Privacy notice

This notice explains what personal information Safe Cert collects, why we collect it, who we share it with, how long we keep it and what your rights are.

Who we are

Safe Cert is run by Patrick Mackin, the controller for the personal information described in this notice. For anything about privacy, email patrickmackin8@hotmail.com.

Information we collect and why

When you ask for an account

The Get started form asks for your company name, your name, your email address and phone number, and anything else you choose to tell us. We use these details to contact you about setting up an account and to answer your questions.

We rely on your request for us to take steps before entering into a contract, and on our legitimate interest in responding to business enquiries. We delete requests 12 months after they’re made. If you become a customer, your account details are covered below.

To stop automated abuse, the form checks your IP address to limit repeated submissions. That check happens in memory: your IP address isn’t stored with your request.

If you have an account

We hold your name, email address, the company you belong to and your role. Your password is stored only as a secure one-way hash, so nobody at Safe Cert can read it. When your account is created or your password is reset, you get a one-time link to choose your password yourself; we store only a scrambled version of the link and delete it once it’s used or expires. We use this information to sign you in and to provide the service to your company.

We rely on our legitimate interest in providing the service your company has signed up for, or on our contract with you if you’re the customer yourself. We keep this information while your account exists and delete it when your account is deleted.

Security records

When you sign in or out, we record the time, your IP address and your browser and device details. We also count failed sign-in attempts against the email address and IP address used, so we can temporarily block password guessing.

We rely on our legitimate interest in keeping accounts secure. We keep sign-in history for 12 months, and it’s deleted with your account. Failed sign-in counts are deleted 24 hours after the last failed attempt, or sooner for your email address when you next sign in successfully.

Machines and certificates your company adds

Companies add details of their vehicles and machines and upload certificates and reports. These documents can contain personal information, such as the name and signature of the person who carried out an examination.

Your company is the controller for this information, and Safe Cert processes it on your company’s behalf. Anyone who scans a machine’s QR code can see its current certificates, which is the purpose of the service. Archived certificates are visible only to the company. The company decides how long to keep this information, and it’s deleted when the company deletes it. If you have a question about information on a machine’s page, contact the company that owns the machine. Our customer terms set out how we process this information for companies.

Website visits

We use Vercel Web Analytics and Speed Insights to understand how the site is used and how quickly it loads. They don’t use cookies. They record the page visited, the referring site, approximate location, browser, operating system, device type and page speed measurements. Visitors are recognised only by a hash of the request, which is discarded after 24 hours, and the results are used only as anonymous totals.

Our hosting provider also processes technical information, such as IP addresses, to deliver the site and protect it from attacks. We rely on our legitimate interest in running a secure and reliable website.

When you email us

We keep your email and our reply for as long as we need them to deal with your enquiry.

Cookies

We only use cookies that are strictly necessary. When you sign in, cookies keep you signed in, for up to 30 days unless you sign out, and protect the sign-in form against forgery. We don’t use advertising or analytics cookies, so we don’t need to ask for your consent.

Who we share information with

We don’t sell personal information or use it for marketing. We use these service providers to run Safe Cert, and they process information only on our instructions:

• Vercel, for website hosting and analytics
• Supabase, for our database, hosted in Ireland
• Cloudflare, for domain name services and file storage
• Microsoft, for email

We may also share information where the law requires it, or to protect our rights or other people’s safety.

International transfers

Some of these providers are based in, or use services in, the United States. Where personal information is transferred outside the UK, we rely on UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework, or on the UK International Data Transfer Agreement or Addendum.

Keeping information secure

The site uses HTTPS encryption, passwords are stored as hashes, certificate files are kept in private storage and only served after access checks, and each company can see only its own account.

Your rights

You have the right to:

• ask for a copy of the personal information we hold about you
• ask us to correct information that’s wrong or incomplete
• ask us to delete your information
• ask us to restrict how we use your information
• object to how we use your information where we rely on legitimate interests
• ask for information you gave us in a reusable format, where we rely on a contract with you

To use any of these rights, email patrickmackin8@hotmail.com. We’ll reply within one month, and there’s normally no charge. If your request is about a machine’s certificates, we may pass it to the company that controls that information.

Complaints

Please contact us first so we can try to put things right. You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.

Changes to this notice

If the way we use personal information changes, we’ll update this page and the date at the top.