Privacy policy | ForgeSpex

Who we are

ForgeSpex provides quality management software for manufacturers. In this policy, 'we' and 'us' mean ForgeSpex, which is responsible for the data described here.

We handle personal data in two different roles, and your rights differ between them.

As the controller, for data about visitors to this website, about the people who sign up for an account, and about the messages you send us.
As a processor, for everything a customer puts into their workspace: their employees, skills, qualifications, documents, and quality records. The customer, normally your employer, decides what goes in and how long it stays. We only act on their instructions.

If your employer uses ForgeSpex and you want to see or correct your own records in it, ask your employer first. We will pass your request to them.

What we collect

Account data: your name, work email address, job title, and the workspace you belong to.
Workspace content: the records your employer keeps in ForgeSpex, such as skills, qualifications, training records, controlled documents, and quality records, together with the files attached to them.
Usage data: the pages you open, the actions you take, your approximate location from your IP address, and your browser and device type.
Website data: the pages you view here, how you reached the site, and what you enter in any form.
Correspondence: the emails you send us and our replies.

We do not collect special categories of data, such as health or biometric data, and ForgeSpex is not designed to hold them.

Why we use it, and on what basis

To provide the service you or your employer signed up for. Basis: performance of a contract.
To keep the service secure, to prevent misuse, and to fix faults. Basis: our legitimate interests.
To send you service messages, such as an approval that is waiting for you or a qualification that is expiring. Basis: performance of a contract. You can turn most of these off in your notification settings.
To measure how this website is used, so we can improve it. Basis: consent, where the law asks for it.
To answer you when you contact us. Basis: our legitimate interests.
To meet our legal and accounting obligations. Basis: legal obligation.

We do not sell personal data, and we do not use your workspace content to train artificial-intelligence models.

Cookies and analytics

The application sets the cookies it needs to keep you signed in. These are essential: without them, you cannot use the product.

This website uses Google Analytics to count visits and see which pages are read. It sets cookies and records your IP address. You can block it in your browser, or use the Google Analytics opt-out add-on.

Who else sees it

We use a small number of suppliers to run the service. Each one may handle personal data only to do its job for us, under a written contract.

Google (Firebase): Sign-in, website hosting, and website analytics.
Amazon Web Services: Application hosting and storage of the files you upload.
MongoDB Atlas: The database that holds your workspace records.
Resend: Sending the emails the application sends you.

We also share data when the law requires it, and we may transfer it as part of a merger or sale of the business, in which case we will tell you first.

Where your data is held

Our suppliers may store or process data outside your country, including in the United States. When data leaves the European Economic Area or the United Kingdom, we rely on the European Commission's standard contractual clauses, or another lawful transfer mechanism, to protect it.

How long we keep it

Workspace content: for as long as the customer's subscription runs. After it ends, we delete or return it within 60 days, unless the customer asks us to do so sooner.
Account data: for as long as the account exists, then up to 12 months.
Website and analytics data: up to 14 months.
Invoices and other accounting records: as long as tax law requires.

Backups are overwritten on their own cycle, so a deleted record can stay in a backup for a short while after it leaves the live system.

How we protect it

Data is encrypted while it travels and while it is stored. Access to production systems is limited to the people who need it. Every change to a record in the application is written to an audit trail, with who made it and when.

No system is perfect. If a breach affects your personal data, we will tell the customer, and the regulator, within the time the law allows.

Your rights

Depending on where you live, you can ask us to give you a copy of your personal data, correct it, delete it, limit how we use it, or send it to another provider. You can also object to processing that rests on our legitimate interests, and withdraw consent at any time.

Write to us at the email address in the Contact section. We answer within one month. If you are not satisfied, you can complain to your data protection authority.

For records inside a customer's workspace, send your request to that customer. We will help them answer it.

Children

ForgeSpex is a workplace tool. It is not meant for anyone under 16, and we do not knowingly collect their data.

Changes to this policy

When we change this policy, we update the date at the top of the page. If a change matters to you, we will tell you by email or in the application before it takes effect.

Contact

Write to hello@forgespex.com. We answer every message about this document.