GGK Technologies Privacy Notice

Introduction

GGK Technologies ("GGK", "we", "us" or "our") respects the privacy of individuals whose personal information is processed through our website and our Garden Gate Keeper incident management service.

This Privacy Notice explains what personal information may be processed, why it is processed, how it is protected, how long it is retained and the rights individuals have under UK data protection law.

GGK is an incident, accident and near-miss reporting and management platform used by organisations to record, investigate, manage and report workplace incidents.

1. Who is responsible for your information?

GGK may act in two different capacities depending on the circumstances.

When an organisation uses GGK to record and manage incidents relating to its staff, contractors, clients or other individuals, that organisation will normally be the Data Controller.

GGK Technologies will normally act as the Data Processor and process that information on the customer's instructions.

Customers are responsible for determining why personal information is collected through GGK, the lawful basis for processing it and how long it needs to be retained.

For information GGK Technologies collects for its own business purposes, such as website enquiries, customer contact information, account administration and security records, GGK Technologies acts as the Data Controller.

2. Personal information processed through GGK

Depending on how a customer configures and uses GGK, information processed through the service may include:

• Name
• Contact information
• Email address
• Employee or user information
• Department and sub-department
• Workplace or site information
• Incident location
• Incident date and time
• Information about the person reporting an incident
• Information about the person impacted by an incident
• Witness names and contact information
• Details and descriptions of incidents
• Accident information
• Near-miss information
• Injury or harm information
• Affected body parts
• Medical treatment information
• First aider information
• Investigation information
• Investigator comments and notes
• Incident status and status history
• Attachments or evidence uploaded in connection with an incident
• User account information
• User permissions and access information

3. Special category information

Some incidents may involve information concerning an individual's health.

Examples may include:

• injuries;
• medical treatment;
• affected body parts;
• health consequences arising from an incident; and
• other medical information supplied as part of an incident record.

Health information is classified as Special Category Personal Data under UK data protection law.

Where GGK processes this information on behalf of a customer, the customer is responsible for determining the appropriate lawful basis under Article 6 of the UK GDPR and the appropriate condition under Article 9 for processing Special Category Personal Data.

GGK processes such information only as required to provide the GGK service and in accordance with the customer's instructions and applicable contractual requirements.

4. Information GGK collects for account and security purposes

GGK may process technical and security information necessary to operate and protect the service.

This may include:

• username;
• user ID;
• login dates and times;
• session information;
• IP address;
• browser and user-agent information;
• authentication and security information;
• login history;
• system access records; and
• security and audit logs.

This information is used for purposes including operating user accounts, maintaining system security, investigating suspected misuse and protecting GGK and its customers.

5. Website and enquiry information

Where someone contacts GGK directly, including through the GGK website contact form or by email, we may process information including:

• name;
• organisation;
• email address;
• telephone number, where supplied;
• information contained in the enquiry; and
• subsequent correspondence.

This information is used to respond to enquiries, arrange demonstrations, discuss GGK services and manage prospective and existing customer relationships.

6. Why personal information is processed

Personal information may be processed through GGK for purposes including:

• allowing incidents, accidents and near misses to be reported;
• recording information about an incident;
• identifying impacted persons and witnesses;
• recording injury and treatment information;
• investigating incidents;
• assigning incidents to investigators;
• recording investigation comments and findings;
• monitoring incident status;
• maintaining an audit history;
• producing reports and dashboards;
• supporting health and safety management;
• supporting regulatory or legal reporting requirements;
• administering user accounts;
• maintaining the security and integrity of the GGK platform;
• providing customer support; and
• operating and improving the GGK service.

7. Lawful bases

Where GGK Technologies acts as a Data Controller, the lawful basis used will depend on the reason the information is being processed.

These may include:

Contract

Processing may be necessary to take steps before entering into a contract or to perform a contract with a customer.

Legal obligation

Information may be processed where necessary to comply with a legal obligation.

Legitimate interests

GGK may process information where this is necessary for legitimate business interests, including operating and securing the GGK service, preventing misuse, responding to business enquiries and managing customer relationships, provided those interests are not overridden by the rights and interests of the individual.

Consent

Where consent is appropriate and required, information may be processed based on the individual's consent.

Where GGK acts solely as a Data Processor for customer incident information, the customer determines the applicable lawful basis for processing.

8. Who may receive personal information?

Personal information stored in GGK is not made publicly available.

Depending on the customer's configuration and permissions, information may be accessible to authorised individuals such as:

• authorised customer administrators;
• health and safety staff;
• managers;
• assigned investigators;
• authorised reporting users; and
• other authorised personnel selected by the customer.

GGK personnel may access customer information only where reasonably necessary to:

• provide technical support;
• maintain the service;
• investigate technical or security issues;
• protect the integrity of the system; or
• meet legal obligations.

GGK will not sell personal information.

9. Data sharing

Personal information may be disclosed where required by law or where necessary to protect the rights, security or legal interests of GGK, its customers or other individuals.

Where third-party service providers are used to support the operation of GGK, appropriate contractual and data protection safeguards will be used where required.

10. International data transfers

GGK does not currently intend to transfer customer incident data outside the United Kingdom as part of its normal service.

If this changes, GGK will ensure that appropriate safeguards required by UK data protection law are implemented and this Privacy Notice will be updated where necessary.

11. How long information is kept

Retention of customer incident information is primarily determined by the customer using GGK and its own legal, regulatory and operational requirements.

GGK will retain customer information for the duration necessary to provide the contracted GGK service and in accordance with the customer's instructions.

When a customer's contract with GGK ends, GGK intends to work with the customer to provide or export the customer's information where required.

Following completion of the agreed handover/export process, customer information will be securely deleted from GGK's active systems in accordance with the contract and agreed retention arrangements.

Some information may remain temporarily within secure backup systems until those backups are overwritten or expire in accordance with GGK's backup retention procedures.

GGK may retain limited information where required to meet legal, accounting, security or contractual obligations.

12. Data security

GGK takes reasonable technical and organisational measures to protect personal information against:

• unauthorised access;
• accidental loss;
• destruction;
• alteration;
• unauthorised disclosure; and
• misuse.

Access to customer information is restricted according to user accounts, roles and permissions.

GGK also maintains security and audit information to help protect the platform and investigate suspected security incidents.

13. Individual data protection rights

Depending on the circumstances, individuals may have rights under UK data protection law including:

• the right to be informed about how personal information is used;
• the right of access to personal information;
• the right to request correction of inaccurate information;
• the right to request deletion of information in certain circumstances;
• the right to restrict processing in certain circumstances;
• the right to data portability where applicable;
• the right to object to processing in certain circumstances; and
• rights relating to automated decision-making and profiling where applicable.

These rights are not absolute and may depend on the circumstances and lawful basis for processing.

14. Requests relating to customer incident data

If an individual's information has been entered into GGK by their employer or another organisation, that organisation will normally be the Data Controller.

Individuals should therefore normally contact that organisation first regarding requests to access, correct, delete or otherwise exercise rights relating to that information.

Where GGK receives a request relating to information for which one of its customers is the Data Controller, GGK may refer the request to the relevant customer and provide reasonable assistance to that customer in accordance with applicable data protection law.

15. Complaints

Individuals have the right to raise concerns about the use of their personal information.

Please contact GGK in the first instance if the concern relates to information for which GGK Technologies is the Data Controller.

Individuals also have the right to complain to the UK supervisory authority:

Information Commissioner's Office (ICO)

Website: https://ico.org.uk/

16. Contacting GGK

For questions about this Privacy Notice or the way GGK Technologies processes personal information, please use the contact form on the GGK website where possible.

GGK Technologies

Contact form: https://ggktechnologies.net/#contact

Website: https://ggktechnologies.net/

Email: thomas@ggktechnologies.net

17. Changes to this Privacy Notice

GGK may update this Privacy Notice from time to time to reflect changes to the service, legal requirements or the way personal information is processed.

The latest version will be made available through the GGK website.

Last updated: September 2026