Privacy Policy

1. Who we are

Duty. is a fire compliance and evidence management platform. We are the data controller for the personal data you provide when booking a demo or using our services. We are registered with the Information Commissioner's Office (ICO) as a data controller in the United Kingdom.

2. What we collect

We only collect the personal data we need to provide the service:

• Demo requests: name, email, business name, and mobile number (optional).
• Project accounts: name, email, role, and project assignment details.
• Compliance records: evidence photos, sign-off records, and user activity logs required for the golden thread of fire safety information.
• Billing: name, email, and payment details processed by our payment provider (Stripe). We do not store full card numbers.

3. How we use it

• To arrange and conduct product demonstrations.
• To operate the Duty. platform and produce compliance records.
• To communicate with you about your project, account, or billing.
• To meet legal and regulatory obligations under building safety legislation.

4. Legal basis

We process your data under the following lawful bases set out in UK GDPR:

• Contract — to provide the service you've signed up for.
• Legal obligation — to maintain compliance records required by building safety law.
• Legitimate interests — to operate and secure the platform, and to communicate with you about the service.
• Consent — for optional communications such as demo follow-ups. You can withdraw consent at any time.

5. Data retention

We keep personal data only for as long as necessary:

• Demo request data is kept for up to 12 months after last contact.
• Project and compliance records are kept for the duration of the project and for the period required by building safety law (typically the life of the building).
• Billing records are kept for 7 years for tax and accounting purposes.
• You can request deletion of your personal data sooner where the law allows.

6. Sharing and sub-processors

We do not sell your data. We only share information with project stakeholders who need it for compliance, or where required by law. We use the following sub-processors to deliver the service:

• Cloud hosting and database — secure, encrypted data storage.
• Stripe — payment processing (PCI-DSS compliant).
• Email delivery — for transactional and account emails.

All sub-processors are bound by written agreements requiring them to protect your data to a standard at least equivalent to UK GDPR.

7. International transfers

Where data is processed outside the UK, we only transfer it to countries with adequate data protection safeguards, or under standard contractual clauses approved by the ICO, to ensure your data is protected to UK GDPR standards.

8. Security

We use encryption in transit and at rest, strict role-based access controls, and invite-only authentication to protect your data. Access is limited to authorised personnel who need it to operate the service.

9. Data breaches

In the unlikely event of a personal data breach, we will assess the risk and, where required by UK GDPR, notify the ICO within 72 hours and inform affected individuals without undue delay.

10. Your rights

Under UK GDPR you have the right to:

• Be informed about how we use your data (this policy).
• Access your personal data.
• Rectify inaccurate or incomplete data.
• Erasure of your personal data ("right to be forgotten"), where the law allows.
• Restrict or object to processing.
• Data portability — receive your data in a structured, machine-readable format.
• Withdraw consent at any time (where processing relies on consent).
• Lodge a complaint with the ICO.

To exercise any of these rights, contact us through the Duty. platform. We will respond within one month, as required by UK GDPR.

11. Complaints

If you have a concern about how we handle your data, please contact us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

12. Contact

For any privacy questions or to exercise your rights, reach out via the Duty. platform and we'll respond promptly.