1. Who we are
HFS Central is operated by to be confirmed (company number to be confirmed, registered office to be confirmed), referred to as "we" and "us". Our ICO registration is to be confirmed. You can reach us about anything in this policy at [email protected].
This policy covers the marketing site at https://hfscentral.com and the application at https://app.hfscentral.com/. It is written under the UK GDPR and the Data Protection Act 2018.
2. Controller or processor
We wear two hats, and which one applies decides what you should read.
- Controller for the people who deal with us directly: the owner who registers a company, the admins they add, anyone who emails us, and visitors to the marketing site. Sections 3 to 9 are about that.
- Processor for the employee records a company keeps on the platform: names, work emails, roles, module assignments and completions. The company is the controller of that data and decides why it is held. We act only on the company's instructions under our data processing addendum. Section 10 explains what that means if your employer uses HFS Central.
3. Data we handle
| Category | Examples | Where it comes from |
|---|---|---|
| Account data | Name, email address, password hash, role, company name and slug | You, when you register or are invited |
| Billing data | Plan, subscription status, invoice history, card brand and last four digits, billing address | You and Stripe. We never receive or store full card numbers. |
| Usage data | Sign-in times, pages used, modules assigned and completed, scores | Generated as you use the platform |
| Technical data | IP address, browser type, device type, session identifiers | Your browser, in server logs and the session cookie |
| Support data | Emails you send us and our replies | You |
We do not collect special category data. Training modules do not ask health questions and you should not enter health information in free-text fields.
4. Lawful basis
- Contract: providing the account, the modules, the records and billing.
- Legitimate interests: securing the platform, preventing abuse, understanding how the product is used so we can improve it, and telling existing customers about changes to the service. We balance these against your interests and you may object at any time.
- Legal obligation: keeping accounting records and responding to lawful requests.
- Consent: only where we ask for it, for example a case study. You can withdraw it whenever you like.
We do not send marketing email to people who have not registered, and we do not sell or rent personal data.
5. Who we share with
We share personal data only with providers that help us run the service, each under a contract that limits what they may do with it:
- Stripe for payments, invoices and the billing portal.
- Resend for transactional email such as sign-in details and reminders.
- Our hosting provider for servers, databases and backups in the United Kingdom.
- Cloudflare for DNS, TLS and protection against attacks.
We may also disclose data where the law requires it, to protect the rights or safety of any person, or as part of a sale or reorganisation of the business, in which case the new operator takes on this policy.
6. International transfers
Account and employee records are stored in the United Kingdom. Some providers, notably Stripe and Resend, process data in the United States under the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Copies are available on request.
7. Retention
- Company accounts: for the life of the subscription and 90 days after cancellation, so a company that returns keeps its records. After that the account and its employee records are deleted.
- Billing records: six years after the tax year they relate to, as HMRC requires.
- Server logs: 30 days.
- Support email: two years after the thread closes.
A company owner may delete the company sooner from the application, or ask us to. Employee-level deletion is handled by the company as controller; see section 10.
8. Security
Traffic is encrypted in transit. Passwords are stored as one-way hashes. Each company's data is separated from every other company's at the database level and every request is checked against the signed-in person's company. Access to production systems is limited to named staff with multi-factor authentication. Backups are encrypted and tested. Annex 1 of the DPA lists the measures in more detail.
9. Your rights
You have the right to access, correct, erase and port your personal data, to restrict or object to processing, and to withdraw consent. Write to [email protected] and we will respond within one month. If you are unhappy with our answer you can complain to the Information Commissioner's Office at ico.org.uk.
If the data is an employee record held for a company, we will pass your request to that company, because they decide how it is handled.
10. If your employer uses HFS Central
Your employer created your account, decides which modules you are assigned and can see whether you have completed them. We hold your name, work email, role, assignments, completion dates and scores on their behalf. We do not use that data for our own purposes, do not contact you except to deliver the service (sign-in details, reminders your employer has turned on) and delete it when your employer tells us to or closes its account.
Questions about why your employer holds the data, or requests to see or delete it, go to your employer first. If you cannot reach them, write to us and we will help.
11. Children
HFS Central is for workplaces. We do not knowingly hold data about anyone under 16. If a company adds someone younger, it is responsible for having the right basis to do so.
12. Changes
We will post changes here and update the date at the top. If a change materially affects how we use your data we will email account owners before it takes effect.