Privacy Notice

This notice explains how [Legal entity name] (company number [Company number], ICO registration [ICO registration number]) uses personal data in connection with PAT Control. If you have any questions or want to exercise your rights, contact support@patcontrol.co.uk.

Two roles

• Controller: for the account and business data in this notice (people who sign up, users of the Service, and people who contact us), we decide how the data is used.
• Processor: for the data our customers put into the Service (their clients' contact details, site and appliance records, test results), we act on the customer's instructions under our Data Processing Agreement. If your details are in a customer's records (for example, you are one of their clients), the customer is the controller, and you should contact them first.

What we collect, and why

Data	Purpose	Lawful basis
Name, email address, password (stored as a one-way hash), two-step verification and passkey details	Creating and securing your account	Contract; legitimate interests (security)
Organisation details and your role	Providing the Service to your organisation	Contract
Billing contact and subscription details. Card details are held by Stripe, never by us	Charging for the Service	Contract; legal obligation (accounting records)
Sign-in times, IP addresses, browser type, and an audit log of changes	Security, fraud prevention, investigating problems, and records customers rely on	Legitimate interests
Messages you send to support	Answering you	Legitimate interests
Records of which terms you accepted, and when	Evidence of our agreement	Legitimate interests; contract

We don't sell personal data. We don't use it for advertising, and we don't use advertising or tracking cookies.

Cookies

We use only the cookies needed to keep you signed in and to protect your session. Because they are essential, no consent banner is needed.

Who we share it with

We share personal data with these service providers, under contracts that protect it:

• hosting and storage in the United Kingdom ([hosting provider — to be confirmed]);
• email delivery ([email provider — to be confirmed]);
• payments (Stripe Payments Europe Ltd. Stripe may process data outside the UK under approved safeguards);
• accounting packages (Xero, QuickBooks, FreeAgent), only when your organisation chooses to connect one.

We may also disclose data where the law requires us to, or to protect our rights.

How long we keep it

Data	How long
Account data	While the account is active, then 90 days
Billing records	Six years, for tax law
Security logs	12 months
The audit log of an organisation's records	As long as the organisation's records

Your rights

You have the right to access, correct or delete your personal data, to restrict or object to its use, and to data portability. To use any of these rights, email support@patcontrol.co.uk. We will reply within one month. You can also complain to the Information Commissioner's Office (ico.org.uk), but we'd like the chance to help first.

Changes

We will post any updates here, with a new version date.