Privacy notice
About this notice
QSHE Limited uses the QSHE name for its website and business software service. This notice explains how information is handled when you visit qshe.co.uk or www.qshe.co.uk, contact us, or use an account at app.qshe.co.uk. Contact info@qshe.co.uk with privacy questions or requests. Last updated: 1 November 2026.
Our role and your organisation’s role
QSHE handles website enquiries, account administration, service communications and billing information for its own business purposes. Where an organisation uploads information about employees, contractors, visitors or other people into its workspace, that organisation determines why the information is used. QSHE processes workspace information to provide the service under the applicable customer agreement and processing instructions. Contact your organisation first about its operational records; we can help route a request to the appropriate administrator.
Information we handle
Website requests can include an IP address, browser and device information, requested pages, timestamps and technical or security information. If you email us, we receive your contact details, message and attachments. Accounts and applications can include your name, business email, company, role, access permissions, verification details, terms acceptance and related activity. Billing records can include business details, invoice and quotation information and payment status. Workspace information depends on the modules and records your organisation uses. Do not send passwords or unnecessary sensitive information in an enquiry.
Why we use it
We use enquiry details to answer questions and discuss requested services; account information to verify users, manage applications and provide access; and service information to deliver support, operational messages and billing. We use technical information to operate, protect and troubleshoot the service. We rely on legitimate interests for business communications, security and administration, balanced against individuals’ rights; on taking steps towards or performing a contract where the individual is a party; and on legal obligations where they apply. Business contacts acting for an employer are generally handled under legitimate interests. A trial request does not itself sign you up for promotional emails.
Providers and sharing
Our current service uses Cloudflare for website/application hosting, D1 records and private R2 files; Supabase for account authentication; Resend and its email delivery infrastructure for application messages; and Microsoft 365 for business email. Relevant information is shared with these providers to deliver their part of the service. A message recipient receives the information included in that message, and an authorised customer user can access information permitted by their role and organisation. Information may also be disclosed where required by law or necessary to establish or defend legal claims. We do not sell personal information.
Locations and international processing
Providers operate international infrastructure and support services. We do not promise that all data or access remains in the UK. The applicable provider arrangements, processing locations and safeguards must be considered for each service. Contact info@qshe.co.uk for the processing and transfer information applicable to your organisation before supplying information that requires particular location or transfer restrictions. This notice does not claim that an unverified UK-only arrangement or particular transfer safeguard is already in place.
How long information is kept
Retention depends on the purpose of the record, the customer’s instructions and agreement, support needs, security investigations, accounting duties and any live legal claim or required preservation. An expired trial loses operational access; expiry does not by itself erase the workspace. Deletion and export requests are assessed with the relevant organisation, and retained copies or backups may remain until their applicable retention ends. No fixed automatic deletion or backup expiry period is promised by this notice. Contact us for the retention arrangements applicable to a particular record or account.
Cookies and browser storage
The marketing website’s supplied code does not install advertising trackers or optional analytics. Hosting and security services may process technical information needed to deliver and protect it. The application uses browser storage for authentication and session behaviour. Email and application links may take you to providers with their own notices. Any future optional tracking will need its own information and, where required, consent before use.
Security
The service uses HTTPS, authenticated application access, permissions and private file storage. These controls reduce risk but cannot guarantee absolute security or uninterrupted availability. Keep passwords and private portal links confidential, use only the access assigned to you and report suspected misuse to info@qshe.co.uk. This notice makes no claim of certification, a completed independent audit or a guaranteed recovery time.
Your choices and rights
Depending on the circumstances, you can request access, correction, deletion, restriction or portability of your information. You can object to processing based on legitimate interests, including on grounds relating to your particular situation, and object to direct marketing at any time. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. Rights are subject to applicable conditions; we may need to verify identity and the authority of a request. Contact info@qshe.co.uk. You can also complain to the UK Information Commissioner at ico.org.uk/make-a-complaint.
Providing information and changes
Account and company information needed for verification and access must be supplied to use those features; an application may be reviewed or declined if required details cannot be verified. This service is for business use and is not intended for children. If our processing changes, we will update this notice and provide further information where appropriate. The date at the top identifies this version.