Privacy Policy

1. Who is responsible for your data

The Platform is used by several employer organisations. For your data:

• The data controller is your employer / the organisation that gave you access. It decides why and how your data is processed.
• The data processor is the Platform operator, which runs the software on the controller's behalf.

If you are unsure who your controller is, contact your organisation's administrator. Data-protection contact: Mohamed Abdelsalam - hsqe.catchup@gmail.com.

2. What personal data we process

• Account & identity: username, name, email address, roles.
• Authentication: password (stored only in hashed form, never in plain text), "remember me" token.
• Access & security logs: login date/time, IP address, browser user-agent, and whether login attempts succeeded.
• Document activity: which documents you have read and when, forms you submitted, and submission timestamps.
• Safety-form content: names, roles and working hours of personnel, inspection records, and incident reports.
• Health data (special category): diver medical certificate date on certain forms.
• Signatures: handwritten signatures captured on toolbox-talk, induction and rescue-plan forms.
• Emergency / next-of-kin details on rescue-plan forms.
• Images: photographs attached to inspection and incident forms.

The diver medical-certificate data is special-category (health) data under Article 9 GDPR, processed only where a lawful condition in Article 9(2) applies (see section 4). Handwritten signatures and photographs are personal data but are not treated as Article 9 "biometric" data, because we do not process them by technical means to uniquely identify a person.

Data about other people. Some forms contain information about individuals who did not enter it themselves — for example personnel named by a supervisor, or emergency / next-of-kin contacts. We obtain that data from the person completing the form. Those individuals have the same rights set out in section 8.

Do you have to provide your data? Where account and safety data is needed to give you access, perform your employment contract, or meet a legal health-and-safety obligation, not providing it may mean your organisation cannot grant access or meet its safety duties.

3. Why we process your data

• To create and manage your account and control access.
• To authenticate you and keep the service secure.
• To let your organisation manage HSQE records, including diving and rope-access operations.
• To meet legal record-keeping obligations for workplace health and safety.
• To send operational notifications (document updates, inactivity reminders, incident reports).

4. Our lawful bases

• Account management and providing the service — performance of a contract and/or legitimate interests.
• Security logging and abuse prevention — legitimate interests.
• HSQE and safety records — compliance with a legal obligation and legitimate interests.
• Special-category (health) data — diver medical certificates — Article 9(2)(b)/(h) in the field of employment, health and safety, with a UK Appropriate Policy Document in place.

We do not rely on consent as the basis for processing worker data, and we do not sell personal data or use it for advertising.

5. Who we share data with

Your data is stored on the operator's self-hosted infrastructure in the EU (including the database and self-hosted logging, monitoring and security tooling). We also use these sub-processors:

• Google LLC — Google Drive: stores exported form PDFs and attached photographs.
• Google LLC — Gmail / Google Workspace SMTP: delivers notification emails, which may contain personal data and attachments.

Google may process this data outside the EU/UK (United States) — see section 6.

6. International transfers

Transfers to Google outside the EEA/UK are protected by Google's data-processing terms and Standard Contractual Clauses / the UK International Data Transfer Addendum, with supplementary safeguards. A copy is available on request.

7. How long we keep your data

• Account data — for the duration of your access, then per the controller's retention schedule.
• HSQE / safety records — as long as required by health-and-safety law and the controller's schedule.
• Security & login logs (including IP addresses) — for a defined retention period set by the controller.

8. Your rights

Subject to conditions in the GDPR, you have the right to access, rectify, erase, restrict or object to processing, to data portability, to withdraw consent where processing is based on consent, and to lodge a complaint with a supervisory authority (in the UK, the ICO at ico.org.uk). To exercise these rights, contact your organisation or Mohamed Abdelsalam - hsqe.catchup@gmail.com. We will respond within one month.

9. Automated decision-making

We do not carry out solely automated decision-making that produces legal or similarly significant effects about you.

10. Changes to this policy

We may update this policy from time to time. Material changes will be communicated through the Platform or by your organisation.

11. Contact

Data-protection contact: Mohamed Abdelsalam - hsqe.catchup@gmail.com.

See also our Cookie Policy and Terms of Service.