Privacy Policy
This policy explains how BadgerRMS ("we", "us") handles personal data under the UK GDPR and the Data Protection Act 2018.
Operator details to be completed before launch: registered company name, company number and registered office address.
1. Two different roles
- Our customers' data (we are the processor). Organisations using the Service enter information about their own customers, crew, suppliers, contacts and equipment. The organisation decides what to enter and why: it is the controller, and we process that data on its behalf under our Terms. If you are an individual whose details are held by one of our customers, please contact that organisation first about your rights.
- Account and website data (we are the controller). For the people who sign up for and sign in to the Service, and for visitors to this website, we decide how data is used. That is what the rest of this policy covers.
2. What we collect
- Sign-up and account details: your name, work email address, organisation name, workspace code, a salted hash of your password (we never store your password itself), and the date you accepted our terms.
- Activity records: an audit log of key actions in the Service, and — when someone signs a document online — their name, email, time, IP address and browser details.
- Security data: a one-way hash of the IP address used for sign-up, kept only to limit abuse (for example repeated sign-ups).
- Email you send us: messages to support@badgerrms.co.uk and our replies.
3. Cookies
We use a single session cookie that keeps you signed in and protects forms from cross-site request forgery. It is strictly necessary for the Service to work, so no consent banner is needed. We do not use advertising, analytics or tracking cookies.
4. How and why we use it (lawful bases)
- To create and run your account, provide the Service and support you — performance of a contract.
- To keep the Service secure, prevent abuse and fraud, and keep records of activity — legitimate interests in running a safe service.
- To send service messages (for example about your trial, security or changes to our terms) — contract and legitimate interests. We do not send marketing email unless you ask us to.
- To meet legal obligations — legal obligation.
5. Who we share it with
We do not sell personal data. We use a hosting provider to run the Service and store data, and, if you choose to connect Xero, we send the invoice data you ask us to send to Xero using your own connection. If you connect your own mail server, we keep its address and login so the Service can send the emails you ask it to send, and we send those emails (and any attachments you choose) through that server. If you use the Current RMS transfer with an API key, the key is used for that transfer only and is not stored. We may disclose data where the law requires it or to protect our legal rights. Where a provider is a processor for us, it is bound by a written contract.
6. Security — what we actually do
- All traffic between your browser and the Service uses HTTPS (TLS) encryption.
- Each organisation's records are kept in its own separate database file, which is not reachable from the web, so records from different organisations are never mixed.
- Passwords are stored only as salted hashes. Forms are protected against cross-site request forgery.
- Access to the underlying servers is limited to those who need it.
We do not currently add application-level encryption to the database files themselves; they are protected by access controls and by our hosting provider's infrastructure. No online service is completely secure, and you should keep your own copies of important data.
7. How long we keep it
We keep account data while your organisation is active. After an organisation closes, or a trial ends without a paid plan, we may delete the organisation and its database; on request we will delete or return it (see the Terms). We may keep limited records longer where the law requires or to deal with disputes.
8. International transfers
Where personal data is transferred outside the UK, we make sure a lawful transfer mechanism applies, such as an adequacy decision or the UK International Data Transfer Agreement or Addendum.
9. Your rights
Subject to the law, you can ask us to: give you a copy of your personal data; correct it; delete it; restrict or object to our processing; and give you your data in a portable format. Where we rely on consent you can withdraw it at any time. Contact support@badgerrms.co.uk — we will respond within one month.
10. Complaints
If you are unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113.
11. Children
The Service is for businesses and is not aimed at anyone under 18.
12. Changes
We will update this policy as the Service changes and show the date at the top. For material changes we will give reasonable notice.
13. Contact
Privacy questions or requests: support@badgerrms.co.uk.