Privacy policy

This notice applies to three groups of people. Different sections apply depending on how you interact with us:

• Website visitors — anyone who visits censiary.co.uk or our other domains.
• App users — individuals who use Censiary Lifting Protect or another Censiary app, usually as an employee or contractor of one of our customers.
• Business contacts — people at our customers, prospective customers, suppliers and professional advisers.

When your employer or site operator subscribes to a Censiary app, the equipment registers, inspection records, photographs and other content entered into the app are that organisation's data. For that data your employer (our customer) is the controller and Censiary is a processor acting on its instructions, under our Data Processing Addendum (CEN-INT-LEG-010). If you have questions about how your employer uses that data, or want to exercise your rights over it, please contact your employer in the first instance.

Censiary is the controller for: your account details; device, crash and analytics data we collect to run and improve the apps; website data; and business contact data. This notice describes that processing.

4.1 Website visitors

• Technical data: IP address, browser type and version, device type, pages visited, referring site, date and time of visit, and essential cookie identifiers.
• Contact form / enquiry data: name, company, email, telephone number and the content of your message, if you contact us.
• Analytics data: only if you consent to analytics cookies (see section 13).

4.2 App users (Censiary Lifting Protect and other Censiary apps)

• Account details: name, work email address, employer/site, job role, and your login credentials (passwords are stored only in hashed form).
• Records you create: equipment entries, inspection records, notes, sign-offs and timestamps. These are attributed to your user account so that your employer can see who recorded what.
• Photographs: images of equipment and tags/labels that you upload. Please avoid including people's faces or unnecessary personal information in photographs.
• Device identifiers: device model, operating system version, app version, push notification token and an installation identifier.
• Crash and analytics data: crash reports, error logs and basic usage events (for example which screens are used and how often) used to diagnose faults and improve the app.
• Location: only if you enable location services for the app — used to tag a record with the site location. The app works without location access.
• Support data: the content of support requests you send us and any diagnostic files you attach.

4.3 Customers, prospects and suppliers (business contacts)

• Name, job title, employer, business email, business telephone number and postal address.
• Correspondence, meeting notes, proposals, contracts and Order Forms.
• Billing and payment information (for customers and suppliers) — invoices, purchase order numbers and bank details for supplier payments.
• Publicly available professional information (for example from your company website or LinkedIn) used to understand your organisation.

We do not collect special category data (for example health, ethnicity or trade union membership) and ask that you do not enter it into the apps.

Where we rely on legitimate interests we have considered the balance between our interests and your rights. You can ask us for details of that assessment or object (see section 10).

We do not use your personal data for automated decision-making that produces legal or similarly significant effects on you.

We share personal data only where necessary and with appropriate contractual protections. Our current service providers and other recipients are:

We do not sell personal data and we do not share it with third parties for their own marketing.

We aim to keep personal data in the United Kingdom or the European Economic Area. Some of our service providers (for example Apple, Xero and their sub-processors) may process data in the United States or other countries. Where personal data leaves the UK we make sure one of the following safeguards applies:

• the destination country is covered by UK adequacy regulations (this includes the EEA);
• the transfer is covered by the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment; or
• the transfer is to a US organisation certified under the UK Extension to the EU–US Data Privacy Framework.

You can ask us for more information about the safeguards used by contacting enquirys@censiary.co.uk.

Backups are retained for a further limited period and then overwritten in the normal cycle.

We apply technical and organisational measures appropriate to the risk, including: encryption of data in transit (TLS) and at rest; access controls with row-level security so that each customer can only see its own data; multi-factor authentication on all administrative accounts; least-privilege access for staff and contractors; regular backups; logging and monitoring; and a documented incident response process. Our Information Security and Cyber Policy (CEN-INT-LEG-012) and the technical measures in Annex 2 of our Data Processing Addendum describe these in more detail. No system is completely secure; if we become aware of a personal data breach affecting you we will act in accordance with our legal obligations, including notifying the ICO within 72 hours where required. See our Security and data page for a plain-English summary of these measures.

Under UK GDPR you have the following rights, subject to certain conditions and exemptions:

• Access — to obtain a copy of the personal data we hold about you.
• Rectification — to have inaccurate or incomplete data corrected.
• Erasure — to have your data deleted in certain circumstances.
• Restriction — to ask us to limit how we use your data in certain circumstances.
• Portability — to receive data you provided to us in a structured, machine-readable format, where processing is based on contract or consent.
• Objection — to object to processing based on legitimate interests, and to object at any time to direct marketing.
• Withdraw consent — where we rely on consent, you can withdraw it at any time without affecting the lawfulness of earlier processing.

To exercise any of these rights, email enquirys@censiary.co.uk or write to our registered office. We will respond within one month (which may be extended by two further months for complex requests). We may need to verify your identity. There is normally no fee.

If the data concerned is held in an app on behalf of your employer, we will refer your request to your employer as controller and assist them in responding.

Complaints. If you are unhappy with how we have handled your data, please contact us first so we can try to resolve it. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113, or Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Our website, apps and services are intended for use by adults in a business context. They are not directed at, and we do not knowingly collect personal data from, anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.

To create an app account you must provide a name and work email address; without them we cannot provide the service. Providing location access and enabling crash reporting are optional and can be controlled in your device settings. Providing business contact data is necessary for us to contract with you or your organisation.

Our website uses a small number of cookies and similar technologies:

We do not use advertising or cross-site tracking cookies. You can also block cookies through your browser settings, although some parts of the site may not then work. The apps themselves do not use cookies but do use device identifiers as described in section 4.2.

We may update this notice from time to time. The version number and date at the top show when it was last changed. Material changes will be notified by email to customer contacts and by a notice in the apps or on the website. Earlier versions are available on request.

This table summarises the data collected by the iOS app in the categories used by Apple's App Privacy questionnaire ("privacy nutrition label"). "Linked to you" means the data is associated with your account or identity. None of the data is used for tracking across other companies' apps or websites.