Privacy Notice

01Who we are

FoodSafe Formulate is the controller for personal data about website visitors, account holders, billing contacts and people who contact us.

For personal data that customers put into their Workspace (for example staff names on HACCP records or supplier contacts), the customer is the controller and we act as their processor under our Data Processing Agreement.

Contact our privacy team at privacy@foodsafeformulate.co.uk.

02Personal data we collect

Depending on how you use the Service, we may process:

• Identity and contact data: name, email, job title, organisation, phone number if you provide it.
• Account data: sign-in identifiers, role, workspace memberships, profile preferences, consent records.
• Billing data: billing contact, plan, invoices and payment status. Card details are handled by Stripe; we never see or store full card numbers.
• Usage and technical data: IP address, browser type, device, pages used, timestamps, error logs and security events.
• Audit data: who created, changed, submitted or approved records, and when — kept to provide trustworthy audit trails.
• Communications: support requests, feedback, complaints and their outcomes.
• Workspace content containing personal data, processed on the customer's behalf.

03Why we use it and our lawful basis

We only use personal data where the law allows:

• Contract — to create and run your account, provide the Service, process subscriptions and give support.
• Legitimate interests — to secure the Service, prevent fraud and abuse, keep audit trails, improve features and send service-related messages. We balance these interests against your rights.
• Legal obligation — to keep financial records, respond to lawful requests and meet our regulatory duties.
• Consent — for optional cookies and marketing emails. You can withdraw consent at any time.

04AI features

When you use AI drafting, the relevant product information is sent to our AI provider through a secured gateway to produce a draft. We instruct providers not to use your content to train their models. AI is never used to calculate nutrition or to decide allergen status, claims or approvals, and no decision with legal or similarly significant effect is made about you by automated means.

05Who we share data with

We share personal data only with trusted service providers who act on our instructions (listed on our Sub-processors page), professional advisers, and authorities where the law requires. We never sell personal data.

Consultants you invite into your Workspace can see the information your organisation gives them access to.

06International transfers

Some providers may process data outside the UK. Where they do, we rely on UK adequacy regulations or the International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses, with supplementary measures where needed.

07How long we keep data

We keep personal data only as long as needed:

• Account and workspace data: for the life of the account, then deleted within 90 days of closure unless an export or legal hold applies.
• Audit and approval records: for the life of the workspace, because they evidence food safety decisions.
• Billing and tax records: 6 years after the end of the financial year they relate to.
• Security logs: up to 12 months.
• Support correspondence: up to 3 years after the matter closes.
• Marketing preferences: until you unsubscribe, then a suppression record so we do not contact you again.

08How we protect it

We use encryption in transit and at rest, row-level access controls that keep each organisation's data separate, role-based permissions, server-side enforcement of approvals and plans, and least-privilege access for staff. See our Security page for details.

09Your rights

You have the right to:

• be informed about how we use your data;
• access a copy of your data;
• have inaccurate data corrected;
• have data erased in certain circumstances;
• restrict or object to processing, including direct marketing;
• data portability;
• withdraw consent at any time;
• complain to the Information Commissioner's Office.

10Exercising your rights

Email privacy@foodsafeformulate.co.uk. We will respond within one month, which may be extended by two months for complex requests. We may need to verify your identity. If your data is held in a customer's Workspace, we will refer your request to that customer and help them respond.

11Children

The Service is for businesses and is not intended for anyone under 18.

12Complaints to the regulator

We would like the chance to resolve your concern first. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

13Changes to this notice

We will post updates here and tell account holders about significant changes.