Version 1.1 · Last updated 22 August 2026
Privacy Notice
HeliSafe Surveyor Ltd
Who we are
HeliSafe Surveyor Ltd is a software company registered in England and Wales (Company No. 17031918), based at 3 Byron Avenue, Grove, Oxfordshire, OX12 0RF. We are registered with the Information Commissioner’s Office (ICO Registration No. ZC115698).
Our role depends on the data. We are the data controller for personal data we collect directly: website enquiries, marketing contacts, and the account and billing information of the organisations we contract with. We are a data processor for personal data that our customers enter into the HeliSafe Surveyor application, including survey records and site contact details. In those cases the customer organisation is the data controller and determines how that data is used; we process it only on their documented instructions, under a data processing agreement. If your data is held in the application by an operator, that operator is the first point of contact for your rights, and we will assist them in responding to you.
What data we collect and why
- Account information (name, company name, email address, phone number) — to provide access to the HeliSafe Surveyor application and manage your account.
- Helipad and site data, including named site contacts (name, job title, direct phone number, email address) — to support helipad survey and safety operations within the application. This data is entered by our customers, who are the controllers for it.
- Usage and log data (IP address, session information, timestamps) — for security monitoring and service improvement.
- Invoicing data (company name, address, email address) — to issue invoices and manage payment for services provided.
- Enquiry emails and contact form submissions — to respond to your enquiries.
We do not use personal data for automated decision-making or profiling.
Our legal basis for processing
Where we act as controller, we process your data under Article 6 of the UK GDPR, relying on: contract performance (to deliver our service to you); legitimate interests (security monitoring, fraud prevention, and operational safety data management); legal obligation (financial record keeping required by HMRC); and consent (for marketing communications, where applicable).
Where we act as processor, our customer determines the lawful basis and we process only on their instructions.
Cookies and website tracking
Our website does not set analytics, advertising or tracking cookies, and we do not use third-party analytics on it. Fonts are served from our own infrastructure rather than a third-party font service.
Where a form is provided on the website, we use a bot-protection service to prevent automated abuse. This processes a visitor’s IP address and basic technical signals to distinguish a person from a script. It does not track visitors across websites and is not used for advertising or profiling.
Strictly necessary cookies may be set within the HeliSafe Surveyor application to keep you signed in and to maintain your session. These are required for the application to function and are not used for any other purpose.
Where your data is held
Personal data in the HeliSafe Surveyor application is stored within the European Union, in Ireland. Files stored in the application, including survey documents and imagery, are additionally backed up to a separate location within the European Union, in the Netherlands.
Some of our providers are established outside the UK and EEA, or operate global infrastructure. Where that is the case, transfers are protected by appropriate safeguards under UK and EU data protection law: the 2021 Standard Contractual Clauses, the UK International Data Transfer Addendum, or the provider’s certification under the EU–U.S. Data Privacy Framework, as applicable to each provider. Details of the safeguard applying to each provider are available on request.
How long we keep your data
Account data is kept for the duration of your account plus 6 years. Site contact data is reviewed annually and deleted when no longer operationally relevant. Log data is kept for 12 months. Financial records are kept for 6 years as required by HMRC. We will delete your data sooner if you request it and there is no legal reason to retain it.
Your rights
Under UK GDPR you have the right to: access your personal data; correct inaccurate data; request deletion of your data; object to processing; restrict processing; and data portability.
Where we rely on your consent (for example, for marketing communications), you may withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.
To exercise any right, please contact us at privacy@helisafe-surveyor.com. If your data is held in the application on behalf of an operator, we will pass your request to that operator, who is the controller, and assist them in responding.
Third-party providers
We use the following providers to operate our services. Each processes personal data only on our documented instructions, under a data processing agreement: either signed directly with us, or, where a provider publishes standard terms that are binding upon it, incorporated into our contract with them.
| Provider | Purpose | Where processed |
|---|---|---|
| Supabase | PurposeApplication database, authentication and file storage | Where processedEuropean Union (Ireland) |
| Vercel | PurposeApplication hosting and deployment | Where processedUnited States (global edge) |
| Resend | PurposeTransactional email delivery | Where processedUnited States |
| Google Workspace | PurposeBusiness email only | Where processedUnited States |
| IONOS | PurposeWebsite hosting and domain | Where processedEuropean Union |
| Backblaze | PurposeOff-platform backup of stored files and certificates | Where processedEuropean Union (Amsterdam) |
| GitHub | PurposeSource code, and nightly backup transit — customer files pass through an Actions runner | Where processedUnited States |
| Anthropic | PurposeIn-app help assistant — processes what a user types into the help widget | Where processedUnited States. No EU inference option is available on this interface. |
| Cloudflare | PurposeBot protection on public web forms | Where processedGlobal edge network |
We do not sell your personal data to any third party. We notify our customers in advance of any change to the providers who process data on their behalf.
Our bank
We hold a business banking relationship with Mettle, provided by NatWest, which we use to issue invoices and receive payment. A bank is not our processor: it handles payment data under its own regulatory duties and does not act on our instructions. It is an independent controller in respect of that data, and its own privacy notice governs how it uses it.
Changes to this notice
We may update this notice from time to time. The current version is always published at helisafe-surveyor.com, with the version number and date shown at the top. Where a change materially affects how we handle personal data, we will notify affected customers directly rather than relying on this page alone.
Contact us
- Data protection enquiries: privacy@helisafe-surveyor.com
- Data Protection Officer: dpo@helisafe-surveyor.com
- Security enquiries: security@helisafe-surveyor.com
Complaints
You have the right to lodge a complaint with the Information Commissioner’s Office: www.ico.org.uk · 0303 123 1113
We would ask you to raise a concern with us first, so that we have the opportunity to put it right.