Privacy Policy

1. Introduction

ExpiryTrack respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use, store, share and protect personal data when you visit our website, register an account, subscribe to our services or use the ExpiryTrack application.

ExpiryTrack is an equipment inspection, certification and renewal tracking service operated by:

Stuart Howitt trading as ExpiryTrack

Elderflower House
Carbrooke
Thetford
IP25 6SS
United Kingdom

Email: appsupport@stuarthowitt.co.uk

For the purposes of UK data protection legislation, Stuart Howitt is the data controller for personal information processed for account administration, billing, communications and the operation of ExpiryTrack.

Where we process personal data contained within equipment records or documents uploaded by business customers, we generally act as a data processor on behalf of the relevant customer.

This policy should be read alongside our Terms of Service and Data Processing Agreement.

2. Information We Collect

We collect and process information necessary to provide and maintain the ExpiryTrack service.

Account information

When you register or use ExpiryTrack, we may collect:

• Your name.
• Email address.
• Business or organisation name.
• Account identification details.
• Subscription plan and account status.
• Authentication and security information.
• Communications and support requests.

Equipment and inspection records

When using ExpiryTrack, you may enter information including:

• Equipment identification numbers.
• Asset descriptions and locations.
• Inspection and examination dates.
• Renewal and expiry dates.
• Inspection histories.
• Names of inspectors or competent persons.
• Contractor or service provider details.
• Uploaded inspection certificates.
• Maintenance records and related documents.

Some of these records may contain personal information.

The business customer is responsible for ensuring it has a lawful basis for collecting and uploading information relating to other individuals.

Billing and payment information

When you purchase a subscription, payments are processed by Stripe.

We may receive information including:

• Subscription plan.
• Billing status.
• Payment confirmation.
• Transaction references.
• Customer billing identifiers.
• Invoice information.

We do not receive or store your full payment card number or card security code.

Stripe processes payment information in accordance with its own privacy and security arrangements.

Technical and usage information

When you access ExpiryTrack, technical information may be collected by the application or its service providers.

Depending on the technologies used, this may include:

• IP address.
• Browser type and device information.
• Login and authentication activity.
• Application errors.
• Security and diagnostic logs.
• Dates and times of service access.

This information may be used to maintain, secure and troubleshoot the service.

3. How We Use Your Information

We use personal information for the following purposes:

Providing the service

To create accounts, manage subscriptions, maintain equipment records, store certificates, generate reports and deliver inspection reminder notifications.

Account administration

To manage access, respond to enquiries, provide technical support and communicate important account information.

Payment processing

To administer subscriptions, process payments, manage billing and maintain appropriate financial records.

Security and reliability

To protect accounts, investigate suspected misuse, diagnose technical problems and maintain the security and availability of the platform.

Legal and regulatory obligations

To maintain records and comply with applicable accounting, taxation, data protection and other legal requirements.

Service communications

To send necessary information concerning subscription renewals, payment issues, service changes, security matters and updates to our terms.

We do not sell customer personal data to advertisers or data brokers.

We do not use customer-uploaded inspection records or certificates for unrelated marketing purposes.

4. Our Legal Basis for Processing

Under UK GDPR, we must have a lawful basis for processing personal data.

Depending on the circumstances, we rely on:

Where we rely on legitimate interests, we consider whether the processing is necessary and whether those interests are overridden by individuals' rights and freedoms.

Where consent is used, it may be withdrawn at any time without affecting the lawfulness of processing already carried out.

When processing personal data contained in customer-managed equipment records, we normally act on the documented instructions of the business customer rather than determining the purpose or lawful basis ourselves.

5. Business Customer Data

ExpiryTrack allows businesses to store equipment records, inspection information, certificates and associated documents.

The business customer is generally the data controller for any personal information contained within those records.

ExpiryTrack acts as a data processor when storing or otherwise handling that information on the customer's behalf.

We process customer-managed information only as necessary to provide the service, follow lawful documented instructions or comply with applicable legal requirements.

Our Data Processing Agreement describes the respective responsibilities of ExpiryTrack and its business customers.

If you are an individual whose information appears in an inspection certificate or other record uploaded by a business customer, you should normally contact that business in the first instance to exercise your data protection rights.

We will assist the relevant customer in responding to lawful requests where required.

6. Sharing Your Information

We may share personal information with trusted service providers where necessary to operate ExpiryTrack.

These may include:

Application hosting and infrastructure providers

To host the application, maintain its underlying systems and provide database or document storage.

Payment processors

Stripe processes payments, manages subscriptions and provides billing services.

Authentication and security providers

To support secure account access and protect the platform.

Email delivery providers

To send inspection reminders, subscription notifications and essential service messages.

Calendar services you choose

If you turn on the calendar feed, the calendar app or service you add it to (for example Google Calendar, Microsoft Outlook or Apple Calendar) fetches your item names, check types and due dates from your private feed link. That service handles the data under its own privacy terms. You can stop this at any time by removing the calendar or creating a new link in Settings.

Professional advisers and authorities

Where reasonably necessary for legal, accounting, regulatory or compliance purposes.

We require processors acting on our behalf to handle personal information under appropriate contractual and data protection obligations.

We may disclose information where required by law or where necessary to establish, exercise or defend legal claims.

We do not sell customer records, inspection histories or uploaded certificates to third parties.

The sub-processors we currently use are listed in Schedule 2 of our Data Processing Agreement.

7. International Data Transfers

Some service providers may process or access personal data outside the United Kingdom.

Where personal data is transferred internationally and a restricted transfer occurs, we will ensure that an appropriate lawful transfer mechanism is in place.

This may include a UK adequacy regulation, the UK International Data Transfer Agreement or an appropriate UK Addendum to standard contractual clauses.

Details of relevant international processing arrangements may be requested by contacting us.

8. Data Security

We take reasonable and appropriate steps to protect personal information against unauthorised access, accidental loss, alteration, disclosure and destruction.

Security measures are selected according to the nature of the information and the risks associated with processing it.

These may include authentication controls, restricted access, encrypted communications, appropriate hosting security and monitoring for suspicious activity.

No internet-based service can guarantee absolute security.

Users are responsible for protecting their account credentials and notifying us promptly if they suspect unauthorised access.

We regularly consider the security measures necessary to operate the service safely.

9. Data Retention

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including applicable legal, accounting and regulatory requirements.

Our retention approach depends on the type of information.

Active account information

Account information is normally retained while your ExpiryTrack account remains open.

Equipment records and certificates

Customer-managed records remain associated with the account while it is active, unless the customer deletes them or closes the account.

Subscription and billing records

Relevant transaction and accounting information may be retained for periods required by applicable UK tax, accounting and other legal obligations. Invoices and payment records are also held by Stripe.

Support communications

Customer support correspondence is retained only for as long as reasonably necessary to manage the enquiry, maintain appropriate business records or address potential disputes.

Technical and security records

Operational and security information is retained in accordance with the applicable system and service-provider retention arrangements.

Backups

Information removed from active application systems may temporarily remain within protected backups until those backups are overwritten or securely deleted under the applicable backup retention arrangements.

Where data is retained in backups after deletion from active systems, it will be protected from ordinary use and access, except where legitimately required for recovery, security or legal purposes.

We will review retention arrangements periodically and remove information when there is no longer a valid reason to retain it.

10. Account Closure and Data Deletion

You can close your account yourself at any time: open Settings, go to your data section and choose Delete my account. You may also request closure by emailing:

appsupport@stuarthowitt.co.uk

If you ask us by email, we may ask you to verify account ownership before proceeding.

We will complete closure requests made by email as soon as practicable and in any event within one month. Data belonging to an account that has been removed by us is cleared by a scheduled weekly clean-up.

Closing an ExpiryTrack account permanently removes the account and its associated equipment records, inspection histories and reminder settings from the active application, and cancels any active paid subscription. Certificates and documents you uploaded are no longer accessible through your account; copies held in the underlying storage are removed in line with the platform's storage arrangements.

Before closing your account, you should export any records or certificates you need to retain.

Account closure is intended to be permanent and cannot be reversed through the application.

Deleting your account does not necessarily result in the immediate deletion of information contained in protected system backups or records we are legally required to retain, such as invoices and payment records.

Any remaining information will be handled in accordance with this Privacy Policy and applicable legal requirements.

Cancelling a paid subscription does not automatically delete your account.

If you wish to stop paying for ExpiryTrack but retain your records, you may cancel your subscription and continue using the Free plan, subject to its applicable limits.

11. Your Data Protection Rights

Under UK GDPR, you may have the following rights in relation to your personal data:

• Right of access: Request a copy of personal information we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete information.
• Right to erasure: Request deletion of personal information in circumstances where this right applies.
• Right to restrict processing: Request that certain processing activities are limited.
• Right to data portability: Receive certain personal information in a structured, commonly used and machine-readable format where applicable.
• Right to object: Object to processing carried out on certain lawful bases, including legitimate interests.
• Rights relating to automated decisions: Exercise applicable rights where decisions are made solely by automated means and produce legal or similarly significant effects.
• Right to withdraw consent: Withdraw consent at any time where consent is the basis for processing.

These rights are subject to applicable legal conditions and exemptions.

To exercise your rights, contact appsupport@stuarthowitt.co.uk.

We may request reasonable information to verify your identity before responding.

We will respond within the time limits required by applicable data protection legislation.

Where information is controlled by a business customer rather than ExpiryTrack, we may direct your request to the relevant organisation.

12. Cookies and Similar Technologies

ExpiryTrack may use cookies or similar technologies necessary for account authentication, session management, security and essential application functionality.

Additional technologies, such as optional analytics, will be subject to applicable privacy and electronic communications requirements.

Where consent is required for non-essential cookies or similar technologies, we will request it before using them.

Further information about the technologies actually used by the application will be made available where required.

13. Marketing Communications

We may contact customers about important operational matters, including subscription status, billing issues, security updates and changes affecting the service.

These are service communications rather than optional marketing messages.

If we introduce promotional emails or marketing campaigns, we will comply with applicable UK electronic marketing and privacy requirements.

Where consent is required, it will be obtained before marketing communications are sent.

Marketing preferences can be changed or consent withdrawn using the method provided in the communication or by contacting us.

14. Children's Privacy

ExpiryTrack is intended for business and professional use by individuals aged 18 or over.

We do not intentionally offer accounts to children or knowingly collect personal information directly from children as account holders.

If we become aware that an account has been created in breach of this requirement, we may take appropriate steps to restrict or close it.

The service is not intended for storing personal information about children.

15. Personal Data Breaches

We maintain procedures for responding to suspected personal data breaches.

Where a breach occurs, we will assess its nature, potential impact and applicable reporting requirements.

Where legally required, we will notify the Information Commissioner's Office and affected individuals.

Where we act as a data processor, we will notify the relevant business customer without undue delay after becoming aware of a personal data breach affecting data processed on its behalf.

16. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our services, technology, legal obligations or data processing practices.

The latest version will be published within ExpiryTrack.

Where changes materially affect how personal information is processed, we will provide appropriate notice before the changes take effect.

The date at the top of this document indicates when it was last updated.

17. Complaints and Contact Information

If you have concerns about how we handle your personal information, please contact us first so we can investigate.

Stuart Howitt trading as ExpiryTrack

Elderflower House
Carbrooke
Thetford
IP25 6SS
United Kingdom

Email: appsupport@stuarthowitt.co.uk

You also have the right to raise concerns with the UK's data protection regulator:

Information Commissioner's Office (ICO)

Website: https://ico.org.uk
Telephone: 0303 123 1113

We encourage you to contact us first, although you are not required to do so before contacting the ICO.