Privacy notice
1. Who we are
Four Point Zero Compliance Limited (company no. 17326139, VAT no. GB 525 6595 65, registered office C/O Towers + Gornall Ltd, River View, 96 High Street, Garstang, Preston, Lancashire, PR3 1WZ) runs the Fire Compliance Vault. Contact us about privacy at james@fourpointzerocompliance.com or 0330 633 4040.
2. Two roles
- Your account and use of the Vault: we are the controller of the personal data described in section 3.
- Documents your organisation uploads: certificates and records can contain personal data, such as names on training records. For that data your organisation is the controller and we process it on its behalf, under its subscription terms with us.
3. What we collect and why
| Data | Why | Lawful basis |
|---|---|---|
| Name, work email, organisation, role and the sites you can access | To create and run your account and control what you can see | Contract with your organisation; our legitimate interests in running a secure service |
| Sign-in times, and a record of changes you make and packs you issue | Security, an audit trail for your organisation, and to support you | Legitimate interests |
| Contact details and other information entered in a new customer setup form | To set up your organisation's Vault and contact you about it | Steps before entering a contract; legitimate interests |
| Email reminders and notices we send you | Expiry alerts, visit confirmations, invitations and password resets | Contract; legitimate interests |
We do not sell personal data, use it for advertising, or use tracking or analytics cookies. The Vault only uses the cookies needed to keep you signed in.
4. Who we share it with
We use these service providers to run the Vault. Each acts on our instructions under a written agreement:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, sign-in and secure file storage | United Kingdom (London) |
| Vercel | Hosting the Vault website | EU and United States |
| Resend | Sending emails | EU and United States |
| Anthropic | Reading uploaded certificates automatically to fill in their details | United States |
| Google Fonts | Supplying the typefaces the website uses (your browser's IP address) | United States |
Where data goes outside the UK, we rely on UK adequacy regulations or appropriate safeguards such as the UK International Data Transfer Addendum. Anthropic does not use data sent through its commercial API to train its models.
We may also share data where the law requires it, or with professional advisers under a duty of confidence.
5. How long we keep it
Account data is kept while you have access and for up to 12 months after, then deleted. Sign-in and audit records are kept for up to 6 years for security and to resolve disputes. Documents are kept and deleted as set out in your organisation's subscription terms. Setup forms that never go ahead are deleted within 12 months.
6. Security
Data is encrypted in transit, files are held in private storage reached only through short-lived links, and database rules keep each organisation's information separate from every other organisation's.
7. Your rights
You can ask for a copy of your personal data, and ask us to correct it, delete it, restrict or object to its use, or move it to another provider. For data in your organisation's documents, please contact your organisation first; we will help it respond. Contact james@fourpointzerocompliance.com.
If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113), but please contact us first so we can try to put it right.
8. Changes
We will update this notice when our practices change and show the date of the latest version above.