Customer terms

These terms form the contract between your business (“you”) and Patrick Mackin, trading as Safe Cert (“we” or “us”) for your use of Safe Cert. You accept them when you start using Safe Cert after we’ve sent you these terms, for example with your welcome email. Safe Cert is for businesses only, not consumers.

1. The service

Safe Cert lets you store the certificates for your vehicles and machines and show the current ones to anyone who scans a machine’s QR code. We may improve and change the service. We’ll tell you in advance about any change that significantly reduces what it does.

We aim to keep Safe Cert available at all times, but we can’t guarantee it will always be uninterrupted or free of errors, and we may need to take it offline for maintenance.

2. Your account and users

You decide who in your business can use Safe Cert. You’re responsible for what your users do, for keeping their sign-in details secure, and for telling us promptly if you think someone has accessed your account without permission.

3. Your certificates and content

• You’re responsible for what you upload: that certificates and reports are genuine, accurate and current, and that expiry and due dates are right. We don’t check or verify them.
• A machine’s current certificates can be seen by anyone who has its QR code or link. Don’t upload anything you don’t want those people to see. Archived certificates are visible only to your users.
• Safe Cert doesn’t carry out examinations or inspections, and doesn’t give legal or safety advice. You remain responsible for complying with LOLER, PUWER and any other law that applies to you, including keeping reports for the periods the law requires.
• You own your content. You give us permission to store, copy and display it only as needed to provide Safe Cert to you.
• You mustn’t upload anything unlawful or harmful, such as malware; try to access other customers’ data; try to disrupt or overload the service; or resell it without our agreement.

4. Fees and payment

The fees and billing period are those set out in your order or quote. We’ll invoice you, and invoices are due within 30 days. Fees don’t include VAT, which we’ll add where it applies.

If an invoice is overdue, we’ll remind you, and we may suspend your access if it’s still unpaid 14 days after that reminder. We can change our fees by giving you 30 days’ notice, and you can end the contract before the change takes effect.

5. Starting and ending the contract

The contract starts when you first use Safe Cert after receiving these terms, and continues until either of us ends it by giving the other 30 days’ notice by email.

Either of us can end the contract straight away by email if the other seriously breaks these terms and doesn’t put it right within 14 days of being asked to. We can also suspend access straight away if that’s needed to protect the service or other customers.

When the contract ends, your access stops. You can ask us for copies of your certificates before it ends or within 30 days afterwards. We delete your content within 30 days of the contract ending, unless you’ve asked for copies or the law requires us to keep it. If you need to keep reports for legal record-keeping, download or request copies before then.

6. Liability

• Nothing in these terms limits liability for death or personal injury caused by negligence, for fraud, or for anything else that can’t be limited by law.
• We aren’t liable for loss of profits, revenue, business or goodwill, or for any indirect or consequential loss.
• We aren’t responsible for the content of certificates you upload, or for decisions made by relying on them.
• Our total liability to you in connection with these terms is limited to the fees you paid us in the 12 months before the event that gave rise to the claim.
• We aren’t liable for delays or failures caused by events beyond our reasonable control.

7. Data protection

For personal information in your content, such as the names of examiners in reports, you’re the controller and we’re your processor. The data processing section below applies to it. For your users’ account details and our security records, we’re the controller, as explained in our privacy notice.

8. Changes to these terms

We may update these terms. We’ll email you at least 30 days before a change that significantly affects you, and if you don’t agree, you can end the contract before the change takes effect.

9. General

• Notices under these terms are given by email: to us at patrickmackin8@hotmail.com, and to you at the email address we hold for your account.
• You can’t transfer this contract without our agreement. We may transfer it to anyone who takes over Safe Cert, and we’ll tell you if we do.
• These terms, with your order or quote, are the whole agreement between us about Safe Cert.
• Nobody other than you and us has any right to enforce these terms.
• If a court decides part of these terms can’t be enforced, the rest still applies.
• These terms are governed by the law of Northern Ireland, and the courts of Northern Ireland have exclusive jurisdiction over any dispute about them.

Data processing

This section is part of these terms. It’s the contract under which we process personal data for you, as required by Article 28 of the UK GDPR (and of the EU GDPR, where that applies to you).

Details of the processing

• Subject matter and purpose: storing and organising your vehicle, machine and certificate information, creating QR codes, and showing current certificates to people who scan them.
• Duration: for as long as you use Safe Cert, and up to 30 days afterwards while we delete your content.
• Types of personal data: names, signatures, job titles, qualifications and contact details that appear in certificates and reports, and any personal information you add to machine or certificate details.
• Whose data: examiners and inspectors named in reports, and your employees, contractors or other people named in the documents you upload.
• You mustn’t upload special category data, such as health information, or information about criminal offences.

Our commitments

• Instructions: we process your personal data only on your documented instructions, which are these terms and your use of Safe Cert, including where it’s stored and transferred, unless the law requires otherwise. In that case we’ll tell you first, unless the law forbids it. We’ll tell you straight away if we think an instruction breaks data protection law.
• Confidentiality: anyone we authorise to process your personal data is committed to keeping it confidential.
• Security: we take the security measures required by Article 32 of the UK GDPR, including those listed below.
• Sub-processors: you authorise us to use the sub-processors listed below. We’ll email you at least 14 days before adding or replacing one, and you can object. If we can’t resolve your objection, you can end the contract straight away and we’ll refund any fees you’ve paid for the period after it ends. We impose the same data protection obligations on our sub-processors by contract, and we remain responsible to you for them.
• People’s rights: we’ll help you respond to requests from people exercising their data protection rights, for example by finding, correcting or deleting their information in your content, and we’ll pass on any such request we receive.
• Breaches and assessments: we’ll help you meet your obligations on security, breach notification, data protection impact assessments and consultation with the ICO, taking into account the information available to us. We’ll tell you about a personal data breach affecting your data without undue delay, and in any case within 48 hours of becoming aware of it, so you can meet the 72-hour deadline for reporting to the ICO.
• End of the service: at your choice, we’ll return copies of your personal data or delete it when the service ends. We delete it within 30 days of the end unless you’ve asked for copies or the law requires us to keep it.
• Information and audits: we’ll give you the information you reasonably need to show that these obligations are met, and allow and contribute to audits, including inspections, by you or an auditor you appoint. Audits need reasonable notice, are at your cost, and can take place once a year, or more often if a regulator requires it or after a breach.
• Transfers: some sub-processors are based in, or may process data in, the United States. Where your personal data is transferred outside the UK, it’s protected by UK adequacy regulations or by the UK International Data Transfer Agreement or Addendum.

Sub-processors

Security measures

• All connections to Safe Cert are encrypted with HTTPS, and our providers encrypt stored data.
• Certificate files are kept in private storage and are only ever served through Safe Cert after access checks. Archived certificates are shown only to your users.
• Each company’s data is kept separate, and users can only see their own company’s account.
• Passwords are stored as one-way hashes, repeated failed sign-ins are temporarily blocked, and sessions can be ended remotely.
• Uploaded files are checked against their declared type and size limits before they’re accepted.
• Files are deleted from storage when the last record using them is deleted, and failed deletions are retried automatically.
• Access to the systems that run Safe Cert is limited to us.