Privacy notice

1. Who is responsible

SAFE SYSTEM RISK MANAGEMENT LTD, trading as Safe System Risk Management, is the controller of the personal information described in this notice. Company number: 13700895.

Contact the Director at info@safesystem.co.uk, telephone 07774 772575, or write to Lower Woodfield, Llangarron, Ross-on-Wye, Herefordshire HR9 6PN.

2. The information we use

We use business contact names, roles, organisations, email addresses, telephone numbers, premises details, enquiries, quotations, correspondence and information necessary to provide and administer our services.

Where requested, we use delegate names to produce training certificates. Supporting documents may contain staff names, such as a building manager's name on a maintenance record. We do not intentionally collect special category information, such as health information, for our routine services. Please do not send sensitive occupant information with an initial enquiry.

Technical connection information is processed when you visit the website, including the requested page, time, browser and device information, referring page and IP-related information.

We normally receive information from you, your organisation, its representatives or documents supplied for the commission. These documents may originally have been prepared by contractors or other relevant parties.

3. Why we use information

We rely on legitimate interests to respond to organisational enquiries, agree and deliver business commissions, communicate with client representatives, prepare requested certificates and keep necessary evidence of our work. These interests are running a professional consultancy, providing the requested services and maintaining an accurate record, balanced against individuals' rights and reasonable expectations.

We rely on legal obligations for required accounting and tax records and legally required disclosures.

We rely on legitimate interests for proportionate website security, handling service concerns and establishing, exercising or defending legal claims. We use legal obligation where a particular complaint-handling or other statutory duty requires processing.

If an individual contracts with us personally in a business capacity, processing necessary to take requested pre-contract steps or perform that contract may instead rely on contractual necessity.

4. Enquiries and marketing

The enquiry tool prepares an email in your own email application. You must send it to complete the enquiry. The website does not itself submit the entered details to a server. If you use the copy function, the prepared text is placed on your device's clipboard.

We currently respond to enquiries and communicate about our services and commissions. Making an enquiry does not subscribe you to a mailing list.

Before introducing direct marketing, we will assess the recipient type, source of contact details, lawful basis and applicable electronic-marketing rules, provide relevant privacy information and a straightforward way to object. You can ask us not to contact you for marketing at any time.

5. Storage and access

Our working client records are held on a password-protected business computer accessible only to the Director. Business email is provided through IONOS and is also processed within its email service. We use IONOS for website hosting.

We use proportionate access controls and secure premises arrangements. No separate cloud backup of client working files is currently operating. This notice will be updated if that arrangement changes.

6. Service providers and disclosures

IONOS processes website and email information as needed to provide those services. We may disclose necessary information to our insurer, broker, legal advisers or authorities where justified for a claim, a legal obligation or another lawful purpose. We do not routinely share client files with external accountants or subcontractors at present.

We use ChatGPT Pro as a support tool. We do not intentionally enter personal names or client photographs into it. Site locations may be used; where a location identifies a person, it can be personal information. We minimise identifying detail, use the tool only where necessary and appropriate, and do not use it to make solely automated decisions with legal or similarly significant effects about individuals. The account setting permitting content to improve models is switched off. This does not mean that the provider does not process or retain submitted content.

We do not sell contact lists or enrol enquirers automatically in marketing.

7. Processing outside the UK

The working files on our business computer are held in the UK. Using an online service does not guarantee that all associated processing remains in the UK.

IONOS provides information about its processing arrangements through its data processing terms and product documentation. For standard web hosting it states that visitor data is not transferred outside the EU.

OpenAI's Europe privacy policy states that its services process information in the United States and other countries where its providers operate. It identifies adequacy arrangements and standard contractual clauses with the UK Addendum as transfer mechanisms, as applicable. We therefore minimise what we submit and avoid entering personal names and client photographs. You can ask us for further information about relevant provider arrangements and safeguards.

Provider information: https://www.ionos.co.uk/terms-gtc/privacy-policy/ and https://openai.com/policies/eu-privacy-policy/.

8. Retention

Enquiries and quotations that do not lead to work: normally 12 months after the last substantive contact.

Core commission records, including agreed scope, issued reports, material assessment notes, relevant photographs, certificates, advice and significant correspondence: normally 15 years after completion of the commission, subject to periodic review of necessity.

Invoices and accounting records: six years after the end of the relevant company financial year, or longer where tax rules require.

Complaints: normally six years after closure. Material needed to explain a professional commission may remain with its core record for the applicable longer period.

Routine administrative emails, duplicates and unnecessary working copies are removed when no longer needed and checked during an annual review. IONOS's standard web-hosting documentation specifies an eight-week retention period for visitor data.

We suspend routine deletion of relevant records where a claim, potential claim, investigation, legal obligation or unresolved complaint justifies it. We keep only the information necessary for the relevant purpose and review any extended retention.

9. Your rights

Depending on the circumstances, you may request access, correction, erasure, restriction or portability of qualifying personal information. You may object to processing based on legitimate interests on grounds relating to your situation. You have an absolute right to object to direct marketing.

If we use consent for a particular activity, you may withdraw it without affecting the lawfulness of earlier processing. We will explain that activity when seeking consent.

Contact us using the details above. Rights are subject to applicable legal conditions; we may need proportionate information to verify identity. Information requested for an enquiry is voluntary, but without necessary contact or project information we may be unable to respond or provide services. We identify information required by a contract or legal obligation where relevant.

10. Complaints and changes

Please contact us if you are concerned about our handling of information. We acknowledge data protection complaints within 30 days, investigate appropriately, provide appropriate updates and explain the outcome without undue delay. The 30-day period concerns acknowledgement, not a fixed resolution deadline.

You can also complain to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/ or telephone 0303 123 1113.

We update this notice when our activities or arrangements materially change.