Privacy Policy

Version 1.0 | Effective 2 November 2026

1. Who we are

This privacy notice explains how the three TalkHSE companies identified below collect and use personal data when you visit talkhse.com, contact us, use the TalkHSE Platform or use our consultancy services. It is provided in accordance with the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003:

Company	What it is controller for
TalkHSE Group Limited (company number 15282511)	Our website, talkhse.com: website visitors, cookies, and enquiries and demo bookings made through the website. Marketing to prospective Customers and other business contacts, including people who enquire through the website and people we meet at events
TalkHSE Limited (company number 15756073)	The TalkHSE Platform: Customer Accounts, Primary Owners, Administrators and Authorised Users, billing, security, service usage and support, and service and marketing communications to Customers
TalkHSE Consulting Limited (company number 15755890)	TalkHSE Consulting: consultancy client relationships and contacts, engagement administration, invoicing and records, consultancy records where it acts on its own account (including where it acts as a client’s appointed competent person or carries out incident investigations), and service and marketing communications to consultancy clients

All companies are registered in England and Wales, with their registered office at Arena Offices, 100 Berkshire Place, Winnersh, United Kingdom, RG41 5RD. TalkHSE Limited and TalkHSE Consulting Limited are both subsidiaries of TalkHSE Group Limited. Each company is an independent Controller for its own processing activities described above; they are not joint Controllers under Article 26 of the UK GDPR.

If you have any questions about this policy or how we use your personal data, email us at enquiries@talkhse.com or write to us at the address above. We will make sure your request reaches the right company.

In this policy, “we”, “us” and “our” mean TalkHSE Group Limited for website data, TalkHSE Limited for Platform data and TalkHSE Consulting Limited for consultancy data. The “Platform” means the TalkHSE cloud-based health, safety and environmental management platform available at https://talkhse.com and through any related website or application. Its services include document generation, document storage and version history, incident reporting, dashboards, the health, safety and environmental chatbot known as “TalkBot”, and related support, as described in the TalkHSE Terms and Conditions.

2. When this policy applies

This policy covers personal data that TalkHSE Group Limited, TalkHSE Limited or TalkHSE Consulting Limited decides how to use. That includes data about:

visitors to our website;
people who contact us, book a demo or sign up for a trial;
the Primary Owners, Administrators, Authorised Users and other contacts on a Customer’s Account, such as names, work email addresses, login details, roles, permissions and how the Platform is used;
people who receive our emails and marketing;
consultancy client contacts and people we deal with when delivering our consultancy services;
individuals whose data TalkHSE Consulting Limited holds as Controller, such as witnesses, site personnel and others involved in audits, inspections or incident investigations.

It does not cover Personal Data contained in Customer Data that Customers put into the Platform, such as identification, contact, employment, health-and-safety, training and incident information about Users, workers, contractors, visitors or incident participants. For that data, the Customer is the Controller and TalkHSE Limited is its Processor. We process it only on the Customer’s documented instructions under the Data Processing Addendum in Schedule 2 of the TalkHSE Terms and Conditions. If your employer or another organisation has added your details to the Platform, please contact that organisation about how your data is used.

Where TalkHSE Consulting Limited processes personal data about a client’s workers, contractors or visitors purely on the client’s instructions in delivering our services, the client is the Controller and we act as its Processor under the data processing addendum in our consultancy terms; please contact the client about how that data is used. Where we decide how and why personal data is used, for example when acting as a client’s appointed competent person or conducting an incident investigation using our own professional judgement, TalkHSE Consulting Limited is a Controller and this policy applies.

3. Personal data we collect

Type of data	Examples
Identity	Name, job title, organisation
Contact	Work email address, phone number, billing address
Account	Username, authentication credentials and identifiers, role, permissions and Account settings
Financial	Billing details and payment history. Card details are taken and held by Stripe; we do not see or store full card numbers. If you pay by bank transfer, we receive the account name and payment details shown on the transfer. Consultancy invoicing is managed through our accounting software provider.
Usage and technical	IP address, browser and device type, log in times, pages and features used, error logs
TalkBot and document generation	Prompts and other content entered into TalkBot or document-generation features, the outputs generated, and associated usage and technical data. Content forming part of Customer Data is processed on the Customer’s behalf as explained in section 2.
Support	Messages, support requests and feedback you send us
Marketing	Your marketing preferences, and whether you open or click our emails
Website	Cookie data, pages visited, and how you move around our website (see section 9)
Consultancy records	Notes, photos, interview and witness records, assessments and reports created when delivering our consultancy services, such as audits, inspections, risk assessments and incident investigations

We collect this data directly from you, from the Customer whose Account you use (for example when an Administrator invites you), automatically when you use our website or the Platform, at events and trade shows (for example when you give us your business card or let us scan your badge), during site visits and consultancy work and from our service providers such as Stripe. Where we ask for information to create or administer an Account, take payment or provide the Services, it is needed for our contract or to take steps requested before entering into it. If it is not provided, we may be unable to open or administer the Account, process payment or provide the relevant Services.

TalkHSE Group Limited and TalkHSE Limited do not ask you to provide special-category data (such as health information) or criminal-offence data for their own controller purposes. Customer Data may nevertheless include health-and-safety, training or incident information determined by the Customer. Where that happens, the Customer must identify an appropriate lawful basis and, where required, an additional condition for processing that data; TalkHSE Limited processes it as Processor under the Data Processing Addendum. Please do not include special-category or criminal-offence data in support messages, TalkBot or document-generation features unless the Customer has determined that it is necessary and lawful to do so.

TalkHSE Consulting Limited may receive health or injury information, and occasionally information about alleged offences or enforcement action (for example HSE investigations or prosecutions), when delivering services to a client, for example during an incident investigation. Where we act as the client’s Processor, see section 2. Where we hold this data as Controller, we rely on the following conditions, as applicable: processing necessary for obligations and rights in connection with employment, including health and safety law (Article 9(2)(b) UK GDPR and Schedule 1, paragraph 1 of the Data Protection Act 2018); processing necessary for the establishment, exercise or defence of legal claims (Article 9(2)(f) UK GDPR and, for criminal-offence data, Schedule 1, paragraph 33 of the Data Protection Act 2018); and, where relevant, preventing or detecting unlawful acts (Schedule 1, paragraph 10). We keep this data to what is necessary and maintain an appropriate policy document where the law requires one.

4. How we use your data and our lawful basis

What we use it for	Lawful basis
Setting up and administering Accounts, giving Authorised Users access, and providing the Platform, including document generation, storage and version history, incident reporting, dashboards and TalkBot	Contract where you contract with us directly; otherwise our legitimate interests in providing and administering the Services for the Customer
Delivering our consultancy services, including competent person advice, audits, inspections, assessments and incident investigations	Contract where you contract with us directly; otherwise our legitimate interests in providing the services to our client
Taking payment, invoicing and recovering money owed	Contract and legitimate interests
Providing support and sending service messages, such as security alerts, renewal reminders and changes to our terms	Contract and legitimate interests
Keeping the Platform secure, preventing misuse and investigating incidents	Legitimate interests and legal obligation
Improving the Platform and our website, including fixing errors and understanding which features are used	Legitimate interests
Answering enquiries and arranging demos	Legitimate interests; or, where you ask us to take steps before entering into a contract, performance of that pre-contractual step
Sending marketing communications about our products and Services to business contacts, including people who enquire or whom we meet at events	Legitimate interests for corporate business contacts; consent or the business-to-business “soft opt-in” where required by the Privacy and Electronic Communications Regulations 2003. You can opt out at any time.
Using non-essential cookies and similar technologies on our website	Consent
Keeping accounting and tax records and meeting other legal duties	Legal obligation

Where we rely on legitimate interests, those interests include operating, securing and improving our business, website and Services; administering Customer relationships; communicating with relevant business contacts; preventing fraud and misuse; and establishing, exercising or defending legal claims. We balance those interests against your rights and reasonable expectations. You can ask us for more detail about that assessment.

We do not make decisions about you based only on automated processing that have a legal or similarly significant effect on you.

Where TalkHSE Consulting Limited processes health, injury or criminal-offence data as Controller in delivering consultancy services, our lawful basis is legitimate interests or contract (as set out above), together with the additional conditions described in section 3.

5. Who we share your data with

We do not sell your personal data. We share it with the following types of recipient under appropriate contractual and confidentiality protections. A provider acting as our Processor may use personal data only on our documented instructions, while a provider acting as an independent Controller is responsible for its own compliance with data-protection law.

Type of provider	What they do for us	Where they are based
The other TalkHSE companies identified in section 1	Provide shared administration and systems and route enquiries or requests to the company responsible for the relevant processing	United Kingdom
Google Cloud Platform / Firebase	Cloud infrastructure, data storage and processing, authentication, messaging and notifications	United Kingdom
OpenAI and Anthropic	Provide AI language-model processing for TalkBot and document generation. These providers act as our Processors and do not use prompts, outputs or other personal data for training their models.	United States
Algolia	Search within the Platform	United Kingdom
Stripe	Take payments and prevent fraud. Stripe acts as an independent Controller for payment processing and fraud prevention; see Stripe’s privacy policy for details.	United States
Customer.io	Send service and marketing emails	European Union
Business software providers	Business email, documents and demo booking	United Kingdom and United States
Website hosting, analytics and advertising providers, including Google Analytics, Microsoft Clarity and Microsoft Advertising	Host our website, measure how it is used and support advertising (analytics and advertising only with your consent). Microsoft acts as an independent Controller for advertising data; see the Microsoft Privacy Statement for details.	United States
Accounting software providers	Invoicing, payment records and bookkeeping	Ireland (EU)

Further information about our current service providers is available on request. Customers can find the current list of Subprocessors in section 9 of Schedule 2 (Data Processing Addendum) to the TalkHSE Terms and Conditions.

We may also share personal data with:

our professional advisers, auditors, insurers and bankers;
for consultancy services, the client who commissioned the work and receives our reports, and associate or subcontracted consultants working with us under confidentiality obligations;
enforcing authorities such as the Health and Safety Executive or local authorities, for example where an incident is reportable under RIDDOR or forms part of an investigation;
a buyer or investor if we sell or restructure all or part of our business, in which case we will notify affected individuals if their personal data will be transferred to a new controller;
the police, regulators, courts or other authorities where the law requires or allows it.

6. Transfers outside the UK

The Platform’s principal cloud infrastructure and storage are hosted in the United Kingdom. Some providers are based in, or may access personal data from, the United States or the European Union. When personal data is subject to a restricted transfer from the UK, we carry out a transfer risk assessment and use an applicable safeguard or exception, together with any supplementary measures needed, including:

the country has been found by the UK to provide adequate protection, which includes the European Union;
where applicable, the provider participates in the UK Extension to the EU–US Data Privacy Framework;
we have a contract with the provider using the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum.

You can ask us for more information about the safeguard used for a particular provider.

7. How long we keep your data

We keep personal data only for as long as we need it for the purposes in this policy.

Data	How long we keep it
Account and user details	For as long as needed to administer the Account and provide the Services. Customer Data is subject to the 30-day Export Period and the Data Export, Retention and Deletion clause of the TalkHSE Terms and Conditions; limited Account records may be kept for up to 6 years after the Account is closed for legal, security and dispute purposes.
Contracts, Orders, invoices and payment records	6 years after the end of the financial year they relate to
Support requests	2 years after the request is closed
Platform security and access logs	12 months
Enquiries, event contacts and demo bookings that do not lead to a sale	2 years after our last contact
Marketing preferences	Until you opt out. We keep a record of your opt out so we do not contact you again.
Website cookie data	As set out in our Cookie Policy
Consultancy records, including audit reports, assessments and investigation files	Where we are Controller, the longer of 6 years after the engagement ends or any period required by law (some health and safety records must be kept for up to 40 years) or needed for potential claims. Where we act as the client’s Processor, as instructed by the client.

Encrypted backups are overwritten in their normal cycle. We may keep data for longer where we need it to deal with a complaint or legal claim, or where the law requires it.

8. How we keep your data secure

We maintain technical and organisational measures appropriate to the risks presented by our processing and review them periodically. Depending on the processing and risks, our measures include:

encryption of data in transit and at rest;
role-based access controls, so people only see what their permissions allow;
limiting access to personal data to people and providers who need it;
regular backups, monitoring and security testing;
a process for handling security incidents, including notifying affected Customers, individuals and the ICO where required.

You and the Customer are responsible for keeping Account credentials secure, using appropriate access controls and promptly removing former or unauthorised personnel. Tell us without undue delay if you suspect credential compromise, unauthorised Account access or another security incident relating to your Account or the Platform.

9. Cookies

Our website uses strictly necessary cookies to work properly. With your consent, it also uses analytics and advertising cookies, including Google Analytics and Microsoft Clarity. You can accept or reject non-essential cookies through the cookie banner and change or withdraw your choice at any time through the cookie settings tool. The Platform uses strictly necessary cookies to authenticate users, maintain sessions and support security.

Our separate Cookie Policy, available on talkhse.com, explains the categories of cookies and similar technologies we use, their providers and purposes, whether they are essential, how long they last, and how to manage your preferences.

Microsoft Clarity and Microsoft Advertising

With your consent, we use Microsoft Clarity and Microsoft Advertising to understand how you use and interact with our website through behavioural metrics, heatmaps and session replay (which records mouse movements, clicks and scrolling but masks personal data entered into forms), and to improve and market the Platform and Services. Website usage data is collected through first- and third-party cookies and similar technologies to measure website activity and support optimisation, fraud and security monitoring, and advertising. For more information about how Microsoft collects and uses personal data, see the Microsoft Privacy Statement.

10. Links to other websites

Our website and the Platform may contain links to other parties’ websites. We do not have any control over those websites and we are not responsible for the protection and privacy of any personal data which you provide whilst visiting those websites. Those websites are not governed by this Privacy Policy.

11. Your rights

Under UK data protection law, you have the right to:

ask for a copy of the personal data we hold about you;
ask us to correct data that is wrong or incomplete;
ask us to delete your data;
ask us to restrict how we use your data;
object to us using your data based on legitimate interests, including for marketing;
ask for data you gave us that we process by automated means based on your consent or our contract with you, to be sent to you or another organisation in a common format;
withdraw your consent at any time, where we rely on consent.

To exercise any of these rights, email enquiries@talkhse.com. We may ask for information reasonably needed to confirm your identity and locate the relevant data; if so, the response period begins when we have the information we need to verify your identity. We normally respond within one month, although UK data-protection law allows us to extend that period by up to two further months for a complex request or multiple requests; if so, we will tell you within the first month. There is usually no charge, but rights are subject to legal conditions and exemptions, which we will explain where relevant.

If your request concerns Personal Data in Customer Data, the relevant Customer is the Controller. Please contact that Customer in the first instance. Where appropriate and permitted, we will notify the Customer of the request and assist it in responding in accordance with the Data Processing Addendum.

You can unsubscribe from marketing emails at any time using the link in the email.

12. Complaints and changes to this policy

If you are unhappy with how we have used your personal data, please contact us first at enquiries@talkhse.com and we will try to put it right.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection. You can contact the ICO through https://ico.org.uk/make-a-complaint, by telephone on 0303 123 1113, or by post at Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. You may complain to the ICO at any time, although it will usually expect you to have raised the matter with us first.

We may update this policy from time to time. The version number and effective date at the top show when it last changed. If we make material changes, we will tell Customers by email or through the Platform at least 30 days before the changes take effect and, where required, seek fresh consent.