Legal
Welcome to ServiceRecord's Privacy Policy.
Effective 23 October 2026
SERVICE RECORD LTD operates the public ServiceRecord website available at https://servicerecord.co.uk (the "Website") and the ServiceRecord software platform available at https://servicerecord.app (the "Platform").
This Privacy Policy explains how SERVICE RECORD LTD, trading as ServiceRecord ("ServiceRecord", "we", "us" or "our"), collects, uses, stores, shares and otherwise processes personal data when you visit the Website, create or use an account on the Platform, or interact with any related products, services, features or communications that we make available. The Website, Platform and those related offerings are collectively referred to in this Privacy Policy as the "Services".
We are committed to protecting your privacy and handling personal data responsibly. Please read this Privacy Policy carefully. If you have questions about this Privacy Policy or our handling of your information, please use our Contact Us form.
The controller responsible for your personal data is:
Our current registered office address and statutory company details are shown in the footer of this website. For privacy questions, rights requests or data-protection complaints, please use our Contact Us form.
ServiceRecord acts as controller for personal data processed for its own account, billing, security, website, communications and business-administration purposes. Where a business Customer uses the Service to process personal data for its own purposes, the Customer is normally the controller and ServiceRecord processes that personal data on the Customer’s documented instructions in accordance with the applicable data-processing terms.
This Privacy Policy explains how SERVICE RECORD LTD, trading as ServiceRecord ("ServiceRecord", "we", "us" or "our"), collects, uses, stores and otherwise processes personal data in connection with our website, platform, accounts, subscriptions and related services. This Privacy Policy is intended to comply with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations ("PECR") and any other applicable UK privacy and data-protection legislation.
Depending on where you are located and how you use our Services, we may process your personal data in accordance with:
Nothing in this Privacy Policy is intended to limit any mandatory rights you may have under applicable law.
The personal data we collect depends on how you interact with us and the Services. The categories of personal data we may collect and process are set out below:
| Category | Personal Data We May Collect | How We Collect or Receive It |
|---|---|---|
| Information you provide directly | Name, business or organisation name, email address, optional business telephone number, role/position, account and login details, billing and transaction information, communications and correspondence with us, information submitted through contact, enquiry or registration forms, and any other information you choose to provide. | Directly from you when you contact us, create an account, register for or use the Services, complete a form, communicate with us or otherwise provide information to us. We may collect role/position and an optional business telephone number during registration or account administration to identify the appropriate person within the Customer organisation and communicate important account or service information. These details are used for account or service administration and do not, by themselves, constitute consent to promotional marketing. |
| Account and service information | Account profile information, user preferences and settings, records, documents, certificates, service information and other content created, uploaded or entered through the Services, dates, times and details of activities carried out through the Services, audit logs, account activity, communications relating to your use of the Services and information required to provide customer support. | From your use of your account and the Services. |
| Information about other individuals | Personal data relating to employees, contractors, customers or other individuals that you or your organisation upload, enter, create or otherwise make available through the Services. | From you, your organisation or another authorised user of the Services. You must ensure that you have a valid legal basis and all necessary authority to provide such personal data to us and, where required, that appropriate privacy information has been provided to the relevant individuals. |
| Payment and transaction information | Payment status, transaction identifiers, subscription status and limited billing information necessary to administer your account, process payments and provide the Services. | From you and our payment service provider, Stripe. We do not ordinarily receive or store your full payment card details. Payment card information is collected and processed by Stripe in accordance with its own systems, terms and applicable security requirements. |
| Technical and usage information | IP address, browser type and version, device type, operating system, pages or features accessed, dates and times of access, referring URLs, approximate location derived from IP address, device and browser identifiers, log files and information about how you interact with the Website and Services. | Automatically when you visit our Website or access or use the Services. |
| Cookies and similar technologies | Information collected through cookies and similar technologies, including information relating to your preferences, session and authentication information, Website and Service usage, performance and security. | Automatically through cookies and similar technologies used on the Website and Services. We use these technologies to operate and secure the Website and Services, remember preferences, maintain sessions and authentication, understand performance and usage, and detect and prevent fraud or misuse. Where required by law, we will obtain your consent before placing or accessing non-essential cookies or similar technologies. |
ServiceRecord may provide AI-assisted features that users can choose to use. Where you use an AI-assisted feature, prompts, uploaded documents and other information submitted to that feature may be processed as necessary to provide the requested functionality. Depending on the feature and how the Service is operated, this processing may involve authorised technology providers acting on our behalf.
We process such information only for the purposes necessary to provide the relevant feature and in accordance with our contractual and data-protection obligations. Where personal data is submitted through a ServiceRecord service operated by one of our business customers, the relevant customer remains responsible for determining whether that processing is lawful and appropriate.
The ServiceRecord Platform uses authentication and session-management technology operated within ServiceRecord’s production environment to provide passwordless authentication, secure login and session management. Information processed may include email addresses, account and user identifiers, authentication and session information, and security-related login events. We use this information to provide, secure and manage access to ServiceRecord accounts and workspaces.
We apply appropriate technical and organisational measures to protect authentication information and retain it only for as long as reasonably necessary for account management, security, legal compliance and related purposes. We do not currently use an externally hosted authentication service to process this information. If our authentication arrangements change and an external provider processes personal data on our behalf, we will update this Privacy Policy with the relevant information, including details of any applicable international transfers.
We may use personal data for the purposes set out below, depending on the nature of your relationship with us and how you interact with the Website and Services.
| Purpose | Type of data | Lawful Basis |
|---|---|---|
| Providing and administering the Service and account communications | Name, work email, organisation, role/position, optional business telephone number, account details, user role and authentication information | Contract where necessary to perform our agreement with you; otherwise legitimate interests in providing and administering our business service, managing customer accounts and business relationships, and communicating important information concerning the Service |
| Managing subscriptions and payments | Billing details, subscription information, payment status and transaction information | Contract; legal obligation where required for accounting and tax records; and legitimate interests in managing payments and recovering amounts properly due |
| Providing customer support and responding to enquiries | Name, contact details and information included in your enquiry | Contract where necessary to take steps at your request; otherwise legitimate interests in responding to business enquiries and managing customer relationships |
| Promotional marketing communications | Name, work email, organisation and marketing preferences | Consent where required by PECR and the UK GDPR; otherwise legitimate interests in promoting our business services where permitted by applicable law, subject to applicable opt-out rights |
| Security, fraud and abuse prevention | Account, payment-related, device, technical and usage information | Legitimate interests in protecting the Service, preventing fraud and abuse, detecting unauthorised activity and maintaining service security |
| Trial eligibility and administration | Relevant account, payment-related and technical information | Legitimate interests in administering trial eligibility, preventing repeated or abusive trial claims and protecting the Service from misuse |
| Service operation and security | Login activity, technical information, IP address, browser information, service events and audit information | Legitimate interests in maintaining security, reliability, accountability and the proper operation of the Service |
| Analytics | Information collected through analytics cookies and similar technologies | Consent, where required by PECR and the UK GDPR |
| Legal and regulatory compliance | Information necessary to meet applicable legal obligations | Legal obligation |
| Establishing, exercising or defending legal claims | Relevant account, transaction, communications and other records | Legitimate interests in establishing, exercising or defending legal rights and claims |
Certain account, authentication and billing information is required where necessary to create or administer an account, provide the Service or process a payment. Required fields on forms will be identified where appropriate. If required information is not provided, we may be unable to create or administer the relevant account, provide the requested Service, process a payment or respond to the relevant request.
Where we rely on legitimate interests, those interests generally include providing and protecting a secure business service, preventing fraud and misuse, managing customer and business relationships, maintaining service reliability, and establishing or defending legal claims. You may have the right to object to processing based on legitimate interests in accordance with section 14 of this Privacy Policy.
Where ServiceRecord offers a free trial or promotional access, we may process relevant account, payment-related and technical information to determine eligibility, administer the trial and prevent fraud, abuse or repeated trial claims. This processing is based on our legitimate interests in protecting the Service, applying trial conditions fairly and preventing misuse.
We may use automated checks for these purposes. We do not use this information to make decisions about a person’s eligibility for a paid subscription based solely on automated processing where that would produce a legal or similarly significant effect, unless permitted by law and appropriate safeguards are provided.
We use Stripe as a payment service provider.
When you make a payment, Stripe may collect and process personal and payment information in accordance with its own privacy documentation and applicable legal requirements. We may receive information from Stripe necessary to:
Stripe may act as an independent controller for certain processing activities. We recommend that you review Stripe’s privacy information before providing payment information.
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected and processed. This may include providing and maintaining the Services, managing user accounts, complying with legal and regulatory obligations, resolving disputes and enforcing our agreements. The length of time for which we retain personal data depends on the category of information and the circumstances in which it is processed.
| Factor | How It Affects the Retention Period |
|---|---|
| Nature of the information | Different categories of personal data may require different retention periods depending on their sensitivity, importance and purpose. |
| Purpose of collection and processing | We retain personal data for as long as necessary to fulfil the specific purpose for which it was collected or processed. |
| Duration of our relationship with you or the relevant customer | Account and service-related information may generally be retained for the duration of the relevant account, subscription, contract or business relationship and for an appropriate period afterwards where necessary. |
| Legal and regulatory requirements | We may retain certain information for longer periods where required to comply with applicable legal, regulatory, tax, accounting, audit or reporting obligations. |
| Applicable limitation periods | We may retain information for as long as reasonably necessary to establish, exercise or defend legal claims, taking into account applicable statutory limitation periods. |
| Disputes, investigations or enforcement | Where a dispute, complaint, investigation, suspected breach or legal claim arises, we may retain relevant information until the matter has been resolved and any applicable retention period has expired. |
| Ongoing business or operational need | We may retain information where reasonably necessary to maintain records, ensure security, prevent fraud or misuse, or protect and enforce our legal rights and agreements. |
When personal data is no longer required for the purposes described above, we will securely delete it, anonymise it so that it can no longer reasonably identify an individual, or securely archive it where appropriate and permitted or required by applicable law.
Where we transfer personal data outside the UK, we will comply with the applicable requirements of the UK GDPR.
Where the destination is not covered by UK adequacy regulations, we will use an appropriate lawful transfer mechanism, such as the UK International Data Transfer Agreement or the UK international-transfer mechanism, where applicable.
We may also implement supplementary safeguards where required by UK data-protection law. Further information about the safeguards applicable to a particular transfer may be requested from our privacy/contact team.
Under the UK GDPR and the Data Protection Act 2018, you are recognised as a data subject and have certain rights in relation to your personal data. These rights apply irrespective of your nationality or place of residence, as long as your data is processed within the scope of applicable data-protection laws. You can exercise any of your rights through our Contact Us form.
| Right | What It Means in Practice |
|---|---|
| Right of access | You can request a copy of the personal data we hold about you (a subject access request). We normally respond within one month. Where permitted by applicable law, this period may be extended for complex or numerous requests, and we will inform you where an extension applies. |
| Right to rectification | You can ask us to correct any personal data that is inaccurate or incomplete. |
| Right to erasure | You can ask us to delete your personal data where there is no compelling reason for us to continue processing it. Also known as the right to be forgotten. |
| Right to restriction | You can ask us to suspend processing of your personal data in certain circumstances, for example while accuracy is disputed. |
| Right to data portability | You can request certain personal data you have provided to us in a structured, commonly used and machine-readable format where the processing is automated and based on consent or contract. |
| Right to object | You can object to processing based on legitimate interests. We will stop unless we can demonstrate compelling legitimate grounds that override your interests. |
| Right to withdraw consent | Where processing is based on consent, you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal. |
| Right to complain | You have the right to lodge a complaint with the appropriate authority. |
These rights are not absolute and may be subject to legal conditions and exemptions. To exercise your rights, please use our Contact Us form.
We take the security of personal information seriously and implement reasonable and appropriate technical, organisational and administrative safeguards designed to protect personal information against unauthorised or unlawful access, disclosure, alteration, loss, destruction or misuse. Depending on the nature of the information and the risks involved, these measures may include access controls, authentication measures, encryption or other appropriate security technologies, restricted access to personal information, internal confidentiality obligations, security monitoring, and periodic review and updating of our security practices.
We may send you promotional marketing communications in accordance with applicable UK GDPR and PECR requirements. Where consent is required, we will obtain it before sending the relevant promotional marketing communications.
You can opt out of marketing emails at any time by:
Please note that opting out of marketing communications will not prevent us from sending you important non-marketing communications, including messages relating to your account, payments, subscription, security, support, data export, account closure or the Services.
If you have concerns about how ServiceRecord processes your personal data, you can make a complaint through our Contact Us form. We will acknowledge and handle your complaint in accordance with the applicable UK data-protection requirements, investigate it appropriately and communicate the outcome to you within the applicable timeframe.
We will acknowledge a data-protection complaint within 30 days, take appropriate steps to investigate it without undue delay, keep you informed where appropriate and communicate the outcome of our investigation. You also have the right to complain directly to the Information Commissioner’s Office (ICO), which is the UK’s independent supervisory authority for data protection.
You are not required to contact ServiceRecord before making a complaint to the ICO.
ServiceRecord accounts are intended for business users and are not offered directly to children. A business Customer may, however, configure its services to process personal data relating to children, special-category data or criminal-offence data. In those circumstances, the Customer is responsible for determining that the processing is lawful and for implementing any additional conditions, notices and safeguards required by applicable law.
ServiceRecord processes such Customer personal data on the Customer’s documented instructions in accordance with the applicable data-processing terms.
Our Website or Services may contain links to third-party websites or services. We are not responsible for the privacy practices, content or security of third-party websites or services. We encourage you to read their privacy policies.
We may update this Privacy Policy from time to time. When we make changes, we will update the Effective Date and, where appropriate, bring material changes to your attention through the Website, Service or other appropriate means. Where a change to our processing requires consent under applicable law, we will obtain the required consent before carrying out that processing.
If you have questions about this Privacy Policy or our processing of personal data, please use our Contact Us form. We accept privacy questions, rights requests and data-protection complaints through this route.
Our current registered office address and statutory company details are shown in the footer of this website.
Our team can walk through specifics with your legal, IT or procurement contacts.