Privacy Notice

1. Who we are

ManageCDM is operated by New Forest Safety, United Kingdom. New Forest Safety is the data controller for personal data processed to run your account and the Service. Where your organisation uploads project information about other people, your organisation is the controller of that content and we process it on its behalf.

2. Data we collect and why

• Account data (name, email, password, company name, role) – to create and secure your account. Legal basis: performance of a contract.
• Project content (project details, dutyholder contacts, documents, risk records) – to provide the Service. Legal basis: contract.
• Support messages – to answer your enquiries. Legal basis: contract and legitimate interests.
• Usage and device data (IP address, browser, device identifiers, activity and audit logs) – for security, fraud prevention, troubleshooting and improving the Service. Legal basis: legitimate interests.
• Billing records (plan, subscription status) – to manage your subscription. Legal basis: contract and legal obligation.
• Marketing emails – only where you have opted in. Legal basis: consent, which you can withdraw at any time.

3. Who we share data with

• Service providers who host and operate the Service (cloud hosting, database, email and AI processing providers), under contract.
• Paddle.com, our Merchant of Record, for the sale of subscriptions, payment processing, subscription management, tax compliance and invoicing. Paddle collects payment details directly; we never see or store your full card details.
• Professional advisers such as lawyers and accountants.
• Authorities where required by law.

4. International transfers

Some providers may process data outside the UK. Where they do, we rely on UK adequacy regulations or appropriate safeguards such as the UK International Data Transfer Addendum or Standard Contractual Clauses.

5. Retention

We keep account data while your account is active. After cancellation, project records are kept read-only for a retention period so you can export them, then deleted or anonymised. Billing records are kept as long as required by law.

6. Your rights

Under UK GDPR you have the right to access, rectify, erase, restrict or object to processing of your personal data, to data portability, and to withdraw consent. We respond within one month. You can also complain to the Information Commissioner's Office (ico.org.uk).

7. Security

We use appropriate technical and organisational measures, including encryption in transit, access controls, company-level data isolation and audit logging.

8. Cookies

We use only essential storage needed to keep you signed in and the Service working. We do not use advertising cookies. You can clear stored data through your browser settings, but you will then be signed out.

9. Contact

Contact New Forest Safety about privacy at hattie@newforestsafety.com.