What we do with the people named in your pack
Your pack names people: who is on the roster, who decides on a lockdown, sometimes who would need help getting out. They did not sign up to us, you entered them, and that makes you responsible for what your procedures say and us responsible for handling it properly. This page is the written version of that, and you can rely on it.
Who is responsible for what
You are the controller of the details you enter about your staff and your building. You decide what goes into your procedures, and you decide when a name comes out of them. We are the processor: we hold that information, turn it into your documents, and do nothing else with it. We do not sell it, we do not use it to train anything, and we do not use it for our own purposes.
For your own account details, the email you sign in with and what you pay, we are the controller. That half is covered by our privacy notice.
What we do on your instruction
We process this data only to provide the service: to build your pack, to let your staff confirm they have read it, to keep the record of who confirmed what, and to support you when you ask. If you tell us to delete something we delete it, subject to the two exceptions in our privacy notice: records of what you paid, which UK tax law requires us to keep for six years, and backups, which expire on their own schedule within seven months.
If one of your staff asks us to remove their details, we will tell them to ask you, and we will tell you they have asked. That is not us passing the parcel: your procedures are your document, and we cannot decide that a name should come out of your lockdown plan. We will act on your instruction within thirty days.
Who else sees it
Four companies, and only these four. Each sees the least it can.
| Hostinger | Runs the server and the database, so it holds everything the service holds. Account region being confirmed and will be stated here. |
|---|---|
| Google (Workspace) | Sends and receives our email. Sees the address we are writing to and what the message says, which is your venue name and a link. |
| Google (Drive) | Holds our offsite backups, encrypted before they leave our server. Google stores the encrypted files and does not have the key, so it cannot read your data, your staff names or anything else in them. This is worth saying plainly because it is unusual. |
| Stripe | Takes the payment. Sees the buyer's email, billing address and card details, and issues the VAT invoice. Sees nothing about your building or your staff. |
| Anthropic | Runs the check on your answers before your documents are made. Sees your answers about the building. It is not sent the names of anyone on your roster: it gets how many people there are and what roles they hold, and nothing that identifies them. It is sent no email addresses, no contact details and nothing about billing. |
No third-party names leave this building
The only place you name other people is your staff roster, and that is the one thing we deliberately do not pass on. Our reviewer works from counts and roles. Your backups are encrypted before they reach anybody else. So the names of your staff exist in your pack, in our database, and nowhere else.
How long we keep it
While your account is open, and for twelve months after you close it, so that your compliance evidence does not vanish the moment you stop paying. Then it is deleted. The exceptions, again, are payment records for six years and backups expiring within seven months.
If something goes wrong
If we discover a breach affecting your data we will tell you without undue delay and within seventy-two hours of becoming aware of it, with what we know, what we are doing, and what you may need to do. We would rather tell you early with an incomplete picture than late with a tidy one.
Getting your data out
You can download your pack and your attestation records at any time, including after you cancel, without asking us. If you want everything we hold in a machine-readable form, write to hello@fourdrills.co.uk and we will send it within thirty days.
This agreement forms part of our terms. If you need it signed as a separate document for your own records, or your insurer or funder needs a particular form of words, write to us and we will do it.