Privacy notice

Risk-Mngr · Version 1.1 · Effective 5 October 2026

This notice explains how personal information is handled in Risk-Mngr, the health, safety, environmental and quality compliance service at risk-mngr.ai. It covers people who use Risk-Mngr and people named in the records kept in it. Our website, oe-services.com, has its own privacy policy.

1. Who we are

Risk-Mngr is provided by O E Services Limited (“OE Services”, “we”), a company registered in England and Wales under number 05113216, whose registered office is at Studio 21, Sum Studios, 1 Hartley Street, Sheffield S2 3AQ. We are registered with the Information Commissioner’s Office under number ZA119678. For anything about privacy, email privacy@oe-services.com or call +44 20 8720 7015.

2. Your organisation is in charge of its records

Risk-Mngr is used by organisations, our clients, to keep their health, safety, environmental and quality records. The organisation that gave you access, usually your employer or the business you are working for as a contractor, decides what is recorded and why. In data protection terms it is the controller of that information, and we are its processor: we hold and use the information only on its instructions, under a written contract that meets Article 28 of the UK GDPR.

The same applies if you are named in a record, for example as an injured person, a witness or an inspector: the organisation that keeps the record is responsible for it.

So for questions about what is recorded about you, or to use your rights over it, please contact that organisation first. If you contact us instead, we will pass your request to them and help them answer it. We are the controller only for the information described in section 6.

3. What Risk-Mngr holds for your organisation

• Your account. Your name, work email address, the sites you can use and your access level. Accounts are created only by invitation from your organisation. Your password is held only in scrambled (hashed) form by our sign-in provider, so nobody can read it. Risk-Mngr also notes when you were last active in it, so your organisation’s administrators can see who is using it; only the latest time is kept, not a history.
• Records. Whatever your organisation records in its forms: inspections, checks, training, accidents and incidents, with any photographs and documents attached. These can include information about health, such as injuries and first aid given, which is special category data under the UK GDPR. Your organisation must have a lawful basis, and an appropriate condition, for recording it.
• Who did what. Each record keeps who created it and who last changed it, and keeps its earlier versions when it is edited. Separately, an activity log records significant actions, such as access being granted or a record being deleted, and an email log records the reminder emails sent. Both logs are kept for 30 days.
• Emails. Invitations, password resets and due-date reminders are sent to your work email address.

We do not use this information for automated decision-making or profiling.

4. How long it is kept

• Records and accounts: for as long as your organisation keeps them while it uses Risk-Mngr. When it stops, it can ask for a full copy within 30 days, and we then delete its information from the service within a further 30 days.
• Activity log and email log: 30 days.
• Backups: the service is backed up every night to a separate provider, and backups are kept for up to 35 days. Information deleted from the service therefore leaves the backups within about five weeks.

5. Where it is stored, and who helps us run the service

Each provider works under a contract that requires it to protect the information and to use it only to provide its service to us. Organisations using Risk-Mngr are told before we add or replace one.

Ireland and the Netherlands are in the European Economic Area, which the UK recognises as protecting personal information adequately. Emails are sent through Resend in the United States. That transfer is covered by the UK Extension to the EU-US Data Privacy Framework, under which Resend is certified, and by the UK Addendum to the EU Standard Contractual Clauses. All four providers are headquartered in the United States; where their staff may need access to support their service, safeguards of the same kind in their data processing terms apply.

We do not sell personal information or share it for anyone else’s marketing. We share it otherwise only with our professional advisers where needed, or with regulators, law enforcement or courts where the law requires it.

6. Information we hold for ourselves

For the following, OE Services is the controller.

Emails you send us are kept by our mailbox provider, Zoho Mail, in European data centres.

7. Cookies

Risk-Mngr sets only the cookies needed to sign you in and keep you signed in securely. Their names begin with “sb-”. Because they are strictly necessary, they do not need your consent. They are removed when you sign out, and otherwise expire after at most 400 days. There are no analytics, advertising or tracking cookies, and the performance measurements in section 6 use no cookies at all.

8. How we protect it

• Encrypted connections, and encryption of the database and stored files.
• Access checked by the database itself on every request, so each organisation’s information is kept apart from every other’s.
• Accounts by invitation only, with repeated sign-in attempts blocked.
• Attachments reachable only through short-lived private links.
• Nightly backups held with a separate provider.

If a security breach affects information in Risk-Mngr, we tell the organisation responsible without undue delay, so that it can meet its own duties, including reporting to the Information Commissioner’s Office within 72 hours where required. Where we are the controller, we report to the ICO ourselves.

9. Your rights

You can ask for a copy of your information, have it corrected or deleted, restrict or object to how it is used, receive it in a portable format, and withdraw consent where consent is relied on. Some rights depend on the circumstances: for example, an organisation may need to keep accident records for as long as the law requires.

• For information held in Risk-Mngr (sections 3 and 4), contact your organisation. We will help it respond.
• For information we hold for ourselves (section 6), email privacy@oe-services.com. We respond within one month, free of charge.

10. Complaints

If you are unhappy with how your information has been handled, please tell us first at privacy@oe-services.com. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113. If you live in the European Economic Area, you can contact your local data protection authority, listed by the European Data Protection Board.

11. Changes to this notice

We review this notice at least once a year. When we change it, the version and date at the top change too.

12. Contact

Data Protection, O E Services Limited, Studio 21, Sum Studios, 1 Hartley Street, Sheffield S2 3AQ, United Kingdom.
privacy@oe-services.com · +44 20 8720 7015