Privacy Policy

1. Who we are and our role

This policy explains how Waiver collects and uses personal data under the UK GDPR and the Data Protection Act 2018.

For your account details and how you use the website, we are the data controller. For the Health & Safety records your organisation enters into the Service (which may include information about employees, contractors and members of the public), your organisation is the controller and we act as its processor, following its instructions.

2. What we collect

• Account data: name, email address, password (stored only as a salted hash) and organisation name.
• Organisation data: sites, departments, user roles, invitations and company details you provide for verification.
• Records you create: incidents, risk assessments, inspections, permits, training and health-check records, documents and attachments. These can include special category data such as injury or health information.
• Usage and technical data: log-in activity, audit logs of actions in the Service, IP address, browser and device information, and cookies needed to keep you signed in.
• Billing data: handled by Stripe. We receive your subscription status and customer reference, not your full card number.

3. How and why we use it

We use personal data to provide and secure the Service (contract), to take payment and keep financial records (contract and legal obligation), to send service emails such as verification, invitations and alerts (contract), to verify organisations and prevent fraud or misuse (legitimate interests), and to improve and support the Service (legitimate interests).

Where records contain health information, your organisation is responsible for having a lawful basis and a condition for processing it, for example compliance with employment and health and safety law. We process it only on your instructions.

We do not sell personal data and do not use it for advertising.

4. Who we share it with

We use trusted service providers to run the Service, including hosting and database providers, file storage, Stripe for payments, and an email delivery provider. They may only use data to provide their services to us and are bound by data protection terms.

Within your organisation, data is visible only to members according to their role and permissions. If you enable integrations such as Slack, Microsoft Teams or webhooks, information is sent to those services at your direction. We may also disclose data where required by law or to protect our rights.

5. International transfers

If personal data is transferred outside the UK, we use safeguards required by law, such as the UK International Data Transfer Agreement or Addendum, or an adequacy decision.

6. Retention

Your organisation controls how long its records are kept using the retention settings in the Service, and should set these in line with its legal obligations. Account data is kept while your account is active. After an account closes we delete or anonymise personal data within a reasonable period, except where we must keep it, for example billing records for tax purposes. Backups are overwritten on a rolling basis.

7. Security

We use measures appropriate to the risk, including encrypted connections, hashed passwords, role-based access control, organisation-level data separation and audit logging. No system is completely secure, so please use a strong, unique password and deactivate users who no longer need access. We will notify affected customers and the ICO of a personal data breach where the law requires.

8. Your rights

You have the right to access your personal data, have it corrected or erased, restrict or object to its use, and receive a portable copy, as well as to withdraw consent where we rely on it. If your data is in records held by your employer or another organisation using Waiver, please contact that organisation first, as it controls that data; we will help it respond.

To exercise your rights against us, contact us using the details below. You can also complain to the Information Commissioner's Office (ico.org.uk) if you are unhappy with how we handle your data.

9. Cookies

We use essential cookies, for example to keep you signed in and protect your session; these do not need consent.

With your consent, we also use Google Tag Manager and Google Analytics (GA4) to understand how the website is used, such as which pages are visited and how visitors arrive. This sets analytics cookies and sends usage data, including your IP address and device information, to Google. We only load it after you click Accept on the cookie banner, and you can decline. To change your mind, clear this site's data in your browser and choose again. We do not use advertising cookies.

10. Changes to this policy

We may update this policy and will post the new version here with a revised date. We will notify you of significant changes.

11. Contact

Questions or requests about this policy or your personal data can be sent via our contact page.