top of page

Privacy Policy for Handsam Ltd Mobile & Google Applications

Last Updated: August 2026

Effective Date: August 2026

 

Handsam Ltd ("Handsam", "we", "us", or "our") is committed to protecting and respecting your privacy. Handsam Ltd is a company registered in England and Wales providing educational health, safety, and compliance management solutions, software, and consultancy to schools, academies, and Multi-Academy Trusts (MATs).

This Privacy Policy explains how we collect, use, store, disclose, and safeguard personal data when you access or use our Google Workspace add-ons, Android applications, or integrated Google Cloud services (collectively, the "Google Applications" or "Services").

 

This policy is compliant with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act (DUAA) 2025 and Google’s API Services User Data Policy.

​

1. Data Controller and Data Processor Roles

Depending on how you use our Services, Handsam Ltd operates as either a Data Controller or a Data Processor:

  • Data Processor: When your school, trust, or employer subscribes to Handsam software and services, your organisation acts as the Data Controller. We process personal data solely on behalf of, and according to the instructions of, your institution.

  • Data Controller: When you interact directly with Handsam Ltd (e.g., contacting support, creating an account directly with us, or requesting information), Handsam Ltd acts as the Data Controller.

Contact Details

​

2. Information We Collect

We collect information necessary to deliver educational health and safety compliance management, incident logging, training verification, and administrative features.

A. Information Provided directly by Google Authentication

When you sign in using Google Account Single Sign-On (SSO) or grant permissions to our Google Application, we collect:

  • Basic Account Information: Full name, professional email address, and Google profile ID.

  • User Credentials & Tokens: OAuth 2.0 access tokens required to authenticate sessions securely without storing passwords.

B. Health, Safety, and Operational Data

Depending on the specific Google Application deployed by your school or trust, you or your organisation may input:

  • Incident & Accident Logs: Names of staff/pupils involved, date, time, location, details of incidents, and injury/first-aid records.

  • Task & Compliance Management Data: Compliance records, assigned tasks, audit actions, and statutory check completions.

  • Educational Visits Data: Staff and supervisor details for school trips, emergency contact information, and risk assessment signatures.

  • Training Records: Course completion data, certificates, and CPD tracking records.

C. Technical and Usage Data

  • Device and connection information (browser type, operating system, IP address).

  • Application event logs, error reports, and timestamped user action logs for auditing compliance.

​

3. How We Use Google User Data

Our Google Application accesses, uses, and stores Google user data strictly to provide and improve its core features:

Data Type

Purpose of Processing

-UK GDPR Lawful Basis

-Google Profile & Email

-Account authentication, identity verification, role assignment, and system notifications.

-Contractual Necessity / Legitimate Interests

-Google Drive / Docs API (where applicable)

-Exporting risk assessments, health & safety reports, or audit certificates directly to school drive folders.

-Contractual Necessity (at user's explicit request)

-Google Calendar API (where applicable)

-Syncing compliance task deadlines, fire safety checks, and inspection schedules.

​

Google API Limited Use Disclosure

Handsam Ltd use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google API data for serving advertising or for building user profiles for commercial targeting.

 

4. How We Share Your Information

We do not sell, rent, or trade your personal data. We only share information in the following limited circumstances:

  1. Your Educational Institution / Employer: Access to reports, incident logs, and compliance statuses is visible to authorised administrators and designated leads within your school or Multi-Academy Trust.

  2. Sub-processors and Cloud Infrastructure: We use vetted third-party cloud hosting and infrastructure providers (e.g., Amazon Web Services, Google Cloud Platform) operating within secure UK/EEA data centres.

  3. Legal and Regulatory Obligations: We may disclose data if required by law, court order, or regulatory bodies (e.g., Health and Safety Executive (HSE), Department for Education (DfE), or Information Commissioner's Office (ICO)).

 

5. Data Transfers Outside the UK

All primary personal data processed by Handsam Ltd is stored securely within the United Kingdom or the European Economic Area (EEA). If any service provider processes data outside the UK, we ensure adequate safeguards are in place, such as UK Approved International Data Transfer Agreements (IDTA) or Standard Contractual Clauses (SCCs).

 

6. Data Security

We implement appropriate technical and organisational security measures to protect your data against unauthorised access, alteration, disclosure, or destruction:

  • Encryption: Data in transit is encrypted using TLS 1.2+, and data at rest is encrypted using AES-256.

  • Access Control: Role-based access controls (RBAC) ensure users can only view data relevant to their role.

  • Security Audits: Regular vulnerability checks, penetration testing, and code audits.

 

7. Data Retention

  • School / Trust Active Account Data: Retained for the duration of the contract between Handsam Ltd and the subscribing institution.

  • Accident & Health/Safety Logs: Retained in accordance with UK statutory requirements (e.g., RIDDOR regulations and statutory guidance for school incident record retention).

  • Application Log Files: Server logs and audit trails are retained for up to 12 months for security and troubleshooting purposes.

  • Account Deletion: Upon contract termination or verified user deletion request, data is securely anonymised or destroyed within 30 to 90 days, unless longer retention is legally mandated.

 

8. Your Data Protection Rights

Under UK GDPR, users have specific rights regarding their personal data:

  • Right of Access: Request a copy of the personal data held about you.

  • Right to Rectification: Request correction of inaccurate or incomplete data.

  • Right to Erasure ("Right to be Forgotten"): Request deletion of data where processing is no longer necessary. (Note: Where data is processed on behalf of your school/employer as part of statutory compliance, deletion requests may need to be handled via your school's Data Protection Officer).

  • Right to Restrict Processing: Request restriction of data processing under certain conditions.

  • Right to Data Portability: Request transfer of your data to another organisation in a structured, machine-readable format.

  • Right to Object: Object to processing based on legitimate interests.

To exercise these rights regarding Handsam software, contact us at info@handsam.co.uk or submit a request to your school's data controller.

 

If you believe your data has been handled incorrectly, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

 

9. Children's Privacy

Handsam Ltd’s Google Applications are designed for use by school staff, governors, site managers, and educational administrators. Where pupil information is processed within incident management or educational trip tools, it is uploaded solely under the lawful direction and oversight of the subscribing educational institution acting as Data Controller. We do not market directly to or collect personal data directly from children.

 

10. Updates to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in legal requirements, technology, or app features. Material updates will be published on our main portal or communicated through app release notes.

 

11. Contact Us

If you have any questions or concerns about this Privacy Policy or our data protection practices:

Handsam Ltd

Email: info@handsam.co.uk

Website: https://www.handsam.education

bottom of page