Privacy notice
This notice explains what personal information BattenProof collects, why, who we share it with, and your rights. We've kept it as short and plain as we can.
Who we are
BattenProof is run by Kieron Evans, a sole trader. For the information described here, we are the data controller unless we say otherwise.
- Address: 5 Lowerdale Drive, Pontyclun, CF72 8DY
- Email: hello@battenproof.co.uk
Two kinds of information
Information about you, our customer. Your email address, your account, your payments and how you use BattenProof. We decide how this is used, so we are the controller.
Information you enter about other people. Staff names, roles, training and card details, subcontractor details, and accident records. You decide what goes in and what the documents are for, so you are the controller of that information and we process it on your behalf. Our Terms set out how we look after it.
What we collect
| What | Examples | Why we need it |
|---|---|---|
| Account details | Email address, sign-in records | To let you sign in and to send you your documents and account emails |
| Company profile | Company name, address, company number, trades, director's name and role, signed date | To build your documents |
| Team details | Names, roles, card types and expiry dates, training courses and dates | To fill in your training matrix and remind you before things expire |
| Safety record | RIDDOR figures, short summaries of past incidents, enforcement history | To fill in your accident and enforcement record |
| Project details | Site address, principal contractor, dates, first aid and A&E details, tasks chosen | To build project RAMS |
| Logo | The image you upload | To put your logo on your documents |
| Payment records | What you bought, when and how much | To provide what you paid for and keep tax records |
| Technical information | IP address, browser type, error logs | To keep the service secure and working |
| Messages | Emails you send us | To answer them |
We don't store card numbers. Payments are handled by Stripe, and we only see the last four digits and the card type.
We don't store staff card numbers either, only the card type and expiry date.
Please don't enter health details. Accident summaries should describe what happened and what you changed, not a person's injuries or medical details. If you do enter that kind of information, we'll treat it with extra care, but it isn't needed for your documents.
Our lawful basis
- Contract: to provide the account and documents you've signed up for, and to take payment.
- Legal obligation: to keep financial records for HMRC.
- Legitimate interests: to keep the service secure, fix problems and improve it. We only do this where it doesn't override your rights.
- Consent: if you sign up for product news by email. You can unsubscribe at any time.
For information you enter about your staff and others, you are responsible for having a lawful basis to share it with us. For most firms that's the legal duty to manage health and safety and keep training records.
AI features
Some features use AI. The job describer and PQQ checker send the text you type, and photo reading sends the photo you upload, to Google's Vertex AI service in London. It reads them and suggests which tasks or answers fit. The AI never writes the safety wording in your documents. Google doesn't use this information to train its models. We keep what you send only as long as needed to give you the result and run the service.
Who we share it with
We use a small number of companies to run BattenProof. They act on our instructions and must keep your information secure.
| Company | What for | Where |
|---|---|---|
| Google Cloud and Firebase | Hosting, database, file storage, AI features | London (UK) |
| Google Firebase Authentication | Signing you in by email link | United States |
| Stripe | Taking payments | UK and United States |
| Resend | Sending emails | United States |
Where information goes to the United States, it's protected by the UK Extension to the EU–US Data Privacy Framework, or by the UK's International Data Transfer Addendum.
We never sell your information or share it for advertising. We'd only share it with anyone else if the law requires it.
How long we keep it
- Your account, profile, projects and documents: for as long as you have an account. When you delete your account, they're removed straight away from our live systems, and from our backups within 90 days.
- Sign-in records: removed when your account is deleted. Google may take up to 180 days to clear them from its backups.
- Payment records: 6 years, to meet HMRC rules.
- Technical logs: up to 30 days.
- Emails to us: up to 2 years, unless they're about an ongoing matter.
Your rights
You can ask us to:
- give you a copy of your information (you can also download it yourself from Account → Download all my data);
- correct anything that's wrong;
- delete your information (you can do this yourself from Account → Delete account);
- restrict or stop how we use it, or move it to another service.
Email hello@battenproof.co.uk. We'll reply within one month. If one of your staff asks about their information in your documents, we'll pass the request to you and help you answer it.
If you're unhappy with how we've handled your information, please tell us first. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint or 0303 123 1113.
Cookies and storage
We only use what's needed to keep you signed in and remember your progress. That's stored in your browser. We don't use advertising or tracking cookies. If we ever add analytics, we'll ask first.
Children
BattenProof is for businesses and isn't meant for anyone under 18.
Changes
If we change this notice in a way that matters, we'll email account holders before the change takes effect. The date at the top shows when it was last updated.