it longer to meet a legal, accounting or regulatory requirement. Customer-uploaded data is retained and deleted in line with the customer agreement.

10. How we protect your data

We use technical and organisational measures appropriate to the risk, including encryption in transit, access controls, tenant isolation, audit logging and regular review of our security practices. No system can be guaranteed completely secure, but we work to protect your data and to notify you and the relevant authority of any breach where the law requires.

11. Your rights

Subject to certain conditions, you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to our processing;
• data portability;
• withdraw consent at any time, where we rely on consent.

To exercise any of these rights, contact [email protected]. We will respond within the timeframes required by law. If you are an end user of a customer’s account, please direct your request to that organisation, and we will assist them as their processor.

12. Children

SafetyHalo is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 18.

13. Changes to this policy

We may update this policy from time to time. We will post the updated version here and change the “last updated” date above. Significant changes will be communicated to account holders.

14. Complaints

If you have concerns about how we handle your data, please contact us first so we can help. You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk or by calling their helpline.