Skip to content
Privacy

Privacy Policy

We take your privacy seriously. This policy explains how HSEQ Nova collects, uses and protects your personal data in accordance with the UK GDPR and the Data Protection Act 2018.

Last updated: 28 August 2026

1. Data Controller

HSEQ Nova is the data controller for the processing of personal data within the HSEQ Nova platform and on hseqnova.co.uk.

HSEQ Nova

United Kingdom

hello@hseqnova.co.uk

2. What Personal Data We Collect

2.1 Data you provide directly

  • Account information: Name, email address, job title, role
  • Company information: Company name, registered address, Companies House number, billing address
  • User account: Password (hashed), profile picture, assigned role
  • Health and safety data: Risk assessments, incident reports, training records, COSHH assessments, inspection findings, documents

2.2 Data we collect automatically

  • Log data: IP address, browser type, timestamps, pages visited
  • Cookies: See our Cookie Policy
  • Usage data: Features used, frequency of use, error reports

2.3 Data from third parties

  • Payment provider: Payment status and billing information (via Stripe)
3. Legal Basis for Processing

We process personal data on the following legal bases under UK GDPR Article 6:

Contract performance (Art. 6(1)(b))

Delivering HSEQ Nova services, managing your subscription, providing access to the platform, generating documents and reports.

Legal obligation (Art. 6(1)(c))

Retaining invoices and financial records (Finance Act / HMRC requirements), maintaining health and safety documentation as required by HSWA 1974 and MHSWR 1999, retaining COSHH health records (COSHH Regulations 2002).

Consent (Art. 6(1)(a))

Marketing communications, newsletters, non-essential cookies (analytics and marketing). You may withdraw consent at any time.

Legitimate interest (Art. 6(1)(f))

Improving the service, analysing usage patterns, preventing fraud and misuse, providing customer support, generating anonymised industry statistics and benchmarks (see section 3b below).

3b. Anonymised industry statistics

HSEQ Nova aggregates anonymised health and safety data across customers to produce industry statistics, trend analyses and benchmarks. Data is anonymised using k-anonymity (minimum 5 organisations per group) so that no individual company or person can be identified. Once data is sufficiently anonymised it no longer constitutes personal data (UK GDPR Recital 26).

Purpose: Providing customers with valuable insight into their performance relative to industry averages, and enabling research to improve health and safety outcomes across the UK.

Opt-out: You may opt your organisation out at any time via Settings > Statistics in the HSEQ Nova dashboard.

4. Data Retention
User account (active)While the account remains active
H&S recordsPer statutory requirements (typically 3-40 years)
COSHH health records40 years (COSHH Regulations 2002, reg. 11)
Accident book entries3 years (SS (Claims & Payments) Regs 1979)
Invoices and financial data6 years (HMRC requirements)
Marketing consentUntil consent is withdrawn
Analytics cookiesMaximum 26 months

After the relevant retention period, data is deleted or anonymised unless further retention is required by law.

5. Sharing of Personal Data

We do not sell your personal data to third parties. We share data only with the following:

Data processors (UK GDPR Art. 28)

  • Supabase: Database hosting (EU)
  • Resend: Transactional email delivery
  • Stripe: Payment processing

All processors operate under data processing agreements and comply with UK GDPR. Where data is transferred outside the UK, appropriate safeguards (UK adequacy decisions or UK International Data Transfer Agreements) are in place.

Legal disclosure

We may disclose personal data where required by law, court order or regulatory authority.

6. Your Rights Under the UK GDPR

You have the following rights in relation to your personal data:

1Right of access (Art. 15)

You may request a copy of all personal data we hold about you.

2Right to rectification (Art. 16)

You may ask us to correct inaccurate or incomplete personal data.

3Right to erasure (Art. 17)

You may request deletion of your personal data, subject to statutory retention requirements (e.g. COSHH health records, HMRC invoices).

4Right to restrict processing (Art. 18)

You may ask us to restrict the processing of your personal data in certain circumstances.

5Right to data portability (Art. 20)

You may receive your personal data in a structured, commonly used, machine-readable format.

6Right to object (Art. 21)

You may object to processing based on legitimate interest or for direct marketing purposes.

7Right to withdraw consent (Art. 7)

Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

How to exercise your rights

Send an email to hello@hseqnova.co.uk with the subject line “Data Rights Request”. We will respond within one calendar month.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) if you believe your data has been handled unlawfully.

ico.org.uk

7. Security Measures

We implement appropriate technical and organisational measures to protect your personal data, including:

  • Encryption: TLS for all data in transit; hashed passwords (bcrypt)
  • Access control: Role-based access control (RBAC) and multi-tenant data isolation
  • Audit logging: All critical actions are recorded with a full audit trail
  • Backups: Daily backups of all data
  • Patching: Regular security updates to all systems
8. Changes to This Policy

We may update this privacy policy from time to time. Where we make material changes we will notify you by email or through a notification in the platform. We encourage you to review this page periodically.

Last updated: 28 August 2026

Contact Us

If you have any questions about how we process personal data, or wish to exercise your rights, please contact us:

hello@hseqnova.co.uk