This Privacy Notice explains how StatusHQ Ltd (“StatusHQ”, “we”, “us” or “our”) handles personal information when you use statushq.co.uk, the StatusHQ platform, or contact us about our services.

StatusHQ is a web-based facilities and asset-status management platform. It helps organisations manage buildings, locations and equipment, record operational status, assign responsibility, and retain activity histories.

1. Who is responsible for personal information?

StatusHQ Ltd is the controller for personal information relating to our website, enquiries, account administration, billing, security and our own business records. Our registered office is 24 Oak Road, North Duffield, North Yorkshire, YO8 5TN, United Kingdom.

For personal information entered into a customer workspace, the customer organisation normally determines why and how that information is used and is the controller. StatusHQ processes that information on the customer’s documented instructions to provide, secure, maintain and support the service.

2. Personal information we collect

Information you or your organisation provide

• name, work email address, telephone number, employer, job title and organisation details;
• account information, including role, verification status, password hash and two-factor-authentication status;
• enquiry, demonstration, trial, quotation, invoice, support and other correspondence;
• customer-workspace content, such as buildings, locations, assets, status updates, comments, assignments, photographs and files; and
• billing or contact information supplied for quotations and invoices.

Payment information

Online payments are processed by Stripe. Payment-card details are entered directly into Stripe Checkout and are not stored by StatusHQ. We may receive limited subscription, payment-status and transaction information needed to manage your subscription. Stripe’s Privacy Policy is available at stripe.com/gb/privacy.

Information collected automatically

We collect service, security and diagnostic information such as IP-derived security data, browser and device characteristics, session information, login activity, pages requested and security audit events. We use this information to operate and protect the service, diagnose faults and improve reliability. We do not use third-party advertising trackers or optional analytics tools on our public website.

Information received from other sources

We may receive a user’s name, work email address, role and related account details from a customer organisation or administrator who creates or invites that user. We may also receive limited account and payment-status information from Stripe. We do not buy personal information, use marketing lists, or obtain personal information from social-media platforms for advertising.

Sensitive information

We do not intentionally request special-category or other sensitive personal information for our own business purposes. Customer organisations should not enter medical, highly sensitive or unrelated personal information into a workspace unless they have confirmed that it is necessary and lawful to do so. Where a customer enters such information, the customer remains responsible for the applicable lawful basis and privacy information.

3. How and why we use personal information

• create, verify, secure and administer accounts and manage access permissions;
• provide and support StatusHQ, including authorised collaboration within a customer workspace;
• respond to enquiries, demonstrations, support requests and other communications;
• manage trials, subscriptions, invoices and payment administration;
• send service-related messages, including invitations, verification, security and billing notices;
• maintain security, investigate misuse and incidents, prevent fraud, troubleshoot faults and protect the platform;
• review service and diagnostic information to maintain and improve reliability and usability; and
• maintain backups and audit records, meet legal and accounting duties, and establish, exercise or defend legal claims.

Our legal bases

Where the UK GDPR or EU GDPR applies, we use personal information only when we have a lawful basis. Depending on the activity, this is performance of a contract or steps requested before entering into one; our legitimate interests in operating, securing and improving StatusHQ; compliance with legal obligations; or consent where a genuine choice is required. We may also use information to protect vital interests in exceptional circumstances involving safety.

4. Who we share information with

• authorised users within the same customer organisation, who may see names, roles, work contact details where provided, and activity connected to workspace updates, comments and assignments;
• providers of web hosting, cloud infrastructure, database hosting, email delivery, data storage and backups;
• Stripe, our payment processor;
• performance-monitoring providers, only where the relevant integration is enabled;
• professional advisers, insurers, regulators, law-enforcement bodies or other parties where required by law or necessary to protect legal rights; and
• a prospective purchaser, investor or successor in connection with a business reorganisation, sale or financing, subject to appropriate confidentiality protections.

Workspace content is not public. It is available only to people authorised by the relevant customer organisation and to StatusHQ personnel only where access is necessary to provide support or operate the service. We do not sell personal information or disclose it to advertising networks, social networks, affiliate programmes or unaffiliated business partners for their own marketing.

5. International transfers

Our hosting and backup configuration uses European locations. Some service providers, including Stripe, may process personal information outside the UK or European Economic Area. Where this occurs, we use an appropriate transfer safeguard, such as an adequacy regulation, the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses, as applicable.

6. How long we keep information

• Account and authentication information: for the duration of the user account and for three years after account termination.
• Customer-workspace information and user-to-user communications: for the duration of the customer contract and for three years after it ends, unless the customer requests earlier deletion or a longer period is required by law.
• Enquiries and support communications: for three years from the last contact.
• Orders, subscriptions and accounting records: for six years from the end of the relevant financial year, or longer where required by law.
• Service and usage information: for 12 months after collection.
• Security, audit and business-continuity records: for the duration of the customer contract and for three years after it ends, unless a longer period is needed for an incident, dispute, legal obligation or claim.

When a user account is deleted, we remove login credentials, contact details and authentication information. Operational history that must remain available during the relevant retention period is associated with a non-identifying former-user label where appropriate. Backup copies are isolated from routine use and removed through controlled backup-retention cycles.

7. Security

We use technical and organisational measures designed to protect personal information. These include HTTPS, organisation separation, server-side access controls, password hashing, two-factor authentication, controlled sessions, protected file delivery, audit records and separate recovery copies. No internet service can be completely secure; please use strong credentials and report suspected unauthorised access promptly.

8. Cookies

We use essential cookies and similar technologies for secure sessions, security and preference storage. Our public website does not currently use optional analytics, advertising or cross-site marketing cookies. See our Cookie Notice for more information.

9. Children

StatusHQ is a business service and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us and we will take appropriate steps to address the issue.

10. Your privacy rights

Depending on the law that applies to you, you may have rights to request access to, correction or deletion of your personal information; restriction of processing; portability; or to object to certain processing. You may withdraw consent at any time where processing relies on consent. To make a request, email privacy@statushq.co.uk.

For information in a customer workspace, please contact the relevant customer organisation first. We will assist that organisation where required by law or our agreement with it. You may also complain to the UK Information Commissioner’s Office or, where applicable, your local data-protection authority.

11. Changes to this notice

We may update this Privacy Notice when our services, suppliers or legal obligations change. We will publish the revised notice and update the date above.