Privacy Policy

1. Who we are

coshhassessments.co.uk is a UK COSHH assessment generator. For data protection questions, contact us at info@coshhassessments.co.uk.

2. What data we collect

We collect only the minimum data needed to provide the service:

• Purchase records: email address and payment information (via Stripe), credit balance
• Assessment content: not stored on our servers. PDFs are generated in the browser session and delivered directly to you
• Server logs: standard web server access logs (IP address, timestamp, page requested) for security and diagnostics, retained 30 days

3. What we do NOT collect

• Your assessment answers are not stored on our servers
• We do not use tracking cookies or third-party analytics that identify you personally
• We do not sell or share your data with third parties for marketing

4. Legal basis for processing

Under UK GDPR, we process your data on the basis of:

• Contract: to provide the service you have purchased
• Legitimate interests: for security logs and fraud prevention
• Legal obligation: to retain financial records for tax purposes

5. Third-party services we use

• Stripe (payment processing), see Stripe's privacy policy
• Vercel (website hosting), see Vercel's privacy policy
• Supabase (purchase database), see Supabase's privacy policy

6. Your rights under UK GDPR

You have the right to access, correct, or delete your personal data. Email info@coshhassessments.co.uk to exercise any of these rights. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

7. Data retention

Purchase records are retained for 7 years to meet HMRC record-keeping requirements. Server logs are retained for 30 days.

8. Changes to this policy

We may update this policy occasionally. The date at the top of this page shows when it was last updated.