Privacy Policy

This policy explains how Sysress Limited handles personal information when you visit CertifyApps, contact us, request trial access, ask for support, or use a Certify app or service that links to this policy.

1. Who we are

CertifyApps is operated by Sysress Limited, a company registered in England and Wales under company number 10452033.

Registered office:

Unit 10, Robjohns House
Navigation Road
Chelmsford
England
CM2 6ND

Sysress Limited is the data controller when we decide why and how personal information is used, including website enquiries, account administration, support, billing administration, security and service operations.

When a business uses a Certify app to enter information about its own customers, sites, staff, equipment or certificates, that business will normally be the controller of that information. Sysress Limited processes it to provide the service on the business’s instructions, except where we must use limited information for our own legal, security, billing or operational purposes.

For privacy questions or requests, email [email protected].

2. What this policy covers

This policy covers:

• the CertifyApps website at www.certifyapps.co.uk;
• contact, support, trial, demo and subscription enquiries;
• CertifyApps account, service and operational information; and
• any Certify app or service that expressly links to this policy.

Individual apps may provide a more detailed product privacy notice describing their exact data, permissions and service providers. Where a product-specific notice applies, it supplements this policy and is the more specific source for that product.

For example, CertifyPAT has its own public Privacy Policy and Account Deletion page.

3. Information we collect

The information we process depends on how you interact with us.

Website and enquiry information

When you contact us, request a trial, ask about subscribing, or submit a support request, we may collect:

• your name and email address;
• your trade or business type;
• your team size;
• the app, plan or workflow you are interested in;
• the contents of your message; and
• our correspondence and actions taken in response.

Please do not include passwords, payment-card details or information that is not needed for your request.

Account and subscription information

Where you create an account or use a paid feature, we may process:

• your email address, sign-in provider and account identifiers;
• your organisation, workspace, role or allowed-user information;
• plan, product and entitlement information;
• renewal, cancellation and restore status; and
• limited purchase metadata received from the relevant app store or subscription service.

We do not receive your full payment-card or bank-account details when purchases are processed by Apple App Store or Google Play.

Product and user-provided information

A Certify app may process business records you choose to enter or upload. These can include customer and site details, staff or inspector details, asset and equipment records, inspection or test results, certificate information, branding images, signatures, documents, exports and audit records.

The exact categories depend on the app. The applicable product privacy notice explains those categories in more detail.

Technical, security and reliability information

Our website, hosting and security providers may process network and request information such as IP address, browser or device type, requested page, time, security signals and server logs.

Individual apps may also process limited crash and diagnostic information to maintain security and reliability. For example, CertifyPAT uses a tested privacy filter before sending crash and error diagnostics to Sentry and disables screenshots, session replay, performance tracing and automatic collection of personal data. See the relevant product privacy notice for the current configuration.

Information received from other sources

We may receive information:

• from the organisation that gives you access to a Certify app;
• from Apple, Google or a subscription-management provider about a purchase or entitlement;
• from authentication, hosting, email, support and security providers; or
• from a business customer that enters information needed for its professional records.

4. Why we use information and our lawful bases

We use personal information only where we have a lawful basis.

Where we rely on legitimate interests, we consider the need for the processing, its effect on individuals and whether a less intrusive approach is available.

Where processing is based on consent, you can withdraw consent at any time. This does not make earlier processing unlawful.

5. How we use information

We may use information to:

• operate, secure and improve the website and services;
• respond to contact, support, trial, demo and product-fit enquiries;
• create accounts and authenticate users;
• provide, sync and recover authorised business records;
• generate requested certificates, reports, labels and exports;
• manage plans, subscriptions, entitlements, cancellation and restoration;
• diagnose errors and maintain service reliability;
• prevent misuse, fraud and unauthorised access;
• meet legal, accounting and regulatory requirements; and
• establish, exercise or defend legal claims.

We do not sell personal information. We do not use customer, certificate or professional-record data for third-party advertising.

We do not currently make decisions about individuals based solely on automated processing that produce legal or similarly significant effects.

6. Who we share information with

We share information only where reasonably necessary for the purposes described above, including with:

• website hosting, content-delivery and security providers;
• authentication, database, file-storage and application-hosting providers;
• email and support-delivery providers;
• Apple App Store, Google Play and subscription-management providers;
• crash-monitoring and service-reliability providers;
• professional advisers, auditors, insurers or regulators where necessary; and
• law-enforcement bodies, courts or other authorities where disclosure is legally required or necessary to protect rights and safety.

The public CertifyApps website currently uses WordPress and Elementor to publish pages and forms and Cloudflare for content delivery and security.

The providers used by an individual app may differ. CertifyPAT’s current product-specific notice explains its use of Supabase, RevenueCat, Apple, Google, Sentry and support-delivery services.

Our processors may use approved subprocessors. They must handle information under appropriate contractual and security obligations.

7. International transfers

Some providers operate in the United Kingdom, European Economic Area, United States or other countries. This can involve processing personal information outside the UK.

Where required, we use or rely on recognised safeguards such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism. You may contact us for further information about the safeguards relevant to your information.

8. Cookies, browser storage and similar technologies

The public CertifyApps pages do not currently use advertising cookies or third-party marketing trackers. Essential website, hosting, security, caching and form-protection technologies may still process request and security information needed to deliver the site.

A browser-based Certify app may use local storage, IndexedDB, service-worker caches or similar storage to keep the app working, maintain sign-in state, cache assets and support offline or poor-network use. Product-specific notices explain any additional use.

If we introduce non-essential analytics, advertising cookies or similar tracking, we will update this policy and request consent where required before using them.

9. How long we keep information

We keep information only for as long as reasonably needed for the purpose for which it was collected, including to provide the service, respond to requests, meet legal or accounting duties, maintain security, resolve disputes and establish or defend claims.

Retention therefore depends on the record:

• enquiry and support records are kept while the request is active and for a reasonable period afterwards for follow-up, service history and disputes;
• account and product records are generally kept while the account is active and while needed to provide export, recovery or deletion processes;
• subscription and financial records are kept for the period required by applicable tax, accounting and company law;
• security and technical logs are kept for the provider’s configured rotation period or while needed to investigate an incident;
• records subject to a valid deletion request are deleted or anonymised unless limited retention is required for law, accounting, fraud prevention, security or legal claims; and
• residual copies may remain in protected backups until normal backup rotation removes them.

We review retention by considering the amount, nature and sensitivity of the information, the risk from unauthorised use, the purpose of processing and applicable legal requirements.

10. Security

We use technical and organisational measures appropriate to the service. These include encrypted transport, authentication, access controls, workspace and database protections, restricted service credentials, app-store billing controls, backups and operational monitoring where applicable.

No online service can eliminate every risk. You must protect your credentials, limit access to authorised users and tell us promptly if you believe an account or business record has been accessed without permission.

More information is available on our Security and Data page.

11. Your data-protection rights

Depending on the circumstances and lawful basis, you may have rights to:

• ask for a copy of your personal information;
• correct inaccurate or incomplete information;
• ask us to delete information;
• restrict how information is used;
• object to processing based on legitimate interests or direct marketing;
• receive certain information in a portable format; and
• withdraw consent where we rely on consent.

The right to object to direct marketing is absolute. You can ask us to stop at any time.

Some rights are subject to legal conditions and exceptions. We may need to verify your identity before acting on a request.

If Sysress Limited processes business-record information only on your organisation’s instructions, we may refer your request to that organisation or assist it in responding.

To exercise a right, email [email protected].

If you are unhappy with our response, you may complain to the Information Commissioner’s Office. You may also have the right to contact another local supervisory authority.

12. Account and data deletion

Where an app supports account creation, it will provide an in-app or public deletion route. Before deleting an account, export any records you need and check whether your app-store subscription must be cancelled separately.

CertifyPAT users can use its public Account Deletion page.

We verify deletion requests. We then delete or anonymise information no longer needed, subject to limited legal, accounting, security, fraud-prevention and dispute-retention requirements.

13. Children

CertifyApps services are designed for adults using business and professional workflows. They are not directed at children, and users must be at least 18 years old unless an individual service expressly states otherwise.

14. Changes to this policy

We may update this policy when our services, providers or legal obligations change. We will publish the revised version and update the date above. Where a change materially affects how we use information, we will provide an additional notice where reasonably required.

15. Contact us

Privacy and support email: [email protected]

Postal address:

Sysress Limited
Unit 10, Robjohns House
Navigation Road
Chelmsford
England
CM2 6ND