Who is responsible for what
You, the contractor, are the data controller: you decide what's recorded about your workers and why. Shamrock Safety Ltd is the data processor: we run the system and only use the data to provide it to you. Every customer signs a data processing agreement setting this out, as Article 28 of the GDPR (and the UK GDPR) requires.
Where it's kept
Shamrock Comply runs on servers in Amsterdam, in the Netherlands, provided by Krystal Hosting Ltd. The database, uploaded files and backups all stay in the EU. Backups are taken daily and kept for 31 days.
Two things go outside the EU. The emails the system sends (invitations, password resets and alerts) are delivered by Resend, a US email service. They are sent from its Ireland (EU) region, but Resend keeps its records of sent emails in the United States. If Resend is unavailable, an email can instead go out through our host's email route (MailChannels, in Canada and the United States). And if you switch on the optional AI assistant (it's off by default), a question and the records needed to answer it are sent to Anthropic in the United States. The same applies to the optional certificate card reading: if you switch it on, a photo of a certificate is sent to Anthropic to read its details, and a person always checks the result, so nothing is decided automatically. Phone notifications pass through the push service of each person's phone or browser; in a browser they are encrypted end to end, and in the iPhone app Apple can see each notification's short title and text. The full list is on our sub-processors page.
The app can be installed on phones. It keeps only its own program files on the device so it opens quickly, never people's pages. Sign-ins and forms made with no signal are kept on that phone, tied to the person, until they can be sent, and are deleted if anyone else logs in.
Who can see what
- Every record belongs to one company, and nobody can see another company's data.
- Admins see their company. Site managers see only their own sites. Workers see only their own records. Subcontractors see only their own firm and crew.
- Uploaded certificates, documents and photos are never public. Each one is checked against who is asking before it's shown.
- If we ever need to look at your account to help you, it's logged: who, when and for how long.
- A subcontractor firm's office sees its own crew's records, including their sign-in and sign-out times at your sites, so it can work out their hours.
- A worker who works for more than one of our customers has one login, but each customer only sees its own records about them. When they accept your invitation, they can choose to give you a copy of the current training certificates another customer holds about them. You are the controller of that copy, the worker's agreement is recorded, and our data processing agreement covers it.
Photos and biometrics
The kiosk takes a photo at each sign-in, so a manager can check by eye that the right person signed in. Shamrock Comply does not use facial recognition and does not create any biometric data. Photos are deleted automatically after 31 days.
Workers can also be given a printed QR badge to scan at the kiosk instead of typing a PIN, with the same photo. Badges are yours to issue and can be cancelled at any time.
Workers can choose to confirm phone sign-ins with Face ID or a fingerprint. That check happens entirely on their own phone using the passkey standard; we only ever receive a yes or no, never a face or fingerprint.
Location
When a worker signs in on their phone, we check how far they are from the site. We store that distance, not their GPS position.
How long it's kept
Records are kept while you keep them in the system, apart from kiosk photos (31 days). Site close-out packs are your records: they are kept until your account is deleted, and you decide how long to keep any copy you download. Accident report details, including the injured person's health information, are recorded because you have a legal duty to report accidents and keep an accident book; Shamrock Comply never sends anything to the HSA or HSE for you. If you leave, you can download everything first; we then delete your data within 30 days, and it drops out of backups within a further 31 days.
Security
- Encrypted connections only (HTTPS), enforced by the browser
- Passwords and PINs stored only as salted hashes; sign-in pauses after repeated wrong attempts, whether or not the email address has an account, so the login page never reveals who uses Shamrock Comply
- Face ID phones and email address changes are logged, and the person is emailed each time
- Every form protected against cross-site request forgery
- Removed workers and suspended accounts lose access immediately
- Changes to sign-in records are logged with who made them and why
- An automated test suite, including access-control tests, runs before every release
More on our security page.
Your workers
Our privacy notice for workers and visitors explains all of this to the people on your sites. The app and kiosk link to it, and you're welcome to use it as part of your own privacy information.
Questions
We're happy to go through any of this with you or your data protection officer, and to send our data processing agreement before you sign anything. Email info@shamrockehs.com.