HSE-OS — Privacy Policy
Version 1.0 · effective 1 November 2026
Draft — have it reviewed by a lawyer licensed in Iraq before use.
This Privacy Policy explains what personal data HSE-OS handles, why, where it is kept, how long, and who to contact. It covers HSE-OS Online, HSE-OS On-Premise, the offline HSE Workspace, the demo and the "Request a demo" form at https://demo.hse-os.com, and the "Request the service" form at https://plans.hse-os.com. The main HSE-OS website is https://hse-os.com.
1. Who is responsible
1.1 HSE-OS is provided by Essa Jawad Kadhim, trading as HSE-OS, of Basra, Republic of Iraq (the "Provider").
1.2 Words with capital letters (such as Customer, Authorised User, Crew Member, Customer Data, Health Data, Hosted Service, On-Premise Installation and Service) have the meanings given in the HSE-OS Terms of Service.
1.3 Contact for privacy questions: [email protected] · WhatsApp +964 776 780 8363.
2. Two different roles
2.1 Customer Data — the Customer decides. Companies that buy HSE-OS (the Customers) enter information about their crews into HSE-OS. For this Customer Data, the Customer is the controller: it decides what is collected and why. The Provider is the processor: it handles the data only on the Customer's instructions, under the Data Processing Agreement (DPA).
2.2 The Provider's own data — the Provider decides. The Provider is the controller for the personal data it uses to run its own business: customer account and billing contacts, sales enquiries, demo and service requests sent through the website forms, licence records, server and security logs, and demo logs.
2.3 If you are a Crew Member (for example, a worker at one of a company's workplaces whose details are in HSE-OS), your employer or the company that entered your details is responsible for your data. Please send questions and requests to that company first. See Section 10.
3. What data is handled
3.1 Account data (Authorised Users). Name, user name, job title, role, department or sub-department, e-mail address, phone number, Telegram link (if turned on), password (stored only as a strong hash, never in readable form), two-step login settings, language and display preferences.
3.2 Crew data entered by Customers (Customer Data). Depending on how the Customer uses HSE-OS, this may include:
- (a) identity and job details: name, crew number, position, department, sub-department, team, rotation, nationality, date of birth, phone number;
- (b) ID copies, passport and permit details, CVs and photos;
- (c) training records and certificates, and their expiry dates;
- (d) timesheets, attendance, and, for some roles, pay and salary information;
- (e) HSE records: inspections, drills, observations, emergency response teams, reports;
- (f) incident records, including details of injuries and illness (Health Data), witness statements and investigation reports;
- (g) uploaded files and documents; and
- (h) the activity log of which Authorised User did what, and when.
3.3 Technical data and logs. IP address, browser type, device type, date and time of requests, pages or functions used, error reports, and security events (for example, failed sign-ins).
3.4 Licence data (On-Premise Installations). Once a day, an On-Premise Installation sends the Provider: the installation ID, the licence number, the HSE-OS version, the web address, and the numbers of sub-departments, accounts and crew profiles. It never sends names, certificates, salaries, files or other Customer Data.
3.5 Backup recovery key. HSE-OS may send the Provider a sealed (encrypted) copy of a Customer's backup recovery key, so the Provider can help recover backups if the Customer loses the key. The Provider uses it only on the written request of the Customer's main administrator.
3.6 Business contacts. Names, job titles, company, e-mail, phone and WhatsApp number, and messages of people who contact the Provider, buy HSE-OS or sign an Order Form; invoices and payment records.
3.7 HSE Workspace (offline). The data entered in the offline HSE Workspace stays in a folder on the user's own computer. The Provider does not receive it. The Provider holds only the purchase details: buyer's name, contact details, the licensed person's name, the workplace code, the licence key and payment records.
3.8 Demo and service requests. The details people give in the "Request a demo" and "Request the service" forms (listed in Section 12.1). The demo itself uses made-up data, and its users must not enter real personal data. The Provider keeps technical logs (IP address, time, pages, security events) of demo use. See Section 12.
3.9 Usage and server status reports. Every hour, each licensed HSE-OS server with internet (hosted or On-Premise) sends the Provider a usage and server status report with numbers only: the installation ID, licence number, version, web address, company name and hosting option; counts of accounts (in total, active in the last day, week and month, and per role), workplaces, crew profiles, incidents, inspections, daily reports and certificates; the number and size of files per kind, files added in the last day and week, and the space used by files and by the database; the server's processor, load, memory and disk use and running time; the last successful backup time and the number of messages not sent in the last day. Since version 16.2 it also contains daily activity counts and the server's state: for the last day, and for yesterday and today, the number of sign-ins and of people who signed in, the number of records added and changed in each section (incidents, inspections, drills, daily reports, crew and equipment certificates, crew profiles, training, timesheets, letters, rota, site reports) and the number and size of files added per kind; the average and highest processor, memory, disk use and load over the last 24 hours (measured every 5 minutes on the server) and how much the disk, database and files folder grew; and the server's state, checked every hour on the server: Ubuntu and kernel version, waiting updates and security updates, whether a restart is needed, running time, Docker version, the state of HSE-OS's own containers, and the time and size of the last backup. These are counts and versions only, kept on the same terms. It never contains names, e-mail addresses, file names, file contents or any record about a person. It is used for support, capacity planning, warnings about server problems and licence checks. The Customer's HR Manager can see exactly what is sent, and the last report, on the Licence page. A server without internet sends the same report as a file once a month, when the Customer chooses to send it (Terms of Service, Section 19.9).
3.10 Password reset codes. When the Customer asks, the Provider may issue a one-time code (valid for 24 hours, only on the Customer's own HSE-OS server and for its HR Manager's account) with which the HR Manager sets a new password himself; the Provider never sees, keeps or sends the password and keeps only a record that the code was made (when, for which licence and which username).
4. Cookies and browser storage
4.1 HSE-OS uses only necessary cookies:
- (a) a session cookie that keeps a user signed in; and
- (b) a security cookie that protects forms against cross-site request forgery.
4.2 HSE-OS also saves a few preferences in the browser's local storage (for example, the language, the chosen department, and table layout). These stay on the user's device.
4.3 Cloudflare, which carries traffic to HSE-OS, may set its own necessary security cookies to detect bots and attacks.
4.4 HSE-OS does not use advertising cookies, tracking cookies or third-party analytics.
5. Why the data is used, and the legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Providing the Service to the Customer (storing and showing records, reminders, reports, notifications, backups) | Account data, Customer Data | Contract with the Customer; for Customer Data, on the Customer's instructions (the Customer has its own legal basis) |
| Signing in, security, preventing misuse and investigating incidents | Account data, technical data and logs | Legitimate interest in keeping the Service secure; contract |
| Support requested by the Customer | Account data, the parts of Customer Data needed | Contract; Customer's instructions |
| Checking and renewing licences | Licence data | Contract; legitimate interest in protecting the Software |
| Support, server capacity planning, warnings about server problems, licence checks | Usage and server status reports (Section 3.9) | Contract; legitimate interest in running and supporting HSE-OS |
| Invoicing, accounting and tax | Business contacts, payment records | Contract; legal obligation |
| Answering enquiries and sales follow-up | Business contacts | Legitimate interest; steps before a contract |
| Answering demo and service requests: checking the request, sending the demo account, preparing a quote and following up | Data from the website forms | Steps taken at the person's request before a contract; legitimate interest in answering enquiries |
| Running the demo safely | Demo technical logs | Legitimate interest in security and fair use |
| Improving HSE-OS | Usage statistics that do not identify anyone | Legitimate interest |
| Meeting legal duties | Any data, only as required | Legal obligation under the applicable laws of the Republic of Iraq or other applicable law |
5.1 The Provider does not use Customer Data for its own purposes, does not sell it, and does not use it for advertising or for training artificial intelligence models.
5.2 Health Data and other sensitive data (for example, injury details and ID copies) are processed only as part of the Service, on the Customer's instructions. The Customer is responsible for having a lawful basis and, where required, consent.
6. Where data is stored
6.1 Hosted Service. Customer Data is stored on cloud servers chosen by the Provider, in data centres operated by the Provider's hosting provider.
6.2 On-Premise Installation. Customer Data is stored on the Customer's own server, wherever the Customer keeps it. The Provider does not hold it, except data the Customer gives it for support, the licence data in Section 3.4 and the usage and server status reports in Section 3.9 (numbers only).
6.3 HSE Workspace. Data is stored in a folder on the user's own computer.
6.4 Traffic. Web traffic to HSE-OS passes through Cloudflare's global network.
6.5 Website forms. Demo and service requests are kept on the Provider's own server, in a data centre operated by the Provider's hosting provider.
7. Who data is shared with
7.1 The Provider does not sell personal data.
7.2 The Provider shares personal data only with:
- (a) sub-processors that help provide the Service (listed in Section 8);
- (b) the Customer and its Authorised Users, for Customer Data;
- (c) professional advisers (for example, lawyers and accountants), under confidentiality;
- (d) authorities, where the law requires it or to protect people's safety or rights; and
- (e) a company that the Provider owns or controls, or a buyer of the HSE-OS business, under the same protections.
8. Sub-processors
8.1 The Provider currently uses these sub-processors:
| Sub-processor | What it does | Data involved | Location |
|---|---|---|---|
| Oracle Corporation (Oracle Cloud Infrastructure) | Cloud servers for the Hosted Service, the demo and the website forms | All Customer Data of the Hosted Service; demo and service requests | Data centres operated by the hosting provider |
| Cloudflare, Inc. | Carries and protects web traffic (DNS, proxy, attack protection) | Data passing between browsers and the Service; IP addresses | Global network |
| Telegram (only if turned on) | Sends notifications and, if chosen, encrypted backup files | Message content (for example, names, certificate expiry dates), Telegram user IDs | Telegram's servers (outside Iraq) |
| Brevo (Sendinblue SAS) | Sends e-mail notifications (only if turned on) and the Provider's e-mails about demo and service requests | E-mail addresses, names and message content (for a demo: the demo username and password) | European Union |
8.2 The Provider will update this list and give Customers notice of new sub-processors as described in the DPA.
8.3 Telegram and e-mail notifications are optional. The Customer and each Authorised User decide whether to turn them on. E-mails about demo and service requests are always sent through the e-mail service (see Section 12.4).
9. International transfers
9.1 Some sub-processors (for example, the cloud servers, Cloudflare, Telegram and the e-mail service) may store or handle data outside the Republic of Iraq.
9.2 The Provider chooses well-known providers with recognised security practices and uses contracts and technical measures (such as encryption in transit and encrypted backups) to protect the data.
9.3 Customers who must keep data inside Iraq or inside their own network may choose an On-Premise Installation.
10. Your rights
10.1 Depending on the law that applies to you, you may have the right to ask for access to your personal data, to correct it, to delete it, to limit or object to its use, or to receive a copy.
10.2 Crew Members and Authorised Users: please send requests to the company that uses HSE-OS (your employer or the company that entered your details). That company controls your data and can correct, export or delete it in HSE-OS. If the Provider receives your request, it will pass it to that company and help it respond.
10.3 Business contacts, people who sent a demo or service request, and demo users: send your request to [email protected]. The Provider will reply within 30 days. It may ask you to prove your identity. You may ask at any time for your request and its details to be deleted.
10.4 You may also complain to a competent authority in your country.
11. How long data is kept
| Data | How long |
|---|---|
| Customer Data (Hosted Service) | While the Customer's Agreement is active, then 60 days after it ends so the Customer can ask for an export, then deleted. Backup copies are deleted as backups expire, within 12 months after that (daily backups are kept for 14 days, weekly backups for 8 weeks and monthly backups for 12 months). |
| Customer Data during a suspension for late payment | Not deleted for 60 days from the start of the suspension. |
| Pilot data | Deleted 30 days after the pilot ends, unless the Customer continues as a paying Customer. |
| Account data | As long as the account exists; removed with the Customer Data. |
| Server and security logs (Hosted Service) | 24 months |
| Demo account and demo copy (made-up data and anything the user types or uploads in it) | Deleted automatically 2 hours after the first sign-in, or 2 days after the demo request is approved, whichever comes first. |
| Demo and service requests (website forms) | If the person does not become a Customer: deleted 12 months after the request, or earlier if the person asks. If the person becomes a Customer: kept as business contacts (below). |
| Demo technical logs | 30 days. |
| Licence data | For the life of the licence and as long as needed for accounting and legal duties. |
| Usage and server status reports | Hourly figures: 14 days. One set of figures per day (with that day's activity counts and the server's state): 400 days. The newest report: while the licence exists. |
| Invoices and payment records | As long as required for accounting and tax under the applicable laws of the Republic of Iraq. |
| Business contacts | While there is a business relationship, and up to 2 years after the last contact, unless the person asks for earlier deletion. |
11.1 The Provider may keep data longer only where the law requires it, and then keeps it secure.
12. Demo and service requests (website forms)
12.1 What the forms collect. There are two forms:
- (a) "Request a demo" (https://demo.hse-os.com): name, job title, company, work e-mail, phone or WhatsApp number, country, company type, number of workplaces, preferred language, an optional message, and the person's confirmation that they accept the Demo Terms and this Privacy Policy; and
- (b) "Request the service" (https://plans.hse-os.com): company and contact details, the chosen package, hosting option, billing period, number of offline licences, wished start date and notes.
12.2 Why. The Provider uses this data only to answer the request, to check it and, for a demo, to send the demo account, to prepare a quote, Order Form or contract, and to follow up on the request. It does not sell it or use it for advertising.
12.3 Where. The requests are kept on the Provider's own server (Section 6.5). They are shared only as described in Section 7.
12.4 E-mails. E-mails about a request, including the e-mail from [email protected] with the demo username and password, are sent through an e-mail delivery service, Brevo, acting on the Provider's behalf. Brevo receives only what is needed to deliver the e-mail: the e-mail address, the name and the message content.
12.5 How long. If the person does not become a Customer, the request and its details are deleted 12 months after the request, or earlier if the person asks. The person may ask for deletion at any time by e-mail to [email protected]. If the person becomes a Customer, the details are kept as business contacts (Section 11).
12.6 The demo. When the Provider approves a demo request, the person receives one username and one password for a private demo of their own at https://demo.hse-os.com, with made-up sample data that nobody else sees. After signing in, they choose which of the 10 roles to use and can switch roles. The demo account works for 2 hours from the first sign-in (a countdown is shown on the screen) and must be used within 2 days of the approval. When the 2 hours end, or 2 days have passed since the approval, whichever comes first, the demo account, the demo copy and everything typed or uploaded in it are deleted automatically. A new demo may be requested; the Provider may refuse a request, including repeated requests, without giving a reason.
12.7 Do not enter real personal data or confidential information in the demo.
12.8 The demo itself does not send Telegram messages or e-mails.
12.9 The Provider keeps technical logs of demo use for 30 days for security and fair use. The Demo Terms also apply.
13. Security
13.1 The Provider uses reasonable technical and organisational measures to protect personal data. They include encrypted connections (HTTPS) between users' browsers and the Service's web address, passwords stored only as strong hashes, optional two-step login, role-based access, an activity log, encrypted backups and restricted administrator access.
13.2 No system is completely secure. If a personal data breach affects Customer Data, the Provider will tell the Customer within 72 hours of becoming aware of it, as set out in the DPA. The Customer then decides whether to inform Crew Members and authorities.
14. Children
14.1 HSE-OS is meant for workplaces and is not intended for children under 18. Customers must not enter data about children unless the law allows it and it is strictly necessary.
15. Changes to this Policy
15.1 The Provider may update this Policy. The version number and effective date at the top show the current version. Material changes will be notified to Customers at least 30 days in advance.
16. Language
16.1 This Policy may be translated into Arabic or other languages. If there is any conflict between the English version and a translation, the English version prevails.
17. Contact
[email protected] · WhatsApp +964 776 780 8363 · Basra, Republic of Iraq