Privacy Policy

1. Who is responsible

The controller for the personal data described in this policy is HSE Hub, the operator of hse-hub.net.

Email: [email protected]

We have not appointed a data protection officer. Send any privacy question or request to the address above.

2. Visiting the website

When you open a page, your browser sends technical data that every website receives: your IP address, the date and time, the page requested, the referring page, and your browser and operating system. Our providers use this data to deliver the site and keep it secure:

• Cloudflare sits in front of the website, delivers it and filters attacks.
• Vercel hosts the website and runs our server functions, the programs behind the forms, accounts and tools. The server functions run in Vercel's Paris (France) region.

We do not keep our own access-log database. The providers keep their logs for limited periods under their own settings and terms.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a website that loads reliably and is protected against misuse.

3. Cookies and browser storage

We do not use cookies or storage for advertising, analytics or tracking. The site stores the following in your browser, only to provide functions you use:

• Your sign-in session, your "keep me signed in" choice and the time of your last activity, so we can sign you out after a period of inactivity.
• Your theme (dark or light) and your language choice.
• Course progress if you study without an account. This stays in your browser, is not sent to us and does not lead to a certificate.
• Whether the SENTINEL companion has already greeted you.
• On the sign-up, sign-in, password reset and some admin pages: a security check by Cloudflare Turnstile, which reads browser and device signals to tell people from automated bots.

This storage is strictly necessary for a service you have asked for, so it does not need consent (Section 25(2) no. 2 of the German TDDDG and Art. 5(3) of the EU ePrivacy Directive). Where it involves personal data, the legal basis is Art. 6(1)(b) GDPR for signed-in users and Art. 6(1)(f) GDPR for visitors without an account. Our legitimate interest is to remember the settings you chose and to keep the site secure. You can delete it at any time in your browser settings. You will then be signed out and your settings will reset.

4. Contact form

When you send the contact form, we receive:

• An optional form of address, such as a first name, initials or an alias
• Your email address
• The topic you chose and your message
• A submission time and a non-reversible keyed digest made from network and browser signals, used only to block spam and abuse

We do not need your full or legal name. Do not include names or identifying details of injured people, witnesses or other people involved in an incident.

Resend delivers the message by email to our address [email protected], and Cloudflare Email Routing forwards it to our mailbox.

We use your details only to answer your enquiry. We do not add you to a mailing list.

Legal basis: Art. 6(1)(b) and (f) GDPR for answering your enquiry, and Art. 6(1)(f) GDPR for spam protection.

5. Accounts, courses and certificates

If you create an account, we process your first and last name, your verified email address, a password record, your optional country, your confirmation that you have read the Privacy Policy and accept the Terms of Use, sign-in times and security data. Supabase stores and checks the password. We never receive your readable password. Account emails, such as address verification and password reset, are sent through our sign-in service.

For learners we store the courses you start, completed lessons, your last lesson, your progress, assessment attempts and scores, and certificate eligibility. When you complete a course, we issue a certificate with your profile name, the course, the issue date, your score, a certificate ID and its status, and we can email the certificate to you through Resend. Email verification does not prove a person's legal identity.

Anyone with a certificate ID can check it on our verification page. That check shows only the holder's profile name, the course title, the issue date, the certificate ID and whether it is valid.

The sign-up, sign-in, password reset and some admin pages use Cloudflare Turnstile to tell people from automated bots. Turnstile processes browser and device signals. Cloudflare runs this check for us, and also uses the signals on its own account to improve its bot detection, as described in its Turnstile privacy addendum.

Legal basis: Art. 6(1)(b) GDPR (the account service you request). Security checks, fraud prevention and reliable certificates are also our legitimate interest under Art. 6(1)(f) GDPR.

6. Tools you save to your account

Signed-in users can save records in our tools: risk assessments, job safety analyses, toolbox talks, inspection checklists, incident investigations, COSHH records and the Career Compass. These records are stored in our Supabase database in the EU. Only you can read them, or the authorised members of your organisation where you use a tool through an organisation account.

Incident and assessment records should describe people by their role, for example "injured worker", "operator" or "witness A". Do not enter names, medical details, employee numbers or contact details of other people.

COSHH exposure monitoring and health surveillance should be recorded by job group, not by named worker. Results linked to an identifiable person, especially biological monitoring, are health data, a special category of personal data. Do not enter workers' names next to monitoring or health surveillance results, and remove names from lab or monitoring reports before you upload them.

Where you use a tool through an organisation account, your organisation decides what is recorded and is responsible for that data. We store it on the organisation's behalf.

In the COSHH tool you can upload Safety Data Sheets (SDS) and monitoring documents. They are kept in private Supabase file storage with the same access rules. If you delete a chemical or your account, we delete the database records at once and also try to delete the uploaded files. A storage error can occasionally leave a file behind. If that happens, it stays in storage until we find and remove it.

Legal basis: Art. 6(1)(b) GDPR.

7. HSE Guide and AI features

Five features send content to the Google Gemini API. They are available only to signed-in users with a verified email address, and are meant for users aged 18 or over:

• The HSE Guide: your question, the mode, jurisdiction and industry you selected, and up to 12 recent messages of the conversation, so Gemini can answer and, where available, find source links.
• Inspection checklist drafts: the inspection type, work area, jurisdiction and industry you enter.
• Toolbox talk drafts: the task or topic, jurisdiction and industry you enter.
• COSHH SDS extraction: the whole uploaded SDS file, so Gemini can read out fields such as hazard classification and storage needs.
• COSHH suggested wording: the task, chemical and control details of an assessment, so Gemini can suggest control actions and spill and waste wording.

AI results are drafts. Nothing is saved to a record until you review and accept it, and the features do not make decisions about you.

We do not store HSE Guide conversations. The conversation stays in your browser until you reset it, reload the page or close it. We keep only a daily request count per account and per feature, to apply usage limits, and delete those counts after 31 days.

We currently use Google's free (unpaid) Gemini API service. Under Google's terms, Google may use what you submit and the answers it generates to improve its products, and human reviewers at Google may read them. For this processing Google acts under its own terms and privacy policy, not on our instructions. For that reason, do not enter personal, medical, confidential or legally privileged information, or details that identify anyone involved in an incident.

Google's terms do not allow its free service to be used by people in the EU, the EEA, the UK or Switzerland. We therefore switch the AI features off for visitors from those countries, based on the country our network provider Cloudflare detects from your connection. We do not store that country. All other tools work as normal there, and drafts can be filled in by hand.

Legal basis: Art. 6(1)(b) GDPR (the answer or draft you request) and Art. 6(1)(f) GDPR (usage limits and abuse prevention).

8. SENTINEL companion

SENTINEL is the owl guide in the corner of the website. It does not store anything you type. It counts anonymously which part of the site it was opened on and which suggestion was used. These daily counts contain no IP address, account or other identifier.

9. Security and abuse prevention

To protect sign-in, contact, assessment, certificate and account functions, we keep request counters linked to a pseudonymous keyed digest rather than your raw IP address, and delete them after 31 days. Administrator actions are recorded in an audit log. All connections use encrypted HTTPS, and our providers receive only the access they need. No online service can promise complete security. If a personal-data breach occurs, we will assess it and notify the authorities and the people affected where the law requires.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is keeping the site and your data safe.

10. Service providers

We do not sell personal data or share it for advertising. These providers process data for us:

We may also disclose data where the law requires it, for example to an authority or a court.

11. Transfers outside the EU

Our database and server functions are in the EU. Email delivery and the AI features involve providers in the USA, Cloudflare runs a worldwide network, and Vercel is a US company. Personal data can therefore be processed outside the EU, the EEA and the UK.

For these transfers we rely on the EU-US Data Privacy Framework where the provider is certified under it. Otherwise we rely on the EU Standard Contractual Clauses in the provider's data processing terms (Art. 46(2)(c) GDPR). For data from the UK and Switzerland, the UK Extension and the Swiss-US Data Privacy Framework, or the UK Addendum to the clauses, apply in the same way. The free Gemini service is the exception: Google processes that data under its own terms, as described in section 7. You can ask us for details of the safeguard that applies to your data.

12. How long we keep data

• Contact enquiries: deleted from our mailbox no later than 12 months after our last substantive exchange, unless you ask for earlier deletion or we must keep them for a documented legal claim or duty.
• Accounts, course progress, certificates and saved tool records: while your account is open.
• Account deletion removes your sign-in record, profile, progress, assessment history, certificates and saved tool records, including COSHH records. Uploaded files are deleted on a best-effort basis, as described in section 6. Public certificate verification stops at once. Copies in provider backups and security logs expire later, under the provider's backup cycle.
• HSE Guide conversations: not stored by us. Daily usage counts: 31 days.
• Security counters: 31 days.
• Hosting, delivery and security logs: for the shortest period the provider's settings allow that still covers security and incident investigation.

We review stored enquiries at least every three months and delete or anonymise what is no longer needed. A legal hold pauses deletion only for information relevant to a specific claim or legal duty.

13. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15)
• have inaccurate data corrected (Art. 16)
• have your data deleted (Art. 17)
• restrict how we process it (Art. 18)
• receive your data in a portable format, where the legal conditions apply (Art. 20)
• withdraw any consent you have given, at any time and with effect for the future (Art. 7(3))

To use any of these rights, email [email protected]. We may ask for reasonable information to confirm that a request concerns your own data. We answer without undue delay and within one month, which the law allows us to extend in some cases.

You can also complain to a data protection supervisory authority, in particular in the EU country where you live or work or where you believe the infringement took place (Art. 77 GDPR). In the UK, this is the Information Commissioner's Office (ICO). In Switzerland, it is the Federal Data Protection and Information Commissioner (FDPIC).

14. Other information

Do you have to give us your data?

No law requires you to. Some data is needed for a function to work: we cannot reply without your email address, and we cannot provide an account, saved progress or certificates without the account details. Everything else is optional.

Automated decisions

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR). The HSE Guide produces general educational text. Do not use its output to decide on employment, discipline, medical treatment, insurance, legal liability or access to services.

Children

The site is meant for professionals and higher-education learners, not children. We do not knowingly collect data from children. If you believe a child has sent us personal data, contact us and we will check and delete it.

Not for emergencies or confidential information

The contact form and the HSE Guide are general channels for learning and enquiries. Do not use them for emergencies, medical information, confidential records or the names of people involved in an incident. In an emergency, contact local emergency services and the people responsible on site.

Rights in other countries

Privacy laws outside the EU and UK may give you further rights, such as the right to know, to opt out of certain disclosures or to appeal a decision. We do not sell personal data or share it for cross-context behavioural or targeted advertising. If such a law applies to you, you can use those rights through the same email address. Being able to open this site from a country does not by itself mean that country's law applies.

External links

This site links to external sources, including news articles we collect and reference. Those sites are run independently, and their own privacy practices apply once you leave our site.

Legal and service references

• EU General Data Protection Regulation, official text
• European Commission, GDPR processing principles
• UK Information Commissioner, data protection principles
• Google Gemini API terms

Changes to this policy

We update this policy when our data practices, providers or legal requirements change. The date at the top shows the current version. We will point out important changes clearly on the site.