SafetyForce Privacy Notice
Effective date: 14 October 2026
Version: 1.0
1. Introduction
SafetyForce is a UK-focused digital Health & Safety management platform designed to help organisations manage workplace safety, employee training, risk assessments, incident reporting and compliance activities.
Our aim is to make health and safety management simpler, more accessible and more effective for organisations and their employees.
This Privacy Notice explains how personal information is processed through SafetyForce, the purposes of that processing and the rights available under applicable UK data protection legislation.
2. Contact and responsibility
Email: [email protected]
Where participating organisations use SafetyForce to manage their employees' health and safety information, the relevant organisations determine the purposes and lawful bases of that processing and act as data controllers, either individually or under other applicable arrangements.
Where SafetyForce processes such information on their documented instructions, the platform provider acts as a data processor.
The platform provider may separately act as a data controller for personal information used for its own service administration, security and direct communications.
3. Personal information processed
Depending on the functions used, SafetyForce may process:
- Names, business email addresses, job titles, departments and work locations.
- Employee profiles, user accounts and access permissions.
- Health and safety training assignments, attendance, completion records and acknowledgements.
- Risk assessments and employee confirmations.
- Personal protective equipment requirements and issue records.
- Workplace accident, incident and near-miss reports.
- Witness information, investigation notes and supporting evidence.
- Injury, medical and return-to-work information.
- Corrective actions, safety observations and compliance records.
- Notifications, support requests and relevant security or technical information.
Not all categories apply to every user.
4. Purposes of processing
Personal information may be processed to:
- Support workplace health and safety compliance.
- Administer safety training and record completion.
- Manage risk assessments and employee acknowledgements.
- Record and investigate workplace incidents.
- Manage PPE and corrective actions.
- Maintain relevant workplace safety records.
- Administer accounts and permissions.
- Deliver operational notifications.
- Protect the security and integrity of the platform.
- Meet applicable legal and regulatory obligations.
5. Lawful bases
The relevant data controller is responsible for establishing the applicable lawful basis for each processing activity.
Depending on the circumstances, these may include compliance with legal obligations under Article 6(1)(c) UK GDPR and legitimate interests under Article 6(1)(f), where appropriate.
Health-related information may constitute special-category personal data. Such information requires an additional applicable condition under Article 9 UK GDPR and any relevant safeguards under the Data Protection Act 2018.
Where processing is necessary to fulfil employment law obligations, Article 9(2)(b) may apply, subject to its legal requirements.
Employee consent is not treated as the general lawful basis for mandatory workplace health and safety processing.
6. Sharing and service providers
Information may be accessible to authorised employees, managers, health and safety personnel and administrators where necessary for their responsibilities.
SafetyForce uses cloud services to operate the platform, including Supabase for database and authentication functionality and Railway for application hosting.
Other service providers may support authorised communications and integrations.
Information may be disclosed where required by law or reasonably necessary for legitimate investigations, regulatory compliance or legal claims.
Access to sensitive information should be appropriately restricted.
7. International processing
Cloud infrastructure and service providers may involve processing or access from different countries.
Where restricted international transfers occur, the responsible parties must ensure that applicable UK data protection requirements and appropriate transfer safeguards are satisfied.
Further information about relevant processing arrangements may be requested through the contact details above.
8. Security
SafetyForce uses authentication and role-based access mechanisms intended to protect information and restrict access according to authorised responsibilities.
Additional safeguards are required for sensitive incident and health-related records.
Users must protect their account credentials and promptly report suspected security incidents.
9. Retention
Personal information is retained according to the relevant processing purpose, applicable legal requirements and the retention arrangements established by the responsible controller.
Different periods may apply to employment, training, accident, medical, compliance and technical records.
Where SafetyForce acts as a processor, retention and deletion are governed by applicable lawful instructions and contractual arrangements, subject to relevant legal obligations.
10. Microsoft Teams integration
Where enabled, SafetyForce may integrate with Microsoft Teams to provide authorised workplace functionality and operational notifications.
Relevant information may include user identifiers, organisational information and notification-related data necessary for the permitted integration.
The use of Microsoft Teams is also subject to the participating organisation's Microsoft 365 arrangements.
11. Cookies and technical storage
SafetyForce may use cookies and similar technologies necessary for authentication, session management, security and service operation.
Any non-essential tracking technologies, if introduced, must be separately assessed and disclosed, with consent obtained where required by applicable law.
12. Individual rights
Subject to applicable legal requirements and exemptions, individuals may have rights to access, rectify, erase or restrict processing of their personal information, object to certain processing and exercise other rights under UK GDPR.
Requests relating to employment and workplace safety records should normally be directed to the relevant employing organisation.
For enquiries concerning SafetyForce, contact:
Individuals may also lodge a complaint with the Information Commissioner's Office:
https://ico.org.uk/make-a-complaint/
13. Updates
This Privacy Notice may be updated to reflect developments in the platform, processing arrangements or applicable legislation.
The latest version will be available at:
https://safetyforce.co.uk/privacy
14. Legal Information & Contact
Product: SafetyForce
Website: https://safetyforce.co.uk
Contact: [email protected]
For enquiries relating to SafetyForce, data protection, privacy rights or these Terms of Use, please contact us using the email address above.