Privacy Policy

Last updated: October 2026

SafetyCore Ltd ("we", "us", "our") operates SupplierCore. This Privacy Policy explains how we collect, use and protect personal data, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Information we collect

• When you buy a subscription: your business name, billing address, email address and how many sites will use SupplierCore, collected through Stripe's checkout. Stripe handles your card details; we never see them.
• When you email us: your name, email address and whatever you choose to tell us.
• When you use SupplierCore: your name, email address and role; sign-in records, including time, IP address and outcome; session information; and, if you turn on two-factor sign-in, an encrypted secret for your authenticator app.

2. How we use your information

We use your information to provide, secure and support SupplierCore, set up and manage your subscription, communicate with you about your account, and meet legal obligations. Our lawful basis is the performance of our contract with you, or steps you have asked us to take before entering one, and our legitimate interest in keeping the service secure. We do not use your data for advertising and do not sell it.

3. Supplier data you record

The supplier records your organisation keeps in SupplierCore include your suppliers' contact names, email addresses and phone numbers, and the people at your suppliers who use the supplier portal. Documents your suppliers upload, such as certificates, may also name people. For this data your organisation is the data controller and SafetyCore Ltd acts as its processor, handling it only to provide the service, as set out in our Data Processing Agreement. Each organisation's data is kept apart at database level, so one organisation can never see another's suppliers.

When a certificate is uploaded, SupplierCore can send the document to Anthropic, which reads the standard, grade, site, scope and dates from it on our behalf. What it reads is shown as a suggestion for a person to check. Anthropic does not use this data to train its models.

4. Data retention

We retain your data while you maintain an active subscription and as required by law. If a subscription is cancelled, data is held for 90 days and then deleted. You can request earlier deletion by contacting us. Backups are kept for 14 days.

5. Third-party sharing

We share data only with trusted service providers who process it on our behalf:

• Stripe, for payments
• Cloudflare, for the secure network connection to our servers
• Resend, to send email such as invitations, document requests, reminders and password resets
• Anthropic, to read details from uploaded certificates, as described above

SupplierCore runs on servers we operate in the United Kingdom.

6. Cookies

This website (suppliercore.co.uk) uses no cookies and no analytics. The SupplierCore application (app.suppliercore.co.uk) uses only the cookies needed to keep you signed in and to protect forms from cross-site requests.

7. Security

We protect your data with invite-only accounts, role-based permissions, account lockout after repeated failed sign-ins, two-factor sign-in, encrypted connections, signed links for every file download, and an audit trail of every change. However, no method of transmission is 100% secure.

8. Your rights (UK GDPR and DPA 2018)

You have the right to access, correct, delete, restrict or port your personal data, and to object to how we use it. Contact us at [email protected] to exercise these rights. If you are a contact at one of our customers' suppliers, we will pass your request to the customer, as they decide how your data is used. You can also complain to the Information Commissioner's Office at ico.org.uk.

9. Contact us

Email: [email protected]
Address: SafetyCore Ltd, Nantwich, Cheshire, United Kingdom