Privacy notice
Risk Register is a web application for health and safety risk assessments. Organisations use it to record hazards, rate risks, assign safety actions to their staff and keep evidence that the actions were done. This notice explains what personal data the application handles, why, and what your rights are.
Who is responsible for your data
Risk Register is provided by BrainerTek, Larnaca, Cyprus.
- Your organisation (the company or consultant that gave you an account) decides what is recorded in its assessments. For that content it is the controller, and BrainerTek processes it on its behalf as a processor, under the agreement between them.
- BrainerTek is the controller for the data it needs to run and secure the service itself, such as sign-in records.
Questions about this notice: [email protected].
What we process
- Account details: your name, work email address, job title, role and the organisation you belong to.
- Two-step verification: a secret key linked to your authenticator app. We never see the codes on your phone.
- Content you or your colleagues add: risk assessments, hazards, actions assigned to you, deadlines, comments and photos uploaded as evidence. Photos can show people or places, so upload only what the action needs.
- Security records: sign-in attempts with the time, email address used, IP address and browser type, used to detect and block password guessing.
- Email notifications: when an action is assigned to you, before its deadline and when it is overdue.
We do not use analytics, advertising or tracking tools, and we do not sell personal data.
Why and on what legal basis
- To provide the service your organisation signed up for: creating your account, showing you your actions and sending you reminders (GDPR Article 6(1)(b), and your organisation's legitimate interest in managing workplace safety, Article 6(1)(f)).
- To keep the service secure: two-step verification, sign-in lockout and security records (legitimate interest, Article 6(1)(f)).
- To meet legal obligations, for example if a public authority lawfully asks for information (Article 6(1)(c)).
Who else handles the data
- Hosting: the application and its database run on servers in a data centre in Cyprus (European Union).
- Cloudflare: sits in front of the site to protect it from attacks and to deliver it securely. It processes your IP address and the pages you request, and may do so outside the EU under the European Commission's Standard Contractual Clauses.
- Microsoft: notification emails are sent through Microsoft 365.
- Your organisation: people in your organisation with a manager role (safety officer or consultant) can see the actions assigned to you and the updates you add.
How long we keep it
- Account details and content are kept while your organisation uses the service. Your organisation can remove users and records at any time. When the agreement ends, the data is deleted or returned as set out in that agreement.
- Earlier versions of an assessment are kept unchanged on purpose, because they are the audit record of how risks were managed.
- Security records are kept only as long as needed to protect accounts and investigate incidents.
How we protect it
All traffic is encrypted with HTTPS. Every account needs a password and a 6-digit code from an authenticator app. Sign-in is paused after repeated failed attempts, sessions end when idle, and each organisation can only see its own data. Evidence photos are never public; they are shown only to people allowed to see the action they belong to.
Your rights
Under the GDPR you can ask to access, correct or delete your personal data, to restrict or object to its use, and to receive it in a portable format. Because your organisation controls the content of its assessments, contact your organisation first; you can also contact us at [email protected] and we will help or pass your request on.
You have the right to complain to the Office of the Commissioner for Personal Data Protection in Cyprus (dataprotection.gov.cy) or the data protection authority where you live.
Changes
We will update this notice when the service changes. The date at the top shows the latest version.