Privacy policy

Last updated 4 October 2026

When your organisation uses ShowerSafety, we hold your staff's names, contact details and the compliance records they create — on your organisation's behalf. We do not sell data, run advertising or use analytics, and we keep data on UK servers, except card payments, which Stripe handles.

1. Who we are

ShowerSafety is run by FixMyPool Ltd, trading as ShowerSafety (company number 17061006, registered in England and Wales, registered office 19 William Street, Colne, Lancashire, BB8 0HH). We are registered with the Information Commissioner's Office, registration number ZC099822.

For any question about this policy or your data, email privacy@showersafety.co.uk or write to us at our registered office.

2. Our two roles

When an organisation uses ShowerSafety, the personal data in its account — its users' details and the records they create — is processed on that organisation's behalf. The organisation is the controller and we are its processor. If you use ShowerSafety through your employer, your employer decides how your data is used, and you should contact them first; we will help them answer you.

We are the controller for the data we use to run our own business: account administrators and billing contacts, people who sign up or contact us, and the security records described below.

3. What we collect

Account details: name, email address, username, role and department. Passwords are stored only as a one-way hash; two-step verification secrets are encrypted.
Compliance records: tasks, temperature readings, flushes, inspections, lab results and notes, each recording who carried it out and when. HSG274 expects records to name the person and the time.
Billing details: organisation name, billing email address, plan, and the reference numbers Stripe gives us. Card details are entered on Stripe's own pages; we never see or store them.
Security records: the IP address used for each sign-in attempt, and the IP address and browser type recorded alongside changes in the audit trail.
Enquiries: what you send through our contact form (name, organisation, email, phone if given, the size of your sites and your message) and emails you send us. To limit repeated form submissions, we also keep a scrambled (hashed) form of your IP address for up to 24 hours.
Website: this website sets no cookies and uses no analytics. Like any web server, our hosting provider's servers keep standard access logs (IP address, page and time) for security and troubleshooting.

ShowerSafety is not designed to hold information about your guests, residents, tenants or customers, and you should not enter it — for example, in notes.

4. Why we use it, and our lawful basis

To provide ShowerSafety to the organisations that use it — as their processor, on their instructions; for administrators and billing contacts, to perform our contract.
To bill for paid plans and keep accounting records — performance of our contract, and our legal obligations under tax law.
To send service emails: confirming your email address, password resets, weekly overdue-task reminders, scheduled reports and trial reminders — performance of our contract and our legitimate interest in running the service. We do not send marketing emails without your consent.
To keep the service secure, prevent misuse and limit repeated sign-in attempts — our legitimate interests.
To answer enquiries and arrange demonstrations — our legitimate interests, or steps you have asked us to take before entering into a contract.

5. Who we share it with

We use these service providers (sub-processors) to run ShowerSafety:

20i Ltd — the servers that host the website, the app and its database, and that send and receive email, in UK data centres. We manage this hosting through CloudCanopy, our own hosting business, which resells 20i's service.
Stripe — card payments, subscriptions and invoices. Stripe may process data outside the UK, including in the United States, using the safeguards UK data protection law requires.

We may also share data with professional advisers, where the law requires it, or with a buyer of the ShowerSafety business, who would be bound by this policy. We never sell personal data and we do not use it for advertising.

6. Where it is kept

ShowerSafety data is stored on servers in the United Kingdom. The only transfers outside the UK are those made by Stripe for payments, as described above.

7. How long we keep it

Compliance records and the audit trail: while the organisation's account exists, and in any case for at least five years in line with HSG274, unless the organisation asks us to delete them.
User accounts: while the account exists. Deactivated users' names stay with the records they signed.
Sign-ups never confirmed by email: deleted about a week after the confirmation link expires.
Sign-in attempt records (with IP addresses): 90 days.
Email confirmation and password reset links: they stop working after 48 hours and 1 hour respectively.
Billing records: six years after the end of the financial year they relate to, as tax law requires.
Enquiries: up to two years after our last contact, unless you become a customer.
Contact form submission limits: up to 24 hours.
Backups: a copy of the database is taken every night and kept for 30 days, then deleted automatically.

8. How we protect it

Every connection is encrypted with HTTPS; passwords are hashed; two-step verification is available on every account; each organisation's data is kept separate from every other's; and access to the servers and database is restricted to the people who run the service. Our own administrators can see account-level information (organisation, plan, users, usage and recent activity) to run billing and support; they sign in with two-step verification every time, every access is logged, and they open an organisation's records only when it asks us to or the law requires it. More on our Security page.

9. Your rights

You have the right to ask for a copy of your personal data, to have it corrected, erased or restricted, to object to how we use it, and to receive it in a portable format. Some rights are limited where records must be kept — for example, an organisation may need to keep its water-safety records, including who carried out each check.

If your data is held in your employer's ShowerSafety account, ask them first; we will help them respond. Otherwise, email privacy@showersafety.co.uk. We will reply within one month.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.

10. Children

ShowerSafety is a workplace service and is not intended for anyone under 16.

11. Changes to this policy

We will update this policy when how we use data changes. We will tell organisations using ShowerSafety about material changes by email, and the date at the top of this page shows when it last changed.