Cairn Note - Privacy Policy

1. Introduction

Cairn Note ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal information when you use our cloud-based assessment and event management platform (the "Service").

We comply with applicable data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data Controller

For the purposes of data protection law, Cairn Note is the data controller responsible for your personal data. If you have any questions about how we handle your data, please contact us at:

Email: privacy@cairnnote.com

3. Information We Collect

We collect the following types of information:

Information you provide directly:

Account information: name, email address, password (stored in hashed form), and organisation name (if applicable)
Assessment data: assessment content, risk assessments, templates, and related documents you create within the Service
Event data: event details, staff assignments, resource allocations, and location information
Uploaded files: documents, certificates, images, and other files you upload to the Service
Checkpoint data: GPS locations and timestamps recorded when you check groups in at checkpoints during a checkpoint session
Payment information: billing details are processed securely by our third-party payment provider (Stripe) and are not stored on our servers

Information collected automatically:

Usage data: pages visited, features used, and actions performed within the Service
Technical data: IP address, browser type, device information, and operating system
Session data: login times, session duration, and authentication tokens

4. How We Use Your Information

We use your personal information for the following purposes:

Purpose	Legal Basis
Providing and maintaining the Service	Performance of contract
Account management and authentication	Performance of contract
Processing payments and managing subscriptions	Performance of contract
Sending service-related communications (e.g. password resets, account notifications)	Performance of contract
Improving and developing the Service	Legitimate interest
Maintaining security and preventing fraud	Legitimate interest
Complying with legal obligations	Legal obligation

5. Data Sharing

We do not sell your personal data. We may share your information with:

Your organisation: if you are part of an organisation account, your organisation administrators can view your account details and activity within the organisation
Service providers: trusted third parties who assist us in operating the Service, including hosting providers, payment processors (Stripe), and email delivery services
Legal requirements: when required by law, court order, or governmental regulation

All third-party service providers are contractually obligated to handle your data securely and only for the purposes we specify.

6. Data Storage and Security

We take the security of your data seriously and implement appropriate technical and organisational measures to protect it, including:

Encryption of data in transit (HTTPS/TLS)
Secure password hashing using industry-standard algorithms
Role-based access controls within the application
Regular security reviews and updates
CSRF protection and session management safeguards
Audit logging of significant account actions

Your data is stored on secure servers. While we implement robust security measures, no method of electronic storage is 100% secure, and we cannot guarantee absolute security.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. Specifically:

Account data: retained while your account is active and for a reasonable period after closure to allow reactivation
Assessment and event data: retained while your account is active and during any post-closure retention period
Audit logs: retained for up to 24 months for security and compliance purposes
Payment records: retained as required by financial regulations

You may request deletion of your account and associated data at any time by contacting us.

8. Your Rights

Under UK data protection law, you have the following rights:

Right of access: request a copy of the personal data we hold about you
Right to rectification: request correction of inaccurate or incomplete data
Right to erasure: request deletion of your personal data (subject to legal obligations)
Right to restrict processing: request that we limit how we use your data
Right to data portability: receive your data in a structured, machine-readable format
Right to object: object to processing based on legitimate interest
Right to withdraw consent: where processing is based on consent, withdraw it at any time

To exercise any of these rights, please contact us at privacy@cairnnote.com. We will respond within one month of receiving your request.

9. Cookies and Tracking

The Service uses essential cookies required for the application to function correctly, including:

Session cookies: to maintain your authenticated session while using the Service
Security cookies: to protect against cross-site request forgery and other security threats

We do not use third-party advertising or analytics tracking cookies. These essential cookies cannot be disabled as they are necessary for the Service to operate.

10. Children's Privacy

The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take steps to delete the information.

11. International Data Transfers

Your data may be processed by service providers located outside the United Kingdom. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions, to protect your data in accordance with UK data protection law.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service. The "Last updated" date at the top of this page indicates when the policy was most recently revised.

13. Complaints

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Website: ico.org.uk
Telephone: 0303 123 1113

We would appreciate the opportunity to address your concerns before you contact the ICO, so please reach out to us first at privacy@cairnnote.com.

14. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Email: privacy@cairnnote.com