Who operates HSE Guardian
HSE Guardian is operated by Robert Kopacz, a registered sole trader (živnostník) based in Levice, Slovakia (business ID / IČO: 50 674 498). For any question about this policy or your personal data, contact contact@hseguard.org.
What this policy covers
HSE Guardian is a workplace emergency alarm system used by client organizations ("Client", "your employer") to warn workers on a job site during an emergency and to confirm that everyone has been reached. Your employer decides to use HSE Guardian and is the data controller for your personal data. HSE Guardian (Robert Kopacz) processes that data on the Client's behalf and instructions, acting as a data processor.
What data we process
| Data | Notes |
|---|---|
| Name | So your employer and site administrators can identify you |
| Organization / site membership | Which company and job site you belong to |
| Phone number (optional) | Only if you choose to provide it, used solely to send a backup safety SMS if an in-app alert cannot be confirmed as delivered |
| Alarm history & acknowledgments | Records of when alarms were triggered and whether you confirmed receipt / marked yourself safe |
| Muster / check-in records | Whether you checked in at the assembly point during a real alarm |
HSE Guardian does not use analytics or advertising trackers, and does not collect continuous location data. If a future version of the app ever requests a one-time device location during an active SOS/alarm event, that feature will require its own separate, explicit permission and this policy will be updated first.
Why we process this data (legal basis)
Processing is based on the legitimate interest of your employer and HSE Guardian in keeping people safe on a job site. During an actual (non-drill) emergency, processing is additionally justified by the vital interest of protecting life and health. Where a phone number is collected, providing it is always optional and you can delete it at any time from within the app.
Who we share data with
Backup safety SMS messages are sent through Twilio Inc., our SMS delivery sub-processor. Twilio receives only the phone number and the text of the safety message needed to deliver it. Twilio's own Data Protection Addendum automatically incorporates the EU Standard Contractual Clauses that make this transfer lawful. We do not sell personal data or share it with anyone else.
How long we keep data
- Real (non-drill) alarm records and acknowledgments: 10 years from the event, matching the statute of limitations for personal-injury claims under Slovak law — these records are what would demonstrate the alarm and its delivery worked as intended.
- Drill/training alarm records: 12 months.
- Phone number: kept only while you are actively assigned to a site; removed automatically when you leave a site or delete it yourself.
Your rights
Subject to applicable law, you have the right to access, correct, or request erasure of your personal data, and to object to its processing. Because alarm/acknowledgment records may need to be kept for the retention period above to defend against possible legal claims, erasure of those specific records cannot always be immediate — but your phone number can always be removed on request. To exercise any of these rights, contact contact@hseguard.org. You also have the right to lodge a complaint with your national data protection authority (in Slovakia: the Office for Personal Data Protection of the Slovak Republic).
Security
Data is stored in Google Cloud Firestore, which encrypts data at rest and in transit by default. Access is controlled through security rules so that, for example, a worker can only confirm their own identity in an acknowledgment record, never someone else's.
Changes to this policy
We may update this policy as HSE Guardian evolves. The "Last updated" date above will always reflect the most recent revision.