Privacy policy.

Who we are

SAMRISK is an online platform for the safety, compliance and land records of buildings and sites. It is a product of Remiam Limited, trading as SAMRISK, a company registered in England and Wales with company number 10829191, whose registered office is at 37 Southgate Street, Winchester, Hampshire, SO23 9EH. In this policy "we", "us" and "SAMRISK" mean Remiam Limited.

We are registered with the Information Commissioner's Office as a data controller, registration number ZA917465.

This policy covers the website at samrisk.co.uk and the SAMRISK application at app.samrisk.co.uk. It follows the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

Our two roles

Data protection law gives an organisation one of two roles for each kind of personal data it handles.

• We are the controller for the data we need to run our own business: your SAMRISK account and profile, company memberships, billing contacts and invoices, support conversations, security and service logs, emails we send you about your account, and visits and enquiries to our website. This policy explains what we do with that data.
• We are a processor for the records your company puts into SAMRISK: its buildings and sites, audits, incidents, visitors, contractors, training records, documents, photos, discussions and everything else it keeps there. Your company is the controller of those records. We use them only to provide SAMRISK to your company and on its written instructions, set out in our data processing agreement, which forms part of our terms.

If you are a visitor, contractor, resident or employee whose details a SAMRISK customer has recorded, the customer is responsible for telling you how it uses your data and for answering your requests. Ask them first. If you write to us, we will pass your request to the customer and help them answer it.

What we collect

Your account

When you create an account or accept an invitation: your name, work email address, phone number (optional), job title and profile photo (optional). Sign in uses your email address with a password or a one-time code sent by email. Passwords are stored only as a one-way hash.

Your company and role

The companies you belong to, your role in each (admin, manager or user), the buildings and sites you are limited to if your admin sets that, and the client you are tied to if your company works for several clients. Invitations record who invited whom and when.

What your company records

As a processor, we hold whatever your company records in the tools it switches on. Depending on those tools this can include:

• Visitors: the name, phone, email and answers to the building's own sign-in questions that a visitor gives on the building's public sign-in page, with the times they signed in and out.
• Contractors: company names, contact names, phone numbers, email addresses, trades, insurance details and accreditations, and permits to work.
• Training: people's courses, certificates, issue and expiry dates, and the certificate files.
• Clients: the people tied to a client and what they may see.
• Incidents: what happened, who reported it and who was involved, and records of occurrence reports a company has made to the Building Safety Regulator. SAMRISK does not send reports to the regulator for you; it keeps the record and the regulator's reference.
• Documents and photos uploaded to any record, which may show or name people.
• Discussions, comments and mentions, and the files attached to them.
• Tasks, audits, inspections, keys, meters, maintenance and land records, which carry the names of the people assigned to them or who completed them.

Please do not record more about people than the work needs. Health and other special category data should only be recorded where your company has a lawful reason to keep it.

The record of who did what

SAMRISK keeps an append-only record of changes, the golden thread and activity log: who created, changed, approved, closed or deleted a record, when, and what changed. It is part of what customers need to show a regulator, so entries are not edited or removed while the record exists.

Billing

For paid plans: the billing contact's name and email, the company's billing address and VAT number if given, the plan and tools bought, and invoices and payment status. Card details are entered on our payment provider's own secure form and go straight to it. We never see or store card numbers.

Support

What you tell us in a support ticket or email, with the replies, and the name and role of whoever raised it.

When you use SAMRISK

Service and security logs: IP address, browser and device type, the time of each request and the page or action, sign ins and failed sign ins. Your settings, such as notification choices, starred tools and sidebar layout.

Our website

On samrisk.co.uk we set no cookies for analytics or marketing until you choose to allow them (see "Cookies" below). The "Book a demo" form does not send anything to us itself: it opens an email in your own email program, and we receive only what you then send.

How we use it and why we may

For each purpose, the law requires a lawful basis. These are ours as controller.

Where we rely on legitimate interests we have weighed them against your rights; you can ask us for that assessment. We do not use personal data for automated decisions that have legal or similarly significant effects on you.

Email and notifications

We send email through an email provider. Each person chooses how SAMRISK tells them about things: at once, in one digest at 7am, or not by email. Account email such as sign in codes, invitations and password resets is always sent. For every email we keep a log of the recipient, subject, type and whether it was delivered, opened, clicked, bounced or marked as spam, so we can show it arrived and fix delivery problems.

AI

SAMRISK does not currently send your data, or your company's records, to any AI provider. Before that ever changes we will update this policy and tell customers first.

Platform support

A small number of SAMRISK staff can see across companies to run the platform and answer support. To see a problem as you see it, a member of staff can use a read only view as: they must give a reason, it lasts at most 30 minutes, nothing can be changed while it is on, and its start, end and reason are written to the company's activity log, which the company's admins can see. Staff do not otherwise open a company's records except to fix a fault, answer a request, or where the law requires.

Who we share it with

We do not sell personal data, and we do not share it for others' advertising.

• People in your company with access, within the limits your admins set.
• Our suppliers, who run parts of the service for us under written contracts that limit what they may do with the data and require them to keep it secure: a managed database (records and sign in), cloud hosting (the application and file storage), our payment provider, our email provider, and map and imagery services. Our data processing agreement names each one with its location; ask us for it at [email protected].
• Places your company sends data to. A company can set up webhooks that send events to its own systems, calendar feed links that let a calendar read its dates, and exports to spreadsheets. The company controls these and what happens to the data once sent. A calendar feed link works for anyone who has it, so treat it like a password and replace it if it is shared by mistake.
• Map services. When a map shows, your browser asks map and imagery services for the area shown; when you search for an address, the words typed are sent to an address search service. No account details are sent with these requests, though the services see your IP address as with any website.
• Authorities and advisers where the law requires it, or to protect our rights, and our professional advisers under confidentiality.
• A buyer if our business or its assets are sold, who must keep to this policy.

Where it is kept

SAMRISK's database and sign in are hosted in London, and its files are stored in London. The application servers run in the United Kingdom or the European Economic Area. Our payment provider (Stripe) and our email provider (Resend) may process data in the United States or elsewhere. Where personal data leaves the UK it is protected as UK law requires, as set out in each supplier's terms: by a UK adequacy decision (including the UK Extension to the EU-US Data Privacy Framework where the supplier is certified), or by the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. Ask us for a copy of the safeguards that apply.

Keeping it secure

• Data is encrypted in transit and at rest.
• Each company's records are kept apart by the database itself on every request, not only by the screens.
• Files are private and are opened through links that expire after about an hour. Profile photos and building cover pictures are shown only to people signed in to the company.
• Webhooks are signed so the receiving system can check they came from SAMRISK.
• Staff access is limited to those who need it and is logged.

No system is perfectly secure. If a breach puts your personal data at risk we will tell the ICO within 72 hours where the law requires, tell the companies affected without undue delay, and tell you where there is a high risk to you.

How long we keep it

Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you and get a copy;
• have inaccurate data corrected;
• have data erased where there is no good reason to keep it;
• restrict how we use it while a concern is looked at;
• move data you gave us to another service, in a common format;
• object to uses based on legitimate interests, and to direct marketing at any time;
• withdraw consent where we rely on it, without affecting what happened before.

You can correct your profile and delete your account yourself in your account settings. For anything else write to [email protected]. We may need to check who you are. We reply within one month, which the law lets us extend by two more months for complex requests; we will tell you if we do. There is normally no fee.

For records a SAMRISK customer keeps about you, the customer decides; see "Our two roles" above.

Children

SAMRISK is a business service for adults. Accounts are for people aged 18 or over, and we do not knowingly collect data from children for our own purposes. A customer may need to record a child, for example a young visitor signing in at a school or hall with a parent; that is the customer's record and its responsibility.

Cookies

Our website sets only what it needs to work until you choose. Google Tag Manager, and through it Google Analytics and advertising measurement, is loaded only after you allow analytics or marketing, and your choice is kept for 12 months. You can change it at any time from Cookie settings in the footer of every page. The SAMRISK application uses a cookie to keep you signed in, which it cannot work without.

Changes to this policy

When we change this policy we update the date and version at the top. Before a change that affects how we use your data, we will email account admins and, where the law requires, ask for consent again.

Contact us

• Privacy questions and requests: [email protected]
• Post: Remiam Limited, 37 Southgate Street, Winchester, Hampshire, SO23 9EH
• Data protection officer: we have not appointed one. Remiam Limited handles data protection questions at [email protected].

If you are not happy with our answer you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would like the chance to put things right first.