Privacy Policy

This Privacy Policy explains how Legionella Logbook Ltd collects, uses and protects personal data when you visit our website, use the Legionella Logbook platform or use the Legionella Logbook mobile app.

Introduction

Last updated: 19 September 2026 This Privacy Policy explains how Legionella Logbook Ltd ("we", "our", "us") collects, uses, stores and protects personal data, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It applies to: • our website at legionellalogbook.com (the "Website"); • the Legionella Logbook web platform at app.legionellalogbook.com (the "Platform"); and • the Legionella Logbook mobile app for iOS and Android (the "App"). We refer to these together as the "Services". The section "The Mobile App" describes exactly what the App does on your device. We do not sell personal data, we do not use it for advertising, and we do not track you across other apps or websites.

Who We Are

Company name: Legionella Logbook Ltd Company number: 16206994 (England and Wales) Registered address: 128 City Road, London, England, EC1V 2NX ICO registration number: ZB857401 Data protection contact: contact@legionellalogbook.com We are a business-to-business software provider. Our Services are built for organisations that must keep water-hygiene records and for the people who work for them. They are not intended for consumers or for anyone under 18.

Controller or Processor

Our role depends on the data concerned. We are the controller for: • personal data about Website visitors, prospects and business contacts; • the account data needed to run the Platform and the App for each user (login email, name, role, security and audit logs); and • the data we collect to secure, support and improve the Services. We are a processor for Customer Content. Customer Content is the information an organisation that subscribes to the Service (a "Customer") and its users put into their logbook: sites, assets, tasks, readings, photos, documents, defects and remedial actions, together with the personal data of the Customer's own personnel, contractors and site contacts. The Customer decides what is stored and for how long. We process it only on the Customer's instructions, under our Data Processing Agreement and the data processing terms in our Terms and Conditions. If your personal data appears in a Customer's logbook, for example because you work for or with that organisation, the organisation is the controller of that data. Please direct requests about it to the organisation in the first instance. We will help them respond.

Personal Data We Collect

Website visitors and business contacts • Contact data you give us through our forms: name, business email address, company, phone number and your message (book-a-demo, contact and support forms). • Newsletter data: your email address when you subscribe. • Technical data: IP address, browser and device type, pages visited and referral source (see "Cookies and Analytics"). Platform and App users • Account data: name, login email address, phone number and profile photo (both optional), job title, the organisations you belong to and your role in each. • Activity data: records you create or change are attributed to you with a timestamp, for example who completed a task, uploaded a photo or raised a remedial action. This attribution is part of your organisation's compliance record. • Security data: sign-in events, IP address, device and browser information, and security notifications such as password changes. We keep these to protect accounts and investigate misuse. • Support data: what you send us when you contact support, including any screenshots you choose to attach. • Diagnostics: crash reports and technical error data (see "The Mobile App" and "Cookies and Analytics"). Customer Content, processed on behalf of the Customer • Site details and site contacts: names, phone numbers, email addresses and addresses of the people responsible for a site. • Personnel records: names, contact details, job titles, experience, companies and training records, including certificates uploaded as evidence of competence. • Compliance records: tasks, readings, notes, photos, documents, defects and remedial actions, each attributed to the user who created it. We do not intentionally collect special category data (such as health data) or data about children. Please do not put such data in free-text fields, documents or photos.

How We Collect Data

• Directly from you, when you fill in a form on the Website, subscribe to our newsletter or contact us. • From your organisation, when it invites you to the Platform. Access is invite-only: your organisation's administrator creates your account and chooses your role and which sites you can see. There is no public sign-up. • From your use of the Services: the records you create, security and audit events, and diagnostics. • Automatically through cookies and similar technologies on the Website, with your consent where required.

Accounts Managed by Your Organisation

The Platform and the App are used by organisations that must keep water-hygiene records, and by their staff and contractors: technicians, site managers, administrators and auditors. • Your organisation creates your account by invitation and controls your role and which sites you can access. • Your organisation's administrators can see your name, login email and role, and everything you record in its logbook. • If you belong to more than one organisation, each one sees only its own logbook. • When your organisation removes your access, the records you created stay in its logbook and remain attributed to you. You can no longer see that organisation's data. • To have your personal data deleted, ask your organisation's administrator or email support@legionellalogbook.com. Compliance records you created are part of the organisation's statutory logbook and are retained by the organisation for as long as UK health and safety law requires (see "Data Retention").

The Mobile App

The App is a field companion to the Platform for technicians and other users whose accounts are created by their organisation. There is no sign-up, no purchase and no advertising in the App. This section describes what the App does with your data. Camera and photo library The App asks for camera or photo library access only when you choose to attach a photo. Photos are taken or selected solely to attach evidence to compliance records (for example a completed task, an asset or a defect) and are uploaded to your organisation's logbook. The App does not scan your photo library, does not use the microphone and does not collect location data. Data stored on your device for offline work So that you can work without a network connection, the App downloads and keeps on your device the data for the sites you choose: site details, site contacts (names, phone numbers, email addresses and addresses), personnel names, tasks, defects, remedial actions, documents and the changes you have made that have not yet synced. Your login session is stored encrypted using the device's secure storage. • Downloaded site data is removed from the device when you sign out. • Changes you made offline that have not yet synced are kept on the device so they are not lost. They sync when you sign back in, and are deleted if a different user signs in on the device or the App is uninstalled. • If your organisation revokes your access while you are signed in, you keep read access to data already downloaded until you next sign out. You can no longer sync or download. • On Android, the App's data is excluded from automatic device backups. Crash reporting The App uses Sentry, hosted in the European Union, to collect crash reports and device diagnostics: device model, operating system version, App version and the technical details of the error. Crash reports do not include your IP address, your name, your email address or any user identifier, and they are not used for advertising or tracking. Sentry processes this data on our behalf under a contract that requires it to protect the data to at least the standard described in this policy. Crash data is retained for 90 days. Other data the App sends Everything else the App sends goes to our own Platform over an encrypted (TLS) connection: your sign-in, the records you create, and the photos and files you attach. Support requests sent from the App include your name, email address and App version so that we can reply. Retention and deletion Data you create in the App is stored in your organisation's logbook and follows the same retention rules as the Platform (see "Data Retention"). To request deletion of your personal data, ask your organisation's administrator or email support@legionellalogbook.com. Compliance records you created are retained by your organisation as required by UK health and safety law.

Cookies and Analytics

Website • Essential cookies and local storage needed for the Website to work, including remembering your cookie choice. • Analytics, only with your consent through the cookie banner: we use PostHog to understand how visitors use the Website, including pages visited, time on site, referral source, approximate location (country or region) and device and browser type. PostHog is hosted in the European Union, does not track you across other websites and is not used for advertising. You can withdraw consent at any time by clearing the site data for legionellalogbook.com in your browser, which shows the banner again, or by emailing us; tracking then stops immediately. Website analytics data is retained for up to 7 years. Platform • Strictly necessary cookies that keep you signed in and secure your session. These cannot be switched off. • Privacy-friendly performance measurement, provided by our hosting provider, that uses no cookies and no cross-site identifiers. • Error monitoring (Sentry, hosted in the European Union) so that we can find and fix faults. Error reports are configured not to include your IP address or personal identifiers. App The App uses no cookies and no analytics SDK. See "The Mobile App" for crash reporting.

Data Sharing and Sub-Processors

We do not sell or rent personal data. We share it only as follows. Sub-processors. We use a small number of specialist providers to host and run the Services on our behalf, in these categories: • cloud database, authentication and file storage (located in London, United Kingdom); • web hosting and content delivery; • background job processing; • transactional email and newsletter delivery; • error and crash monitoring (Sentry, hosted in the European Union); and • website analytics (PostHog, hosted in the European Union). Every sub-processor is bound by a written contract to process personal data only on our instructions and to protect it to at least the standard described in this Privacy Policy. The current list of sub-processors, with their locations, is set out in our Data Processing Agreement and is available to Customers and prospective Customers on request. We notify Customers before adding or replacing a sub-processor so that they can object. Others: • Your organisation, if you use the Platform or the App: its administrators can access your account details and the records you create. • Professional advisers, insurers and auditors, under confidentiality obligations. • Regulators, courts and law enforcement where the law requires it or to protect our legal rights. • A buyer or successor if we sell or transfer our business, in which case this policy continues to apply to your data. We do not share personal data with advertising networks or data brokers.

International Data Transfers

Our database, file storage and backups are located in the United Kingdom (London). Some sub-processors, for example web hosting, email delivery and error monitoring, operate in the European Economic Area or the United States. Where personal data leaves the UK we rely on: • UK adequacy regulations, including for the EEA and for US organisations certified under the UK Extension to the EU-US Data Privacy Framework; or • the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with additional safeguards where needed.

Data Retention

We keep personal data only for as long as necessary for the purposes described in this policy. • Customer Content, including compliance records and the personal data in them: for the life of the Customer's subscription, under the Customer's control. UK guidance (the HSE's Approved Code of Practice L8) expects monitoring records to be kept for at least five years, so Customers typically keep records at least that long. After a subscription ends, the Customer can export its data for 30 days and we delete Customer Content within 90 days, unless the law requires us to keep it. • Account data for Platform and App users: for the life of the account. If you no longer belong to any organisation, we delete or anonymise your account on request, replacing your name on historic records with a non-identifying marker so the organisation's records stay complete. • Enquiries and business contact data: up to 3 years after our last interaction. • Newsletter subscriptions: until you unsubscribe. • Security and audit logs: typically up to 12 months. • Crash reports and error data: 90 days. • Website analytics: up to 7 years. • Backups: deleted data may persist in encrypted backups for up to 7 days. • Accounting, tax and contract records: 6 years after the end of the contract. When data is no longer required, it is securely deleted or anonymised.

Data Security

We apply appropriate technical and organisational measures to protect personal data, including: • hosting in ISO 27001 and SOC 2 Type II certified data centres in the United Kingdom; • encryption in transit (TLS) and at rest, including backups; • role-based access control and per-organisation data segregation on the Platform; • encrypted session storage on mobile devices, with app data excluded from Android automatic backups; • access to customer data by our staff limited to what support and operations require; and • continuous monitoring, logging and regular review of our controls. If a personal data breach is likely to result in a risk to individuals, we will notify the affected Customers without undue delay and the Information Commissioner's Office within 72 hours where required. Our Data Security page describes our measures in more detail.

Your Data Protection Rights

Under the UK GDPR you have the right to: • access the personal data we hold about you; • have inaccurate or incomplete data corrected; • have your data erased in certain circumstances; • restrict or object to our processing, including to direct marketing at any time; • receive the data you provided to us in a portable format; • withdraw consent at any time where consent is the lawful basis; and • complain to the Information Commissioner's Office (ICO). Where your data is Customer Content, your organisation is the controller. Please contact it first; we will assist it in responding, and we will pass on any request we receive directly.

How to Exercise Your Rights

Email contact@legionellalogbook.com with "Data Protection Request" in the subject line, or write to Legionella Logbook Ltd, 128 City Road, London EC1V 2NX. Platform and App users can also contact their organisation's administrator or support@legionellalogbook.com. We respond within one month, extendable by two months for complex requests, and we may ask you to verify your identity first. There is normally no fee.

Children

The Services are intended for business use by adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.

Changes to This Policy

We may update this Privacy Policy from time to time. The current version is always available on our Website with its "Last updated" date. If a change materially affects how we use your personal data, we will notify Customers by email or through the Platform before it takes effect.

Complaints and Contact

If you have any concerns about how we handle your personal data, please contact us first at contact@legionellalogbook.com so that we can resolve them. You also have the right to lodge a complaint with the Information Commissioner's Office: Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Website: https://ico.org.uk/make-a-complaint