This Privacy Policy explains how Digicon LLC, trading as IntegrityIQ360 (“we”, “us”), handles personal information when you visit our website, contact us, buy a subscription, report an observation through a QR code, or use the HSE, Quality and QHSE Command Centers (the “Service”). For questions or requests, email [email protected].
1. Our role
- We are the controller (the business responsible) for information about website visitors, people who contact us, buyers and billing contacts, and for the account, security and acceptance records we need to run the Service.
- We act as a processor (service provider) for the HSE records that an organization and its users put into the organization’s Workspace, and for observation reports sent to an organization through its QR code. The organization decides what is recorded and how it is used, and our Data Processing Addendum governs that processing. If your request concerns a record that your employer or another organization entered, please contact that organization first; we will help it respond.
2. Information we collect
Enquiries and consultation requests. The name, email address, company, country, organization size, topic, product or service interest, preferred plan and message you choose to submit. We also record the page the form was sent from, your browser’s user-agent string and a one-way (hashed) form of your IP address, which we use to limit repeated submissions. Please do not include sensitive medical or other unnecessary personal information in an enquiry.
Online purchases. Company name, your name, work email address, optional phone number and any billing email addresses you add (billing contacts receive billing information only and are not users of the Workspace). We record your IP address with the purchase request to prevent abuse, and a record of the policies you accepted (see “Acceptance records” below). From our payment provider Stripe we receive and keep payment records: customer, subscription and invoice identifiers, plan, Seats, amounts, currency, payment status, invoice links and dates. We never receive or store your full card number.
Accounts. Name, username, email address, organization, role and permissions, authentication settings (including multi-factor authentication settings, stored in protected form), and sign-in and security events such as successful and failed sign-ins. Administrators must also use an authenticator app when they sign in.
Workspace records. HSE information that authorized users enter, such as observations, incidents, corrective actions, inspections, permits, job safety analyses, toolbox-talk attendance, inductions, training, PPE issues and audits, together with related notes and attached photos and PDF documents. These records can include information about workers, contractors, visitors or others, and occasionally health information (for example the nature of an injury) where the organization chooses to record it.
QR-code observation reports. An organization can display a QR code or link that lets anyone on its site report a safety observation without signing in. The report contains what the person describes (for example type, site, area, date and time, risk level, description and immediate action) and up to three photos or PDF files. Reporters may give their name and contact details or report anonymously. We record a one-way (hashed) form of the IP address to limit repeated submissions, and a security log entry. Reports go only to the organization that owns the QR code and enter its records only when one of its authorized users accepts them.
Website assistant. When you use the “How can I assist you?” assistant on our website, the questions you type and the answers are sent to Cloudflare Workers AI (Cloudflare, our hosting provider) to generate an answer from the content of our website. We do not store these conversations; they are kept only in your browser tab until you close it, and our logs record only that a question was answered (not its text). Please do not enter personal, payment or other sensitive information. Answers are generated automatically and may contain mistakes — for quotes, contracts or advice, contact us.
Acceptance records. When you accept our Terms and Policies, we record which documents and version you accepted, the date and time, the account or purchase it relates to, and the IP address and browser used. We keep this record as proof of agreement.
Technical information. Information needed to deliver and protect the website and Service, such as IP address, browser and device information, request and error logs and security events.
3. How we use information
| Purpose | Information used | Legal basis (where the GDPR or UK GDPR applies) |
|---|---|---|
| Respond to enquiries, arrange demos and consultations, prepare proposals | Enquiry details | Steps you request before a contract; our legitimate interest in answering enquiries |
| Sell subscriptions, create Workspaces, take payment, send receipts, invoices and billing notices | Purchase, billing and payment records | Performance of a contract |
| Provide, support and improve the Service; manage access and Seats | Account, Workspace and technical information | Performance of a contract; legitimate interests |
| Keep the Service secure; prevent fraud, abuse and automated attacks | Technical information, security events, hashed IPs, bot-protection signals | Legitimate interests; legal obligations |
| Keep proof of the terms you accepted and of cancellations | Acceptance records | Legitimate interests; legal obligations |
| Meet tax, accounting and legal obligations; respond to lawful requests | Billing records and other relevant information | Legal obligations |
| Send service and account messages (activation, security, billing) | Name and email address | Performance of a contract |
We do not sell personal information, share it for cross-context behavioural advertising, use Workspace records for marketing, or use Workspace records to train artificial-intelligence models. We do not send marketing emails without asking you separately.
4. Payments and bot protection
Stripe. Payments are processed by Stripe. You enter payment details on Stripe’s own secure pages (for example checkout.stripe.com and the Stripe billing portal), not on our website. Stripe receives the information needed to process the payment, such as your name, email, billing address and payment method, and acts as an independent controller for some purposes, such as fraud prevention and meeting its legal obligations, under its own privacy policy (stripe.com/privacy). Stripe also sends receipts and billing emails to the billing email address you provide.
Cloudflare Turnstile. Our purchase page and trial sign-up use Cloudflare Turnstile to tell people apart from automated abuse. Turnstile runs in your browser and sends Cloudflare technical signals such as your IP address, browser information and page details; it does not read what you type into the form. Cloudflare states that it does not use these signals for advertising.
5. Who receives information
- Our personnel, only where they need it to operate, support and secure our services.
- Service providers listed in our Sub-processor List, who process information on our instructions: Cloudflare (hosting, database, private file storage, transactional email, security, Turnstile and cookieless website analytics), Stripe (payments, subscriptions, invoices and billing portal), Google (delivery of website enquiry notifications to our Gmail mailboxes, and the web font loaded by the Service) and Namecheap (the [email protected] mailbox).
- Your organization. An organization’s Administrators and users see information in their own Workspace according to their permissions.
- Others where required: to comply with law or a lawful request, to protect the rights, safety and property of people or of our services, or as part of a merger, acquisition or sale of our business, subject to equivalent protection.
6. International transfers
We serve organizations in many countries and our providers operate internationally, so information may be processed outside your country, including in the United States. Where data-protection law requires it, we use appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, as set out in our Data Processing Addendum. We do not promise that data stays in a particular country unless a signed agreement says so.
7. How long we keep information
| Information | Retention |
|---|---|
| Website enquiries | As long as needed to respond and manage the resulting relationship, then reviewed for deletion, normally within 24 months of the last contact |
| Workspace records and accounts | For the life of the subscription; available for export for at least 30 days after it ends, then deleted within 90 days |
| Backups | Overwritten on their normal cycle, within 30 days |
| Billing and payment records | As long as tax and accounting law requires, normally 7 years |
| Acceptance and cancellation records | For the life of the account and at least 3 years afterwards |
| QR-code reports | Held for the organization until it accepts or rejects them; accepted reports are kept as Workspace records |
| Security and sign-in logs | Only as long as needed for security, investigations and legal obligations, normally up to 12 months |
We may keep information longer where the law requires it or to establish, exercise or defend legal claims.
8. Security
We protect information with encrypted connections, strong password hashing, multi-factor authentication for administrators, strict separation between organizations, private file storage, role-based permissions, audit trails and point-in-time database recovery. Our Security Overview has the details. No service can guarantee absolute security. If we confirm a breach affecting your personal information, we will notify the affected organizations and, where the law requires, regulators and individuals.
9. Your rights
Depending on where you live, you may have the right to access, correct or delete your personal information, to receive a copy of it in a portable format, to object to or restrict certain processing, to withdraw consent where we rely on it, and to complain to your data-protection regulator.
- European Economic Area, United Kingdom and Switzerland: you have the rights above under the GDPR, UK GDPR or Swiss law.
- California and other US states with consumer privacy laws (including Texas, Virginia, Colorado and Connecticut): you may request access, correction and deletion, and you will not be treated differently for using your rights. We do not sell personal information or share it for targeted advertising, and we do not use sensitive personal information to infer characteristics about you.
- Everywhere else: we respect requests where your local law gives you these rights, and consider other requests in good faith.
To make a request, email [email protected]. We will verify your identity and reply within 30 days (or sooner where the law requires). You may use an authorized agent where your law allows. If your request concerns records in an organization’s Workspace, that organization may need to handle it, and we will help it do so. If we decline a request, we will explain why and how you can appeal.
10. Cookies and similar technologies
The Service uses only cookies that are strictly necessary for signing in and security, and stores a few display preferences (such as light or dark theme) in your browser. The website uses Cloudflare Web Analytics (a script loaded from static.cloudflareinsights.com), which counts page views and measures performance without cookies. We do not use advertising or cross-site tracking cookies. See our Cookie Notice.
11. Children
Our services are for business use and are not directed to children. We do not knowingly collect information from children under 16.
12. Changes
We will post updates to this Policy here with a new date and, where the changes are significant or the law requires, give additional notice, for example by email or in the Service.
13. Contact
IntegrityIQ360 — a Digicon company · [email protected]