Which document do you need?
This notice covers the FireCompliance Pro platform — the contractor, engineer and client portals — and explains what we do with personal data where we decide how it is used: account holders, billing, security and support.
Separately, contractors put data about their own staff and clients into the platform. For that data the contractor decides how it is used, and we act only on their instructions. That relationship is governed by our Data Processing Agreement.
Our website privacy policy covers the public marketing site and waitlist only.
1. Who we are, and which hat we wear
FireCompliance Pro ("we", "us") provides a compliance management platform for UK fire safety contractors. Contact for anything in this notice: hello@firecompliancepro.com.
Under the UK GDPR and the Data Protection Act 2018, we wear two different hats depending on whose data it is, and it matters which one applies:
| Data | Our role | Governed by |
|---|---|---|
| The contractor's own account: the people who sign up and sign in, billing, support correspondence, security logs | Controller — we decide how it is used | This notice |
| Data the contractor enters about their staff, their clients, sites and compliance work | Processor — the contractor decides; we act on their instructions | Data Processing Agreement |
If you are an engineer or a responsible person using the platform, most of the data about you was entered by the contractor who invited you, and they are the controller for it. Your first point of contact for questions about that data is them — though you can always contact us and we will help, and we will tell you who the contractor is if you do not know.
2. What we collect, and why
This section covers data we hold as controller.
| Data | When | Why we use it | Lawful basis |
|---|---|---|---|
| Name, work email, phone, company name and address, job title | When an account is created, or a user is invited | To create and run the account, authenticate sign-ins, and contact you about the service | Performance of a contract |
| Billing details — subscription status, plan, engineer seat count, payment method reference | On subscribing | To take payment and manage the subscription. Card and bank details are entered directly with Stripe and are never stored on our systems. | Performance of a contract; legal obligation (tax and accounting records) |
| Sign-in and security records — authentication events, and audit trails of who changed what | Throughout use | To keep accounts secure, investigate problems, and maintain the tamper-evident audit trail the service depends on | Legitimate interests (security and service integrity); legal obligation |
| Technical logs — IP address, browser and device type, pages and endpoints requested, timestamps | Automatically, on every request | To deliver the service, diagnose faults, and detect abuse | Legitimate interests (running and securing the service) |
| Support correspondence | When you contact us | To answer you, and to improve the product | Legitimate interests (customer support) |
| Service emails — notifications about jobs, certificates, defects and renewals | Triggered by activity in the platform | To tell you about things that need your attention | Performance of a contract |
We do not sell personal data, share it with advertising networks, or use the contents of your compliance records to build marketing profiles.
The platform itself does not use analytics or advertising cookies. It sets only the cookies and local storage needed to keep you signed in and to let the engineer portal work offline. Analytics and advertising cookies exist on our public marketing site only, and only if you accept them there — see the website privacy policy.
3. Criminal records and other sensitive data
The platform can hold DBS (criminal records check) information about engineers — a check date, a certificate reference number, and when the next check is due.
Under Article 10 of the UK GDPR this is data relating to criminal convictions and offences, and it gets stricter treatment than ordinary personal data.
Where a contractor records this about their staff, the contractor is the controller and is responsible for having a lawful basis and an Article 10 condition for holding it, and for their own appropriate policy document where one is required. We process it only as their processor, under the Data Processing Agreement.
What we commit to on our side: this data is stored subject to the same access controls as everything else, it is included in our encrypted backups, it is never used for any purpose of our own, and it is never disclosed to anyone outside the sub-processors listed below.
The platform also holds other data that deserves care even though it is not "special category" data in the legal sense: handwritten signature images captured at sign-off, photographs taken on site, and building access notes. We treat these as confidential and restrict access to them in the same way.
The platform is not designed to hold health data, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, or data about sex life or sexual orientation. Please do not enter such data into free-text fields.
4. Where your data lives, and who processes it
The live database and uploaded files are hosted by Supabase in Frankfurt, Germany (EU). We use a small number of service providers ("sub-processors") to run the platform. Each acts on our instructions under a contract:
| Provider | What they do | Where |
|---|---|---|
| Supabase | Database, authentication and file storage — the live system of record | EU (Frankfurt) |
| Vercel | Application hosting and delivery; generates the technical logs described above | US company; EU edge delivery |
| Stripe | Subscription billing and payment processing. Card and bank details go directly to Stripe and are not stored by us | US/EU |
| Resend | Sending service emails — invitations, notifications, alerts | US |
| GitHub (GitHub Actions) | Runs our automated nightly backup job. Data is processed transiently on a hosted runner during the backup and is not retained there | US (Microsoft) |
| Cloudflare (R2) | Encrypted off-site storage of those nightly backups, so the service can be restored after a failure | See note below |
About backups, stated plainly. Once every 24 hours, a complete encrypted copy of the database and uploaded files is taken and stored off-site with Cloudflare. This is what lets us recover the service if our main provider fails or data is lost, and it means a copy of your data exists outside Frankfurt. Backups are retained on a rolling basis — see section 6 — and are restored only to recover the service, never browsed or used for any other purpose.
We will give contractors advance notice of any change to this list, as set out in the Data Processing Agreement.
5. International transfers
The live platform data is held in the EU. Some of our providers are US companies, and backup and support operations may involve access from outside the UK/EEA. Where personal data is transferred outside the UK or EEA, we rely on recognised safeguards — the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and, where applicable, the UK–US Data Bridge — together with encryption in transit and at rest.
6. How long we keep it
| What | How long | Why |
|---|---|---|
| Account and user records | For the life of the subscription, then up to 12 months | To allow reactivation and to resolve any dispute |
| Billing and payment records | 7 years from the end of the accounting period | UK tax and accounting law |
| Compliance records — certificates, service reports, visit records, logbook entries | At least 7 years from the relevant work | Certification scheme requirements (including BAFE SP203-1 clause 10.1.2) and the value of these records as evidence of fire safety compliance |
| Security and audit logs | Up to 24 months | Security investigation and the integrity of the audit trail |
| Support correspondence | Up to 24 months after the matter is closed | Context for later enquiries |
| Backups | Daily copies for 35 days; monthly copies for 13 months | Disaster recovery |
Two honest limits on deletion, which we would rather state than bury.
Backups. When data is deleted from the live platform it disappears from the service immediately, but a copy can persist in encrypted backups until those backups age out — up to 35 days, or up to 13 months for a monthly copy. We do not surgically edit backups, because doing so would undermine their reliability as a recovery point. Restored data is re-deleted.
Compliance records. Fire safety certificates and the visit records behind them are retained for at least 7 years even if an account closes. A record showing a building's fire alarm system was inspected is evidence someone may need years later, and certification schemes require it to be kept. This can limit an erasure request in respect of the named engineer or signatory on a certificate — see section 8.
7. How we protect it
- Separation between customers. Every request is filtered at the database level so one contractor's account cannot read another's data, rather than relying on the application to remember to check.
- Role-based access. Engineers, contractor administrators and client users each see only what their role requires. Sensitive staff records, including DBS fields, are restricted to the contractor's own administrators.
- Encryption in transit and at rest, including backups.
- Private file storage. Certificates, photographs, signatures and uploaded evidence are held in private storage and served only through short-lived links to users entitled to see them.
- Tamper-evident audit trails for compliance-critical actions, written by the database itself so application code cannot skip or forge an entry.
- Tested backups. Backups are verified automatically by restoring them and checking the restored contents match what was captured. A backup that fails verification is not accepted.
- Least privilege for our own access. We access customer data only where needed to operate the service, fix a fault, or where the customer asks us to.
No system is perfectly secure, and we will not claim otherwise. If a personal data breach occurs we will act on it promptly, notify the ICO where the law requires, and tell affected contractors without undue delay so they can meet their own obligations.
8. Your rights
Under the UK GDPR you have the right to access your personal data, correct it, have it erased, restrict or object to our processing of it, receive a copy in a portable format, and withdraw consent where we rely on it — without affecting processing that happened beforehand.
To exercise any of these, email hello@firecompliancepro.com. We will respond within one month.
If your data was entered by a contractor — for example you are one of their engineers, or the responsible person for a building they maintain — they are the controller and we will normally pass your request to them and support them in answering it. Tell us if you do not know who that is.
Erasure is not absolute. Where we must keep a record to meet a legal obligation, or to establish or defend a legal claim, we may keep the minimum necessary and restrict its use instead — the clearest example being the compliance records described in section 6.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office — ico.org.uk or 0303 123 1113. We would appreciate the chance to put it right first.
9. Changes to this notice
If we change this notice we will update this page and its effective date. Where a change materially affects how personal data is used, we will tell affected contractors before it takes effect.