Privacy Policy
Last updated: 23 February 2026
SafetyPermit.io ("SafetyPermit", "we", "us", "our") is operated by Catevo Limited, a New Zealand company. This policy explains what personal information we collect, how we use it, and your rights regarding that information.
SafetyPermit is a workplace safety permit management platform used by organisations ("Tenants") to manage worker check-ins, permits, and site safety compliance. We process personal information on behalf of ourselves and our Tenants.
1. Information We Collect
Account Information
When you create an account or check in to a site, we collect:
- Full name
- Email address
- Phone number
- Role and contractor/organisation name
- Preferred contact method (email or SMS)
Permit and Check-In Data
When you submit a permit or check in to a work site, we collect:
- Responses to safety and prework questions
- Uploaded documents (e.g. certifications, training records)
- Selfie photographs taken during the check-in process
- Photographs taken during checkout
- Terms and conditions acceptance records
- Check-in and checkout timestamps
Device Information
If you use our mobile app, we may collect:
- Device name and platform
- Push notification tokens
Usage Data
We record audit logs of permit actions (submission, approval, rejection, revocation) including timestamps and the identity of the person performing each action.
2. How We Use Your Information
We use your personal information to:
- Process and manage work permits and site check-ins
- Send notifications about permit status changes via email, SMS, or push notification
- Authenticate your identity (e.g. magic link login)
- Maintain safety audit trails as required by workplace health and safety regulations
- Generate permit documents (e.g. PDF exports)
- Enable returning worker recognition to speed up future check-ins
- Provide site safety dashboards to permit issuers and administrators
3. Legal Basis for Processing
We process your personal information on the following bases:
- Legitimate interest: Operating a workplace safety permit system, maintaining audit trails, and ensuring site safety compliance.
- Legal obligation: Workplace health and safety record-keeping requirements.
- Consent: Where you voluntarily provide information during the check-in process or accept terms and conditions.
- Contract: To provide services to our Tenant customers and their workers.
4. How We Share Your Information
Your personal information is shared with the Tenant organisation that operates the site you are checking in to. Tenant administrators and permit issuers can view your permit data, uploaded documents, and selfie photographs as part of the permit review process.
We use the following third-party service providers to operate SafetyPermit:
- Microsoft Azure (United States) — Database hosting (Azure SQL), file storage (Azure Blob Storage), and web application hosting.
- Amazon Web Services (Sydney, Australia) — Email delivery via Amazon Simple Email Service (SES).
- SMS Gateway — SMS message delivery for notifications and authentication codes.
- Apple Push Notification service (APNs) — Push notifications to iOS devices.
- PDF generation service (westus2, United States) — Rendering permit documents as PDF exports.
- Anthropic (Claude) (United States) — Translation of check-in content for multilingual check-in.
We do not sell your personal information to third parties. We do not use your data for advertising purposes.
5. International Data Transfers
SafetyPermit is hosted on Microsoft Azure in the United States. Your data may be stored and processed in the United States or other regions where our service providers operate. Where data is transferred outside your country of residence, we ensure appropriate safeguards are in place, including standard contractual clauses and the data protection frameworks maintained by our service providers.
6. Data Retention
We retain your personal information for the following periods:
- Permit records, uploaded documents, and photographs: Retained for as long as required by applicable workplace health and safety legislation, or as long as the Tenant account remains active.
- Communication logs (email and SMS audit records): 7 years, then automatically deleted.
- Abandoned check-in sessions: Automatically deleted within 24 hours.
- Authentication session data: Expires after 48 hours of inactivity.
Tenant organisations may have their own data retention policies that apply in addition to ours.
7. Data Security
We take reasonable steps to protect your personal information, including:
- All data transmitted over HTTPS/TLS encryption
- Secure, HTTP-only authentication cookies
- Multi-tenant data isolation — your Tenant's data is not accessible to other Tenants
- Role-based access controls
- Rate limiting on authentication and submission endpoints
- Files stored in private containers with no public access
8. Cookies
SafetyPermit uses essential cookies only. These are required for authentication and session management. We do not use tracking cookies, analytics cookies, or third-party advertising cookies.
9. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access the personal information we hold about you, and download a copy in a structured, machine-readable format
- Correct inaccurate or incomplete contact information going forward
- Request deletion of personal information we are not legally required to retain — note that permit, safety, and audit records (including who performed each action) are retained and cannot be deleted or anonymised on request (see the note below)
- Object to or restrict certain processing activities
- Data portability — receive your data in a structured, machine-readable format
- Withdraw consent where processing is based on consent
Important — safety records are retained. SafetyPermit is a workplace health-and-safety system. To keep a complete, accountable record of every action taken on a permit, we and the Tenant retain permit records and the related audit trail (including who performed each action) for the legally required period. We therefore cannot delete or anonymise these records on request; this is permitted where retention is necessary for a legal obligation or the establishment of legal claims (e.g. GDPR Article 17(3)). You can still access and download a copy of your data at any time, and erasure requests for any data we are not legally required to keep are routed to the relevant Tenant.
To download a copy of your personal data, visit the data request page (enter the email or mobile number you used at check-in and we'll send you a verification code). If you have a SafetyPermit login, you can also download your data from your account.
Jurisdiction-Specific Rights
- New Zealand: Your rights are protected under the Privacy Act 2020. You may lodge a complaint with the Office of the Privacy Commissioner.
- Australia: Your rights are protected under the Privacy Act 1988 and the Australian Privacy Principles. You may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).
- United Kingdom: Your rights are protected under the UK GDPR and the Data Protection Act 2018. You may lodge a complaint with the Information Commissioner's Office (ICO).
- United States: Depending on your state of residence, you may have additional rights under state privacy laws such as the California Consumer Privacy Act (CCPA).
10. Data Controller and Processor
SafetyPermit acts as a data processor on behalf of the Tenant organisation (the data controller) that manages the site you are checking in to. The Tenant determines the purposes and means of processing your personal information within their safety permit operations.
For data that we collect independently (e.g. account registration, platform usage), SafetyPermit acts as the data controller.
11. Changes to This Policy
We may update this privacy policy from time to time. We will post the updated policy on this page with a revised "last updated" date. We encourage you to review this page periodically.
12. Contact Us
If you have questions about this privacy policy or wish to exercise your rights, please contact us:
- Email: hello@safetypermit.io
- Website: safetypermit.io