Privacy policy

Version 1.1, last updated 3 November 2026.

This policy explains how 3Sixty Hub handles personal information. 3Sixty Hub is run by 3Sixty Health and Safety Ltd, trading as 3Sixty Health and Safety (company number 09171942), of Suite 21, Enterprise House, Telford Road, Bicester, Oxfordshire, OX26 4LD. We're registered with the Information Commissioner's Office under number ZC291513. In this policy, "we" and "us" means 3Sixty Health and Safety.

Questions or requests about your information: email info@3sixtyhealthandsafety.com.

1. Two different roles

Information about our customers and their users. When a business signs up, we decide how the information about the account (names, email addresses and billing details) is used. For this information we are the controller.

Expert advice. When a business asks our experts a question or buys expert work from us, we are also the controller of what it sends us for that purpose, as any health and safety consultant would be. This includes the questions, our answers and the files attached to them.

Records businesses keep in 3Sixty Hub. Businesses use 3Sixty Hub to keep their own health and safety records, such as staff training, accident and incident reports, display screen assessments, inductions, risk assessments, contractors and visitors. For these records the business is the controller and we are its processor: we only use them to run 3Sixty Hub for that business, following its instructions and our data processing terms. If a business has added your details (for example as a member of staff, a contractor or the person involved in an accident), please contact that business first about your information. We will help them respond.

2. What we collect as controller

• Account details: your name, work email address, business name, sites/locations and the role you have in the account.
• Sign-in details: if you choose to sign in with Microsoft, Google or your company's single sign-on, we receive your name and email address from that service. We never see your password.
• Messages with us: questions to our experts, quote requests, replies by email and any files you attach. These can include details of people at your business, such as someone involved in an accident, if you include them.
• Technical information: your IP address, browser and device type, and records of sign-ins and errors, kept by our hosting providers to run and protect the service.
• Billing details: the billing name, address and VAT number for paid plans, and records of payments. Card details are handled by Stripe, our payment provider. We don't see or store full card numbers.

Your employer may have given us your name and email address when inviting you to its account. You need to give us your name and work email address to use 3Sixty Hub.

3. Why we use it and our lawful basis

• To provide 3Sixty Hub, including sign-in, reminders, chasers and summary emails. If you signed up for yourself, for example as a sole trader, this is necessary for our contract with you. Otherwise it is in our legitimate interests, and your employer's, in providing and using the service your employer has signed up to.
• To answer questions and give expert advice: our legitimate interest in giving the advice your business has asked for, or our contract with you if you signed up for yourself. Where a question includes health information, such as details of an injury, we use it only to give the advice, as part of helping your business meet its legal duties as an employer.
• To keep a record of advice we have given, for 6 years: our legitimate interest in being able to answer questions or claims about that advice.
• To keep the service secure, fix problems and improve it: our legitimate interests.
• To keep business and tax records: legal obligation.
• News and offers: we may email account owners about new features and offers from 3Sixty Health and Safety, in our legitimate interest in telling customers about similar services. Every such email has an unsubscribe link, and you can opt out at any time. Service emails such as reminders can be switched off in Settings.

4. Records businesses keep in 3Sixty Hub

These can include names, contact details, job roles, training results and certificates, signatures, photos, and details of accidents and injuries. Some of this, such as injury and health information, is special category data. The business decides what is recorded and is responsible for having a lawful basis, usually its legal duties as an employer under health and safety law. We keep these records confidential and secure, only let the business's own users see them, and don't use them for our own purposes. Our experts can see a business's account details, users, sites/locations, check registers and documents so they can answer its questions and give the support it has signed up for, such as adding documents to its account. They look at records only for that purpose. Only staff of 3Sixty Health and Safety who are bound by confidentiality have this access.

5. AI features

When our experts reply to an enquiry they can use an AI assistant (Claude, provided by Anthropic in the USA) to prepare a first draft. The enquiry, the business's name and type, and details of the check it is about are sent to Anthropic for this. Under its commercial terms, Anthropic does not use this information to train its models and keeps it only for a limited time. Every draft is checked by a person before it is sent, and no decisions about you are made automatically.

6. Who we share information with

We don't sell personal information. We use these companies to run 3Sixty Hub, under contracts that require them to protect it:

We also use these services, which don't handle the records businesses keep in 3Sixty Hub:

We may also share information with our professional advisers and insurers, with a buyer if our business is sold, or where the law requires it, for example with the police or the Health and Safety Executive.

7. Information sent outside the UK

Some of these companies are based in the USA. Where information leaves the UK, it stays protected to UK standards. For each company, the safeguard we rely on is shown in the tables above: either the UK-US data bridge (the UK extension to the EU-US Data Privacy Framework), for companies certified under it, or the UK International Data Transfer Addendum to standard contractual clauses, for which we have assessed the risks of the transfer.

8. How long we keep it

• Records businesses keep: each business sets how long each kind of record is kept, in Settings, Data retention. The recommended periods are shown below, and the business can't choose less than the legal minimum. On the 1st of each month 3Sixty Hub removes records older than their period, after emailing the account owners at least four weeks before with a list of what is due to go. Documents a business uploads are kept until it deletes them.

  Records	Recommended	Shortest allowed
  Accidents, incidents and near misses	7 years	3 years
  Check records and certificates (fire alarm tests, servicing, inspections)	6 years	5 years
  Completed actions and the evidence sent for them	6 years	1 year
  Staff training records (courses and safeguarding)	6 years	1 year
  New starter inductions	6 years	1 year
  Display screen (workstation) self-assessments	6 years	1 year
  Contractor sign-in and sign-out records	2 years	1 year
  Contractors' insurance and competence documents (after they run out)	6 years	1 year
  Finished contractor jobs with their risk assessments and method statements	6 years	1 year

• Closed accounts: when a business closes its account it has 30 days to download its records or reopen the account. Everything is then deleted, including sign-in accounts that don't belong to another business, and removed from backups within a further 30 days.
• Account details (names and email addresses of users): while the account is open, then deleted with it.
• Messages with our experts: 6 years from the last message, in case of questions about advice given. If the account closes we keep the text only, for the rest of the 6 years.
• Billing records: 6 years after the end of the financial year they relate to, as tax law requires.
• Technical logs kept by our hosting providers: a limited time, set by each provider, usually no more than 90 days.

9. How we protect it

Information is encrypted when it travels over the internet and when it is stored. Each business's records are kept apart by database rules so only that business's users can see them. Files are kept in private storage and shared only through links that expire. We limit who on our side can access information and review our security regularly.

10. Your rights

You can ask for a copy of your information, ask us to correct it or delete it, ask us to limit or stop using it, object to how we use it, and ask for it in a format you can take elsewhere. Email info@3sixtyhealthandsafety.com. We will reply within one month. For records a business keeps about you, we will pass your request to that business and help it reply.

To complain about how we handle your information, email info@3sixtyhealthandsafety.com. We will acknowledge your complaint within 30 days and tell you the outcome without undue delay. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

11. Cookies

We only use cookies that are needed for the site to work, such as keeping you signed in. See our cookie notice.

12. Children

3Sixty Hub is for businesses and isn't meant for children to use. Schools and other organisations may record information about children, such as an accident in the playground. That information is the organisation's responsibility as controller, as described in section 4.

13. Changes to this policy

If we make important changes we will tell account owners by email before they take effect. The date at the top shows when it last changed.

See also: Privacy policy · Terms of service · Cookies