HHnextGen

Privacy Policy

Last updated: June 2026

1. Introduction

HHnextGen (“we”, “our”, or “us”) is committed to protecting and respecting your privacy. This policy explains how we collect, use, store, and protect personal data when you use our platforms, including but not limited to SafetyTrack, Orderly, FireLog, and any other HHnextGen applications (together, the “Services”).

This policy applies to all users of our Services, including business administrators, employees, contractors, and visitors to our website at hhnextgen.co.uk.

We are the data controller for the personal data processed through the business account registration, support, and billing systems. Where our Services are used by a business customer, that business is the data controller for the operational data entered into the platform; we act as a data processor on their behalf.

2. What Data We Collect

We collect and process the following categories of personal data:

  • Account data: full name, email address, role, and business affiliation, provided during account creation or invitation.
  • Usage data: logins, feature interactions, session activity, and audit trails within the platform.
  • Operational data: compliance records, inspection reports, audit findings, risk assessments, incident reports, maintenance logs, actions, uploaded evidence (including photographs and documents), and any other data entered by users.
  • Device data: IP address, browser type, operating system, device identifiers, and approximate location derived from IP address.
  • Support data: information submitted via our support channels, including contact form submissions, email correspondence, and any attachments such as screenshots.
  • Communication data: records of emails and messages between you and HHnextGen, including support tickets.

3. How We Use Your Data

We use personal data for the following purposes:

  • Service delivery: to provide, maintain, and improve the Services, including user authentication, feature access, and data storage.
  • Compliance and safety: to enable businesses to manage their health and safety, fire safety, compliance, and operational obligations.
  • Account administration: to manage user accounts, permissions, and business associations.
  • Support and communication: to respond to enquiries, provide technical support, and send service-related notifications.
  • Security and monitoring: to detect and prevent unauthorised access, fraud, misuse, and to maintain the integrity of the platform.
  • Legal obligations: to comply with applicable laws, regulations, and legal processes, including responding to lawful requests from authorities.
  • Product improvement: to analyse aggregated, anonymised usage patterns to improve functionality and user experience.

4. Legal Basis for Processing (UK GDPR / EU GDPR)

Our legal bases for processing personal data are:

  • Contractual necessity: processing is necessary to perform our contract with you or your employer (e.g., providing access to the Services).
  • Legitimate interests: processing is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and freedoms (e.g., improving security, detecting fraud, providing support).
  • Legal obligation: processing is necessary to comply with a legal or regulatory obligation (e.g., maintaining records for tax purposes, responding to binding legal requests).
  • Consent: where we rely on consent, you have the right to withdraw it at any time (e.g., marketing communications — we do not currently send marketing emails without explicit opt-in).

5. Data Sharing and Disclosure

We do not sell personal data. We may share data in the following limited circumstances:

  • Within your business: data you enter into the Services is visible to other users within your business account according to your administrator’s permission settings.
  • Service providers: we use trusted third-party providers for hosting, infrastructure, email delivery, and analytics. These providers are bound by data processing agreements and are prohibited from using the data for their own purposes.
  • Legal and regulatory: we may disclose data where required by law, court order, or governmental regulation, or where we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
  • Business transfers: in the event of a merger, acquisition, or sale of assets, personal data may be transferred as part of the transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

  • Account data: retained while your account is active and for a reasonable period after closure to handle any follow-up queries or legal obligations.
  • Operational data: retained according to your business customer’s data retention policies and any statutory retention requirements applicable to health, safety, and compliance records.
  • Support data: retained for up to 3 years after resolution of the support ticket, for quality and reference purposes.
  • Usage and device data: retained in aggregated or anonymised form for analytics; identifiable logs retained for up to 12 months for security purposes.

7. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction, including:

  • Encryption of data in transit (TLS 1.2+) and at rest (AES-256).
  • Role-based access controls and mandatory authentication for all Services.
  • Regular security reviews, penetration testing, and vulnerability scanning.
  • Data centre infrastructure with SOC 2 and ISO 27001 certification.
  • Strict internal access policies: only authorised personnel access production data, and only where necessary for support or maintenance.
  • Incident response procedures, including prompt notification to affected parties and the ICO where required.

8. International Data Transfers

Our primary hosting infrastructure is located within the United Kingdom and the European Economic Area (EEA). Where data is processed or stored outside the UK/EEA by our service providers, we ensure that appropriate safeguards are in place, such as:

  • Standard Contractual Clauses (SCCs) approved by the UK Government and/or European Commission.
  • Adequacy decisions where the destination country has been recognised as providing an adequate level of data protection.
  • Binding corporate rules or equivalent mechanisms with our service providers.

9. Your Rights

Under UK and EU data protection law, you have the following rights:

  • Right of access: you may request a copy of the personal data we hold about you.
  • Right to rectification: you may ask us to correct inaccurate or incomplete data.
  • Right to erasure: you may ask us to delete your personal data in certain circumstances (“the right to be forgotten”).
  • Right to restrict processing: you may ask us to limit how we use your data in certain circumstances.
  • Right to data portability: you may request a copy of your data in a structured, machine-readable format to transfer to another provider.
  • Right to object: you may object to processing based on legitimate interests, including profiling (we do not currently conduct automated decision-making or profiling).
  • Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at info@HHnextGen.co.uk. We will respond within one month. Where the request relates to operational data controlled by your employer, we will direct you to your business administrator.

10. Cookies and Tracking Technologies

Our platform uses essential cookies for authentication, session management, and security. These cookies are strictly necessary for the operation of the Services and cannot be disabled.

We do not currently use non-essential cookies for advertising, marketing, or behavioural tracking. If this changes, we will update this policy and provide an appropriate consent mechanism.

11. Children’s Privacy

Our Services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that a child under 16 has provided us with personal data, we will delete it promptly. If you believe we may have collected data from a child, please contact us immediately.

12. Changes to This Privacy Policy

We may update this policy from time to time to reflect changes in our practices, technology, legal requirements, or the Services. When we make material changes, we will notify you by email (to the address associated with your account) or through a prominent notice within the platform at least 30 days before the change takes effect.

Continued use of the Services after any changes constitutes acceptance of the revised policy. We encourage you to review this policy periodically.

13. Contact Us

For any questions about this privacy policy, to exercise your data protection rights, or to raise a concern about our data practices, please contact us:

Emailinfo@HHnextGen.co.uk

Websitehhnextgen.co.uk

DPOContact our Data Protection Officer at the email address above, marked for the attention of the Data Protection Officer.

You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk if you believe we have not handled your data in accordance with the law.