1. Who we are
CipherQHSE is a QHSE management platform operated by Cipher Proactive Solutions ("we", "us", "our"). We act as the data controller for the personal data described in this notice, and as a data processor for the operational records our customers store inside their own organization workspace.
We are registered in the United Kingdom and our contact address is 128 City Road, London, EC1V 2NX, United Kingdom. You can reach our privacy team at info@cipherproactive.com.
2. Scope of this notice
This notice explains what personal data we collect through our website, subscription checkout, sales activity and the CipherQHSE platform, why we collect it, how long we keep it and the rights available to you.
It is written to meet the UK General Data Protection Regulation, the EU General Data Protection Regulation, and — where it applies to users in the region — the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. Where local law grants stronger rights, those rights prevail.
3. Personal data we collect
- Account data: name, work email, password hash, role, department, organization and the permissions assigned to you.
- Organization data: company name, industry, size, registered address, billing contact and the frameworks you manage.
- Subscription and billing data: plan, billing interval, invoice history and payment references. Card details are captured and stored by our payment processor, never by us.
- Operational records: whatever your organization chooses to store, which may include incident reports, injuries, risk assessments, inspection results, training records and personnel details.
- Usage data: IP address, browser and device information, pages viewed, sign-in timestamps and failed login attempts.
- Communications: enquiries, demo requests, support messages and any attachments you send us.
4. How and why we use your data
- To create and administer your organization workspace, user accounts and permissions.
- To process subscriptions, take payment and issue invoices.
- To provide, secure and support the platform, including audit logging and defending against unauthorized access.
- To send transactional messages such as welcome emails, password resets and security notices.
- To answer enquiries, provide demonstrations and follow up on sales conversations.
- To meet our legal, accounting and regulatory obligations.
- To improve the platform through aggregated, de-identified usage analysis.
5. Legal bases for processing
Where the UK GDPR or EU GDPR applies, we rely on the following legal bases under Article 6:
- Performance of a contract — creating your workspace, delivering the platform and processing payments.
- Legitimate interests — securing the platform, preventing fraud, supporting customers and improving our service, balanced against your rights.
- Legal obligation — retaining financial records and responding to lawful requests.
- Consent — where we ask for it explicitly, for example for optional marketing communications. You may withdraw consent at any time.
6. Health and safety data
QHSE records can include special category data relating to injuries or occupational health. Your organization is responsible for establishing its lawful basis for recording that information and for limiting access. We process it only on documented instructions, apply access controls and role-based permissions, and never use it for our own purposes.
7. Sharing and sub-processors
We do not sell personal data. We share it only with service providers who help us operate the platform, and only to the extent needed:
- Payment processing — Stripe collects and processes card payments and subscription billing.
- Cloud hosting and database infrastructure that stores platform data in encrypted form.
- Email delivery for transactional messages.
- Professional advisers, auditors or authorities where required by law.
8. International transfers
Our infrastructure and processors may process data outside the United Kingdom or European Economic Area. Where that happens, we rely on an approved transfer mechanism — the UK International Data Transfer Addendum or the European Commission Standard Contractual Clauses — together with technical and organizational safeguards such as encryption in transit and at rest, and access controls.
9. Retention
We keep account and organization data for as long as your subscription is active, then for a limited period so the workspace can be restored or exported. Billing records are retained for the period required by tax law. Security logs are kept for a shorter operational window. When data is no longer needed, it is deleted or irreversibly anonymized.
10. Security
- Encryption of data in transit using TLS and at rest at the storage layer.
- Hashed credentials, role-based permissions and organization-level data isolation.
- Session management, failed-login lockouts and audit logging of sensitive actions.
- Least-privilege access for our staff and periodic access reviews.
11. Your rights
Subject to applicable law, you may request access to your personal data, correction of inaccurate data, erasure, restriction of processing, portability of data you provided, and objection to processing based on legitimate interests. You may also withdraw consent where processing relies on it.
To exercise any right, contact info@cipherproactive.com. We respond within one month and may ask for verification of identity. If your request concerns records inside a customer workspace, we will refer it to that organization as the controller.
You have the right to complain to a supervisory authority — in the UK the Information Commissioner's Office, in the EU your national data protection authority, and in the UAE the UAE Data Office.
12. Cookies and analytics
We use strictly necessary cookies and local storage to keep you signed in, remember your selected organization and language, and protect forms against abuse. Analytics, where enabled, is configured to avoid collecting unnecessary personal data. You can clear cookies and local storage in your browser at any time, though sign-in will require re-authentication.
13. Children
The platform is designed for use by organizations in a professional context and is not intended for anyone under 16. We do not knowingly collect data from children.
14. Changes to this notice
We review this notice as our service and the law evolve. Material changes are communicated to administrators by email or in-product notice before they take effect.
15. Contact
Questions about this notice or our data practices: info@cipherproactive.com. Postal address: 128 City Road, London, EC1V 2NX, United Kingdom. Business hours: Mon – Fri, 9AM – 5PM.