Privacy Policy

1. Data controller

The data controller responsible for your personal data is:

Featherstone Safety Ltd
14/2E Docklands Business Centre, 10–16 Tiller Road, London, E14 8PX
Email: thomas@featherstonesafetyhub.co.uk
Phone: +44 1865 570810

ICO registration number: 00013953517

Featherstone Safety Ltd is registered in England and Wales under company number 17410006. Featherstone Safety is its trading name and Featherstone Safety Hub is its product name.

2. What data we collect and why

2.1 Contact and enquiry data

When you contact us via a form, email or telephone, we collect your name, email address, phone number, business name and the content of your message. We use this to respond to your enquiry and to provide information about relevant services.

Lawful basis: legitimate interests (responding to a B2B business enquiry) and, where relevant, pre-contractual steps.

2.2 Quotation and proposal data

When we prepare a quotation or proposal, we collect information about your business, size, sector, and health and safety needs. We use this to provide a relevant proposal.

Lawful basis: pre-contractual steps and legitimate interests.

2.3 Client and service delivery data

When you engage us for services, we collect and process information necessary to deliver those services, including employee information relevant to health and safety assessments, workplace information, and incident or risk data. We collect only what is necessary to deliver the agreed service.

Lawful basis: performance of a contract.

2.4 Featherstone Safety Hub platform data

When you use the Featherstone Safety Hub platform, we process data you enter into the platform, including risk assessments, COSHH assessments, incident records, training records, employee details, and compliance evidence. You remain the data controller for all personal data you upload. We act as a data processor in relation to that data.

Lawful basis: performance of a contract (the subscription agreement).

2.5 Marketing and outreach

We carry out business-to-business (B2B) marketing and outreach. We may contact people in their professional capacity at organisations we believe have a legitimate interest in workplace health and safety software and services, including organisations we have not previously dealt with. For this we process business contact details such as name, job title, employer, business email address and business telephone number.

Where we obtain this data: directly from you (for example when you make an enquiry); from publicly available business sources such as company websites and professional networking sites; and from reputable B2B contact-data providers (for example Apollo). We keep the volume and frequency of outreach proportionate and relevant.

We direct this outreach at corporate contacts (for example limited companies, limited liability partnerships and public bodies). We do not send unsolicited marketing to individual subscribers, such as sole traders, ordinary partnerships or private individuals, unless they have consented or already have a relationship with us.

Lawful basis: legitimate interests (promoting our B2B products and services to relevant businesses). We have carried out a balancing assessment, and you have the right to object at any time (see section 8).

You can opt out of future marketing at any time by using the unsubscribe link in any marketing email, by replying “unsubscribe”, or by contacting us at thomas@featherstonesafetyhub.co.uk. We action opt-outs promptly and keep a suppression record so you are not contacted again.

2.6 Website usage data

When you visit this website, our hosting infrastructure may collect standard server log data including your IP address, browser type, operating system, referring URL, and pages visited. This is used for security and operational purposes only.

The Featherstone Safety Hub platform does not currently use analytics or marketing cookies. On the featherstonesafety.co.uk blog and marketing site, Wix manages cookie consent. You can manage your preferences via the cookie banner or settings on that site.

Lawful basis: legitimate interests (website security and operation) for server logs.

3. Cookies

We use cookies and similar technologies to operate this platform. Strictly necessary cookies are required for the platform to function. Non-essential cookies (such as analytics) are only placed with your consent.

For full details, see our Cookie Policy.

4. Who we share data with

We do not sell your personal data. We may share data with the following categories of recipients only where necessary to deliver our services or meet legal obligations:

• IT and hosting providers: Vercel (hosting), Supabase (database and authentication), GitHub (source code hosting and automated daily database backup)
• Payment providers: Stripe (payment processing, card details are handled by Stripe directly and are not stored by us)
• Email and communication providers: Resend (transactional email sent by Featherstone Safety Hub — invitations, alerts and compliance digests) and Microsoft 365 (business correspondence)
• Professional advisers: accountants, insurers, legal advisers where required
• Subcontractors: where we engage suitably qualified third-party specialists to assist with service delivery, subject to confidentiality obligations. Subcontractors are used on a case-by-case basis and are required to handle any data appropriately.
• Regulators and enforcement bodies: where required by law

5. International data transfers

Our database (Supabase) runs on AWS eu-west-1 (Ireland, EEA), and our hosting provider (Vercel) executes all server-side processing in its Dublin (dub1) region, the same EEA region. Our payment provider (Stripe) and business email provider (Microsoft 365) operate within the UK/EEA for the relevant processing. Transactional email sent by Featherstone Safety Hub is handled by Resend, which is US-incorporated; where that processing occurs outside the UK/EEA it is covered by Standard Contractual Clauses and the UK International Data Transfer Addendum in Resend’s data processing terms. We are confirming the processing region for our account and will state it here once verified. Our daily database backup is retained for 30 days by GitHub under the Standard Contractual Clauses and UK International Data Transfer Addendum in its Data Protection Agreement. If this changes we will update this policy and, where required, implement appropriate safeguards.

6. How long we keep data

• Enquiry and contact data: retained for up to 2 years from the date of last contact, unless a contract follows.
• Client and contract data: retained for 6 years from the end of the contract, in line with standard business limitation periods.
• Featherstone Safety Hub platform data: retained for 30 days following cancellation of a subscription, after which it may be permanently deleted. Export is available on request before deletion.
• Marketing data: retained until you opt out or until we have no reasonable basis for further contact. After you opt out, we keep a minimal suppression record (such as your email address) so that we do not contact you again.
• Financial and billing records: retained for 6 years to meet legal and accounting obligations.

7. Security

We take reasonable technical and organisational measures to protect personal data from unauthorised access, loss or disclosure. The Featherstone Safety Hub platform uses encryption in transit (HTTPS/TLS) and encryption at rest. Access to personal data is restricted to those who need it to deliver the service.

No transmission over the internet is completely secure. You share data with us at your own risk and we cannot guarantee absolute security.

8. Your rights

Under UK GDPR you have the following rights in relation to your personal data:

• Access: request a copy of the data we hold about you.
• Rectification: ask us to correct inaccurate or incomplete data.
• Erasure: ask us to delete your data where we no longer have a lawful basis to hold it.
• Restriction: ask us to restrict processing in certain circumstances.
• Portability: receive your data in a structured, machine-readable format where processing is based on consent or contract.
• Objection: object to processing based on legitimate interests, including direct marketing.
• Withdraw consent: where processing is based on consent, withdraw it at any time without affecting earlier processing.

To exercise any of these rights, contact us at thomas@featherstonesafetyhub.co.uk. We will respond within one month in most cases.

Marketing opt-out: you can opt out of marketing communications at any time by replying “unsubscribe” to any communication or by emailing us. We will action opt-outs promptly.

9. Complaints

If you believe we have not handled your data correctly, please contact us in the first instance at thomas@featherstonesafetyhub.co.uk.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

ico.org.uk/make-a-complaint
ICO helpline: 0303 123 1113

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified by a notice on the platform or by email to registered users. The date at the top of this page shows when the policy was last updated.

11. Contact

Featherstone Safety Ltd
Email: thomas@featherstonesafetyhub.co.uk
Phone: +44 1865 570810