| Version | [Privacy Policy version] |
|---|---|
| Effective date | [Privacy Policy effective date] |
1 Who we are
| Controller | FD Check Ltd |
|---|---|
| Company number | 14646975 |
| Registered office | 63-65 Heworth Road, York, YO31 0AA |
| Registered in | England and Wales |
| VAT number | VAT registered: VAT number GB 491 2658 70 (registration number 491 2658 70) |
| ICO registration number | [ICO registration number] |
| Contact | alex@fdcheck.com |
[REVIEW: rebuilt section — confirm against latest source document]
When a customer uses the Platform to record inspections, the customer is usually the controller of inspection data and FD Check is usually the processor. Our processing of Customer Personal Data is governed by the Data Processing Agreement. FD Check is controller for its own website, account administration, service communications, business records and other processing it determines.
2 The personal data we collect
- Identity and contact details: name, job title, email address, telephone number, postal address and organisation.
- Business and company details: company name, property details, building contacts, requirements and correspondence.
- Account and login data: username, password credentials in protected form, role, permissions, sign-in and security events.
- Billing and payment data: billing contact, plan, transaction reference and payment status. Payment card details may be handled by a payment provider rather than stored by FD Check.
- Inspection data and photographic evidence: door identifiers, findings, measurements, dates, reports, maintenance details and photographs. Photographs may incidentally capture individuals.
- GPS location and device data: location points, device type, operating system, connectivity, identifiers and technical diagnostics where enabled.
- Client portal users and electronic signatures: name, contact details, approval activity, signature image or signature event, date and audit information. Electronic signatures are not ordinarily biometric data; we do not use them to identify a person by physical characteristics.
- Support and communications: enquiries, support requests, call notes, feedback and records of communications.
- Website usage, cookies and analytics: browser, device, pages and interaction data only where the relevant technology is used with the required consent. See the Cookie Policy.
- AI-assisted report import content: uploaded reports, images, text and related instructions submitted to generate a requested output.
3 How we collect personal data
We collect personal data directly when you contact us, request a quote, create or use an Account, use the Client Portal, submit a form, upload a report or communicate with support. We may receive data from a customer inviting you, from service providers, from a company you represent, or from public and professional sources.
Some information is collected automatically from devices when a customer enables a Platform feature. We will explain the feature and its purpose and will not use covert monitoring.
4 Why we use personal data and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Provide and secure the Platform | Performance of a contract; legitimate interests in operating a secure service. |
| Account administration | Performance of a contract; legitimate interests in managing users and access. |
| Fire door inspections | Contract; the customer's documented instructions; legitimate interests in keeping accurate records. |
| Digital fire door databases | Contract; legitimate interests in maintaining building and inspection history. |
| Job scheduling and attendance | Contract; legitimate interests; consent where required for location collection. |
| Lone-worker safety | Legitimate interests and health and safety obligations; consent where required. |
| Payments and financial records | Contract; legal obligation; legitimate interests in recovering sums due. |
| Customer service | Contract; legitimate interests in responding and improving support. |
| Security, monitoring and improvement | Legitimate interests in preventing abuse, maintaining resilience and improving the service. |
| Service communications | Contract; legitimate interests; legal obligation where applicable. |
| Marketing communications | Consent or legitimate interests where PECR permits it, with an opt-out in every message. |
| Cookies and analytics | Consent, except strictly necessary technologies. |
| AI-assisted report imports | Contract and documented instructions; legitimate interests in delivering the requested output. |
| Legal claims | Legitimate interests in establishing, exercising or defending claims. |
| Legal and regulatory compliance | Legal obligation; legitimate interests in meeting lawful requests. |
Where we rely on legitimate interests, we balance those interests against your rights and expectations. We do not use a purpose that is incompatible with the purpose for which the data was collected without a lawful basis and appropriate information.
Special category data is not intentionally required for the Platform. If it is included incidentally, the customer must avoid unnecessary inclusion and provide any required Article 9 condition. FD Check will process it only on documented instructions and with appropriate safeguards.
5 GPS and device tracking
Where enabled, GPS and device data may be used for job scheduling, evidence of attendance, route or site context, lone-worker safety, fraud prevention and technical support. We do not use covert monitoring.
Customers must inform their own engineers and contractors about tracking, its purposes, the lawful basis and the controls available. Collection must be limited to what is necessary. Users should be able to stop collection outside working hours; the customer must configure and communicate working-time limits appropriately.
6 AI-assisted features
Uploaded content is processed to provide the requested output. AI outputs require checking by a suitably authorised person before being relied on and are not a substitute for professional judgement, inspection or legal advice.
Relevant sub-processors are listed in the DPA or made available at [Sub-processor list location]. FD Check will not use Customer Personal Data to train a third-party general-purpose model without consent or documented instructions.
7 Who we share personal data with
- Service providers and authorised sub-processors who host, secure, support or operate parts of the Platform.
- Customers and Authorised Users where the customer's permissions allow access to inspection records, reports or portal activity.
- Professional advisers, insurers, auditors and prospective transaction parties subject to confidentiality.
- Regulators, courts, law enforcement and public authorities where legally required or reasonably necessary.
We do not sell personal data. We require providers to protect personal data and process it only for authorised purposes.
8 International transfers
Where personal data is transferred outside the UK, we use an applicable legal mechanism such as an adequacy regulation, the UK International Data Transfer Agreement (UK IDTA), the UK Addendum to the EU Standard Contractual Clauses (SCCs), SCCs with UK safeguards, or binding corporate rules (BCRs). We carry out transfer risk assessments where required and apply supplementary safeguards.
Transfer countries, providers and instruments are listed at [International transfer register] and may be updated with appropriate notice.
9 Retention of personal data
| Record | Retention period |
|---|---|
| Enquiries and contact records | [Retention period] |
| Marketing preferences and campaign records | [Retention period] |
| Customer accounts | [Retention period after closure] |
| Trial data | [Trial data retention period] |
| Security and access logs | [Log retention period] |
| Billing and financial records | [Billing retention period] |
| Inspection records | [Inspection record retention period] |
| Golden thread records | [Golden thread retention period] |
| Photographs | [Photograph retention period] |
| GPS data | [GPS retention period] |
| Device data | [Device data retention period] |
| Electronic signatures and audit trails | [E-signature retention period] |
| Support records | [Support record retention period] |
| AI uploads and outputs | [AI upload retention period] |
| Security incident records | [Security record retention period] |
| Backups | [Backup retention period] |
[REVIEW: rebuilt section — confirm against latest source document]
On cancellation, the customer receives a data export window to download everything. Once that window closes, FD Check deletes Customer Personal Data from active systems within [Active deletion period], subject to legal retention, legal holds and backups. The export window is [Export window].
We may keep data longer where necessary for a legal hold, an investigation, a claim, an audit or a legal obligation. We securely delete or anonymise data when it is no longer required.
10 Security
Measures may include access controls and least privilege, authentication, encryption in transit and at rest, secure development, backups, resilience, logging, monitoring, staff confidentiality, supplier due diligence, vulnerability management and incident response. The precise measures are described in the DPA where FD Check acts as processor.
We will assess and respond to personal data breaches. Where FD Check is controller, we will notify the ICO within 72 hours where the law requires it and notify affected people where required. Where FD Check is processor, we will notify the customer without undue delay in accordance with the DPA.
Security contact: [Security contact email].
11 Your rights
Subject to legal conditions, you may ask us for access, rectification, erasure, restriction, objection, portability, withdrawal of consent and information about automated decision-making. You may object to direct marketing at any time.
Where FD Check processes data for a customer, the customer is the controller and you should normally contact that customer first. We will assist as required by the DPA. We aim to respond within one month, although we may extend the period where legally permitted and will tell you why.
You can complain to the Information Commissioner's Office at ico.org.uk or by telephone on [ICO telephone number]. Please contact us first so we can try to resolve the issue.
12 Cookies
We currently set no cookies, analytics, tracking pixels or third-party tracking scripts on this marketing website. Our preference centre stores your choices in local storage. Read the Cookie Policy for the categories, controls and any future changes.
13 Children's data
The Platform and website are for business users and are not directed to children. We do not knowingly collect children's data. If you believe a child has provided personal data, contact alex@fdcheck.com.
14 Changes to this Privacy Policy
We may update this Privacy Policy to reflect changes in law, processing or the Platform. We will publish the new version with its updated date and provide additional notice where required.
Template status: this document is pending review by a qualified solicitor and is not yet final.