Privacy Policy

Last updated: 16 April 2026  ·  ArbSuitePro Ltd  ·  Company No. 17144294

1. Who We Are

ArbSuitePro Ltd is the data controller for personal data processed through this service.

Registered address: Cabin, Squirrel Lodge, Rumstead Lane, Sittingbourne, ME9 7RT

Company number: 17144294

ICO registration number: ZC137555 (registered 01 May 2026, expires 30 April 2027)

Contact: privacy@arbsuitepro.co.uk

2. What Data We Collect

We collect only what is necessary to provide the service:

• Account data: Full name, email address, company name, role (admin or operative)
• Compliance records: Data you enter into forms (SSRA/RAMS, vehicle checks, toolbox talks, RIDDOR reports, nest checks, COSHH records, equipment records) — this includes site addresses, dates, risk assessments, and signatures
• Photos: Site photos uploaded as part of compliance records
• Company documents: Insurance certificates and other documents you upload
• Usage data: We do not use analytics tracking or cookies beyond what is essential for the app to function

3. Why We Collect It (Legal Basis)

• Performance of a contract — to provide the compliance management service you have signed up for
• Legal obligation — compliance records may be required by UK health and safety law
• Legitimate interests — to maintain the security and integrity of the service

4. Where Your Data Is Stored

All data is stored on servers located in West Europe (London), United Kingdom, provided by Supabase Inc. Your data is stored on servers located in the United Kingdom. Supabase is our data processor and we have a Data Processing Agreement in place with them.

5. How Long We Keep Your Data

• Account data: Kept for the duration of your subscription, plus 30 days after cancellation to allow recovery
• Compliance records: Kept for 7 years from the date of the record — this reflects legal obligations under UK health and safety legislation which requires records to be retained
• Uploaded documents and photos: Kept for the duration of your subscription
• After the retention period, data is permanently deleted

6. Who We Share Data With

We do not sell or share your personal data with third parties for marketing purposes. We use the following processors:

• Supabase Inc. — database, authentication, and file storage (UK servers)
• Netlify Inc. — web hosting (data in transit only, not stored)

7. Your Rights Under UK GDPR

You have the following rights:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — ask us to correct inaccurate data
• Right to erasure — request deletion of your account and personal data (subject to our legal retention obligations for compliance records)
• Right to data portability — request your data in a machine-readable format (Article 20 UK GDPR)
• Right to object — object to processing based on legitimate interests
• Right to restrict processing — ask us to pause processing of your data

To exercise any of these rights, contact us at privacy@arbsuitepro.co.uk. We will respond within 30 days. You also have the right to complain to the Information Commissioner's Office (ICO).

8. Data Security

We take appropriate technical and organisational measures to protect your data, including:

• Encrypted connections (HTTPS/TLS) for all data in transit
• Row-level security — each company can only access its own data
• Authentication required to access any data
• Regular automated backups

9. Cookies

ArbSuitePro uses only essential cookies required for authentication and session management. We do not use advertising, analytics, or tracking cookies. See our Cookie Policy for details.

10. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes by email or via a notice in the app. The date at the top of this page shows when it was last updated.

11. Contact Us

For any privacy-related queries:
Email: privacy@arbsuitepro.co.uk
Post: ArbSuitePro Ltd, Cabin, Squirrel Lodge, Rumstead Lane, Sittingbourne, ME9 7RT