Privacy Policy

This Privacy Notice for SafetyDocs Ltd ("we", "us", or "our") describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

• Visit our website at https://safetydocs.org or any website of ours that links to this Privacy Notice
• Download and use our mobile application (SafetyDocs), or any other application of ours that links to this Privacy Notice
• Use Safety Documentation for Event Teams — SafetyDocs is a digital safety documentation and compliance platform designed for event organisers, venues, and contractors. It enables users to create, manage, and share live safety documents (such as risk assessments, safety plans, and incident reports) through a secure, cloud-based system, with real-time document syncing, role-based access controls, audit trails, and compliance workflows
• Engage with us in other related ways, including any marketing or events

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at info@safetydocs.org.

1. What Information Do We Collect?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. It may include:

• Names
• Phone numbers
• Email addresses
• Profile photo

Sensitive Information. We do not process sensitive information.

Payment Data. We may collect data necessary to process your payment if you choose to make purchases, such as your payment instrument number and the security code associated with it. All payment data is handled and stored by Stripe — see their privacy notice.

Social Media Login Data. We may provide you with the option to register using your existing social media account details, like Facebook, X, or other accounts. If you register this way, we collect certain profile information from the social media provider (see "How Do We Handle Your Social Logins?" below).

Application Data. If you use our application(s) and grant access or permission, we may collect:

• Geolocation Information — location-based information from your mobile device, continuously or while using the app, to provide location-based services. Adjustable in your device settings.
• Mobile Device Data — device ID, model, manufacturer, operating system, version, system configuration, application identification numbers, browser type/version, hardware model, ISP/mobile carrier, and IP address; plus phone network, platform, device type and app features accessed.
• Push Notifications — regarding your account or app features; can be turned off in device settings.

This information is primarily needed to maintain the security and operation of our application(s), for troubleshooting, and for internal analytics and reporting.

All personal information you provide to us must be true, complete, and accurate, and you must notify us of any changes.

Information automatically collected

In Short: Some information — such as your IP address and/or browser and device characteristics — is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services, including device and usage information such as IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, usage information, and other technical information. This is primarily needed to maintain the security and operation of our Services and for internal analytics and reporting.

We also collect information through cookies and similar technologies.

• Log and Usage Data — service-related, diagnostic, usage, and performance information recorded in log files, including IP address, device information, browser type and settings, activity within the Services, and device event information such as crash reports and hardware settings.
• Device Data — information about the computer, phone, tablet, or other device used to access the Services, including IP address, device/application identification numbers, location, browser type, hardware model, ISP/mobile carrier, operating system, and system configuration.
• Location Data — precise or imprecise device location, which can be opted out of via device settings, though certain features may then be unavailable.

Google API. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

2. How Do We Process Your Information?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process it for other purposes only with your prior explicit consent.

• To facilitate account creation and authentication and manage user accounts
• To deliver and facilitate delivery of services to the user
• To respond to user inquiries and offer support
• To send administrative information to you
• To fulfil and manage your orders, payments, returns, and exchanges
• To send you marketing and promotional communications (with opt-out available)
• To save or protect an individual's vital interest

Security Identification. Your device location is recorded at scan time alongside existing identification, photograph, and shift records. Captured under UK GDPR legitimate interests for safety, audit, and incident response. To request deletion or ask a data-protection question, contact info@safetydocs.org.

Barcode badge generation. If you volunteer or work at our events, you'll be issued a personal QR code. When you scan to check in/out of a shift via SafetyDocs Shifts, we record the time of scan, post and shift assigned, IP address/user-agent of the device used, and — where your browser permits and you grant permission — the device's geolocation coordinates and accuracy. Held under UK GDPR Article 6(1)(f) for event safety, access control, and audit, retained alongside your shift records, and referenced if an incident is investigated in line with the Terrorism (Protection of Premises) Act 2025 (Martyn's Law) and duties to the venue and insurers. You may decline location permission at scan time and check-in still proceeds. To request deletion/correction, contact info@safetydocs.org.

Event check in/out. We process your name, contact details, role, shift records, and photograph for identification, badge production, access control, and event administration. SafetyDocs Shifts also records the time of each scan and, where permitted, device location at check-in/check-out, to evidence safety arrangements to the venue and insurers, support post-event incident review, and meet duties under Martyn's Law. Your browser will request location permission at first scan; you may decline and check-in still proceeds. To request deletion after the event, contact info@safetydocs.org. Records may be retained where required for legal or regulatory obligations (e.g. health and safety or incident reporting).

3. What Legal Bases Do We Rely On To Process Your Information?

In Short: We only process your personal information when we believe it is necessary and have a valid legal basis, such as consent, legal compliance, contractual necessity, protecting your rights, or legitimate business interests.

If you are located in the EU or UK

Under the GDPR / UK GDPR, we may rely on:

• Consent — which you can withdraw at any time
• Performance of a Contract — to fulfil our contractual obligations to you
• Legitimate Interests — e.g. sending offers/discounts, security verification prior to shift, badge creation, sign-in process
• Legal Obligations — e.g. cooperating with law enforcement or regulators
• Vital Interests — protecting the vital interests of you or a third party

We are generally the "data controller" under European data protection laws for the personal information described here. This notice does not apply to information we process as a "data processor" on behalf of our customers — in those cases the customer is the data controller.

If you are located in Canada

We may process your information with express or implied consent, which can be withdrawn at any time. In certain exceptional cases permitted by law we may process information without consent — for example for fraud investigation/prevention, business transactions, insurance claims, identifying injured/deceased persons, suspected financial abuse, investigating breach of an agreement or contravention of law, complying with a subpoena/warrant/court order, information produced in the course of employment/business/profession, journalistic/artistic/literary purposes, or publicly available information. De-identified information may be disclosed for approved research or statistics projects subject to ethics oversight.

4. When And With Whom Do We Share Your Personal Information?

In Short: We may share information in specific situations and with specific third parties.

• Business Transfers — in connection with a merger, sale of assets, financing, or acquisition
• Google Maps Platform APIs — e.g. Google Maps API, Places API, which use GPS, Wi-Fi, and cell towers to estimate location (GPS accurate to about 20 meters; Wi-Fi/cell towers improve accuracy indoors)

5. Do We Use Cookies And Other Tracking Technologies?

In Short: We may use cookies and similar tracking technologies to collect and store your information.

We use cookies and similar technologies (web beacons, pixels) to maintain security, prevent crashes, fix bugs, save preferences, and support basic site functions. We also permit third parties and service providers to use tracking technologies for analytics and advertising, including tailoring ads to your interests and sending abandoned-cart reminders.

Where these technologies are deemed a "sale"/"sharing" under applicable US state laws, you can opt out as described under "Do United States Residents Have Specific Privacy Rights?" below. See our Cookie Notice for more detail.

6. Do We Offer Artificial Intelligence-Based Products?

In Short: We offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies.

We provide AI Products through third-party AI Service Providers, including OpenAI. Your input, output, and personal information will be shared with and processed by these providers to enable use of our AI Products. You must not use the AI Products in any way that violates the terms or policies of any AI Service Provider.

Our AI Products are designed for: AI document generation and AI research. All personal information processed using our AI Products is handled in line with this Privacy Notice and our agreements with third parties.

7. How Do We Handle Your Social Logins?

In Short: If you register or log in using a social media account, we may access certain information about you.

Where you register using a third-party social account (e.g. Facebook or X), we receive certain profile information from that provider — typically name, email address, friends list, and profile picture, plus other information you've made public. We use this only for purposes described in this notice. We do not control, and are not responsible for, other uses of your information by the social media provider — review their privacy notice for details.

8. How Long Do We Keep Your Information?

In Short: We keep your information for as long as necessary to fulfil the purposes outlined in this Privacy Notice, unless a longer period is required by law.

When there is no ongoing legitimate business need to process your information, we delete or anonymise it, or, if that isn't possible (e.g. backup archives), we securely store and isolate it from further processing until deletion is possible.

9. How Do We Keep Your Information Safe?

In Short: We aim to protect your personal information through organisational and technical security measures.

Despite our safeguards, no electronic transmission or storage technology can be guaranteed 100% secure. Transmission of information to and from our Services is at your own risk — access the Services only within a secure environment.

10. Do We Collect Information From Minors?

In Short: We do not knowingly collect data from or market to children under 18 (or the equivalent age in your jurisdiction).

By using the Services you represent that you are at least 18 (or the applicable age), or a parent/guardian consenting to a minor dependent's use. If we learn that data from a minor has been collected, we will deactivate the account and delete such data. Contact info@safetydocs.org if you become aware of any such data.

11. What Are Your Privacy Rights?

In Short: Depending on your state or region of residence (e.g. EEA, UK, Switzerland, Canada, or certain US states), you have rights over your personal information, and may review, change, or terminate your account at any time.

In regions such as the EEA, UK, Switzerland, and Canada, rights may include access, rectification, erasure, restriction of processing, data portability, and objection to automated decision-making. Where an automated decision produces legal or similarly significant effects, we will explain the main factors and offer a way to request human review. Contact us using the details in "How Can You Contact Us About This Notice?" to exercise these rights.

EEA/UK residents who believe we are unlawfully processing their data may complain to their Member State or UK data protection authority. Switzerland residents may contact the Federal Data Protection and Information Commissioner.

Withdrawing consent: where we rely on consent, you may withdraw it at any time by contacting us — this won't affect the lawfulness of prior processing.

Opting out of marketing: unsubscribe via the link in our emails, reply "STOP"/"UNSUBSCRIBE" to SMS, or contact us. We may still send necessary service-related messages.

No mobile information is shared with third parties/affiliates for marketing purposes. Sharing with subcontractors for support services is permitted. Text messaging originator opt-in data and consent is never shared with third parties.

Account Information

To review or change your account information, or terminate your account, log in to your account settings and update it, or click Delete Account. We will deactivate/delete your account, though we may retain some information to prevent fraud, troubleshoot, assist investigations, or comply with legal requirements.

You can also manage cookies via your browser settings, though this may affect certain features.

12. Controls For Do-Not-Track Features

Since no uniform standard for Do-Not-Track (DNT) signals has been finalised, we do not currently respond to DNT browser signals. If a standard is adopted that we must follow, we will update this notice accordingly.

13. Do United States Residents Have Specific Privacy Rights?

In Short: Residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia may have rights to access, correct, obtain a copy of, or delete their personal information, and to withdraw consent, subject to limitations under applicable law.

Categories of Personal Information We Collect

The table below shows categories of personal information collected in the past 12 months (illustrative examples only — see "What Information Do We Collect?" for the full inventory):

We may also collect other personal information when you interact with us in person, online, by phone, or mail — e.g. customer support, surveys/contests, and Service delivery/inquiries.

Will your information be shared with anyone else? We may disclose information to service providers under written contract (see "When And With Whom Do We Share Your Personal Information?"). We may use your information for internal business purposes such as technological research and demonstration — this is not considered "selling." We have not disclosed, sold, or shared personal information to third parties for a business or commercial purpose in the preceding 12 months, and will not do so in the future.

Your Rights

• Right to know whether we are processing your personal data
• Right to access your personal data
• Right to correct inaccuracies
• Right to request deletion
• Right to obtain a copy of data previously shared with us
• Right to non-discrimination for exercising your rights
• Right to opt out of targeted advertising, sale/sharing, or profiling with legal/significant effects

Depending on your state, you may also have rights to: access categories of data processed (e.g. Minnesota); obtain a list of categories of third parties data was disclosed to (e.g. California, Delaware, Maryland); obtain a list of specific third parties (e.g. Minnesota, Oregon); obtain a list of third parties data was sold to (e.g. Connecticut); review/correct profiling (e.g. Connecticut, Minnesota); limit use/disclosure of sensitive data (e.g. California); and opt out of voice/facial recognition data collection (e.g. Florida).

How to Exercise Your Rights

Contact us by submitting a data subject access request or by emailing info@safetydocs.org. You may designate an authorised agent under certain state laws; we may require proof of valid authorisation.

Request Verification

We will verify your identity using only the information provided in your request. If we cannot verify identity from information we already hold, we may request additional information for verification, security, or fraud-prevention purposes. Agent-submitted requests require written, signed permission from you.

Appeals

If we decline to act on your request, you may appeal by emailing info@safetydocs.org. We will inform you in writing of the outcome and reasoning. If denied, you may complain to your state attorney general.

14. Do We Make Updates To This Notice?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

Updates are indicated by a revised "Last updated" date at the top. Material changes may be notified via a prominent notice or direct notification. Please review this notice frequently.

15. How Can You Contact Us About This Notice?

Email us at info@safetydocs.org or write to us at:

UK residents: we are the "data controller" of your personal information. Our UK representative is David Franklin — contact by email at david@safetydocs.org, via www.safetydocs.org, by phone at +447859775480, or by post to:

16. How Can You Review, Update, Or Delete The Data We Collect From You?

Based on applicable laws in your country or US state of residence, you may have the right to request access to, details about, correction of, or deletion of your personal information, and to withdraw consent, subject to legal limitations. To request this, please fill out and submit a data subject access request.

---

© 2026 SafetyDocs Ltd. All rights reserved.