Privacy Notice
What we collect, why, who sees it, how long we keep it, and your rights
- Who We Are
- Two Roles
- What We Collect and Why
- The Verify Page
- How We Use AI
- Who We Share It With
- How Long We Keep It
- Your Rights
- Cookies
- Keeping It Safe, and Changes
1. Who We Are
Passmark builds compliance documents for trade and construction businesses and keeps them up to date. This notice explains how we handle personal information: yours if you use our website or buy from us, and your people's if you are a customer.
- Who we are
- [Passmark legal name] Ltd, a company registered in England and Wales, number [company number], registered office [address].
- How to contact us
- hello@mypassmark.co.uk. Write to us at the registered office.
- ICO registration
- [registration number]
2. Two Roles
For most of what we hold we are the controller: we decide why and how it is used. That covers the people who visit our website, create an account, onboard, buy from us or contact us.
For information about a customer's own people, such as names, job titles and copies of their cards and tickets, we are a processor. The customer is the controller and we use the information only to build and keep their documents current, under our terms and a Data Processing Agreement. If you work for one of our customers and have a question about your information, ask your employer first; we will help them answer it.
3. What We Collect and Why
| Who | What | Why, and the lawful basis |
|---|---|---|
| Website visitors | What your browser sends to any website, such as your IP address and browser type, kept in our host's server logs. | To run and protect the website. Legitimate interests. |
| Anyone who creates an account | Name, business name, email address, password (stored scrambled, never readable), or your Apple or Google sign-in. | To give you an account and send you your onboarding link and reminders about it. Taking steps to enter a contract with you. |
| Customers, during onboarding and while their plan runs | Your answers about your business, your logo, your existing documents, your certificates and insurance schedules, the names and contact details of the people who approve documents, and our messages with you. | To build, review, deliver and keep your documents current, and to run your account. Performance of our contract. |
| Customers who pay | Your plan, prices, invoices and payment history. Card and bank details go straight to our payment providers; we never see or store your full card number. | To take payment and keep tax records. Contract, and our legal obligations. |
| A customer's people | Name, job title, and copies of cards and tickets with their expiry dates (for example CSCS, PASMA, IPAF, Gas Safe ID). Only what the customer chooses to send. | On the customer's instructions, to name people in their documents and track when cards expire. We are the processor. |
| Anyone who checks a company on our Verify page | Nothing beyond the server logs above. We do not ask who you are. | Legitimate interests. |
We never ask for, and do not want, health information, right to work checks or disciplinary records. If they reach us we do not keep them and we tell the customer.
4. The Verify Page
Each customer has a public Verify page, opened with their company code or the code on their documents. It shows business details only: the business name, town, trade and company number, the status of their plan, review dates, their Passmark certificate, and the evidence on file by type, for example "Public liability insurance, copy held" or "PASMA cards held for the team".
It never shows anything personal about a customer's people: no names, photos, card numbers or dates of birth. A sole trader's business name may be their own name; they agree to it appearing when they agree our terms, and can ask us to show a trading name instead.
5. How We Use AI
We use an AI service to read the documents customers send us, to draft content around their business and to check our own work. A person reviews everything before it is released. The AI provider processes the information on our behalf only, under contract, and does not use it to train its models. It is named in the list below.
No decision with legal or similarly significant effects on anyone is made by AI alone.
7. How Long We Keep It
| Information | Kept for |
|---|---|
| An account that never went on to buy | 12 months after the last time it was used, then deleted |
| A customer's profile, answers, documents and evidence | While the plan runs, then 12 months in case they come back, then deleted |
| Passmark app records, after moving to Stay Compliant or leaving | Read-only for 90 days, kept 12 months, then deleted |
| Copies of a customer's people's cards | Until replaced by a renewed card, the customer asks us to delete them, or 12 months after the plan ends |
| The register of issued documents and certificates (references, versions and dates, no personal information) | Permanently, so a document can always be checked |
| Invoices and payment records | Six years after the end of the financial year they relate to, as tax law requires |
| Server logs | [up to 30 days, depending on the host] |
8. Your Rights
You can ask us to:
- give you a copy of the information we hold about you;
- correct anything that is wrong;
- delete your information, where we no longer need it or have no other lawful reason to keep it;
- restrict how we use it, or object to our using it on the basis of legitimate interests;
- give you your information in a format you can take elsewhere.
Ask by email at hello@mypassmark.co.uk. We reply within one month. There is no charge.
If you are unhappy with how we have handled your information, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113.
10. Keeping It Safe, and Changes
Information is held in secure, access-controlled systems, sent over encrypted connections, and only seen by people who need it for their job. If something goes wrong we follow our Data Breach Procedure, including telling the ICO within 72 hours where the law requires it.
We review this notice at least once a year. The version and date are at the top and the changes are listed in the revision history.