Hybrid Comply Privacy and Data Protection Policy

Effective date: 16th August 2026 · Last updated: 16th August 2026 · Version: 1.0

1. About this policy

This Privacy and Data Protection Policy explains how HYBRID HQ LTD, trading as Hybrid Comply (“Hybrid”, “we”, “us” or “our”), collects, uses, stores, shares and protects personal data through:

• the Hybrid Comply mobile application;
• any Hybrid Comply web portal or dashboard;
• inspection, compliance-reporting and related services;
• customer support, billing and business communications; and
• any related website, integration or service that links to this policy.

Hybrid Comply is a property health and safety inspection and compliance-reporting platform intended for use in the United Kingdom.

Our users may include property owners, schools, businesses, hotels, recreation facilities, landlords, managing agents, inspectors, contractors, tenants, occupiers and authorised members of their organisations.

This policy should be read alongside our Terms of Service, Cookie and Mobile Tracking Notice, Data Retention Schedule and any customer Data Processing Agreement.

2. Who is responsible for your personal data?

The organisation responsible for your data depends on the context in which it is processed.

2.1 Hybrid as data controller

Hybrid normally acts as a data controller for personal data used to:

• register and administer accounts;
• authenticate users and secure the platform;
• manage subscriptions, payments and billing;
• communicate with customers and users;
• provide customer support;
• monitor platform performance and prevent misuse;
• comply with our legal and regulatory obligations; and
• improve Hybrid using appropriately limited product analytics.

As controller, our details are:

• Legal name: HYBRID HQ LTD
• Company number: 17344036
• Registered office: 142-143 Parrock Street, Gravesend, Kent, United Kingdom, DA12 1EY
• Privacy email: hello@hybrid-hq.co.uk
• Support email: hello@hybrid-hq.co.uk

2.2 Hybrid as data processor

Where a customer uses Hybrid to collect inspection information about properties, tenants, employees, visitors, contractors, pupils or other individuals, the customer will normally decide why and how that information is collected.

In those circumstances:

• the customer is normally the data controller; and
• Hybrid normally acts as the customer’s data processor.

Hybrid will process that information only:

• to provide the contracted services;
• on the customer’s documented instructions;
• as described in our Data Processing Agreement; or
• where processing is required by law.

Individuals seeking to exercise rights relating to customer-controlled inspection records should normally contact the relevant property owner, school, business, landlord, agent or other customer first. We will assist our customers with valid requests as required by data-protection law.

3. Personal data we collect

The personal data we collect depends on how Hybrid is used.

3.1 Account and contact information

This may include:

• name;
• business or organisation name;
• job title and role;
• email address;
• telephone number;
• postal or business address;
• username and account identifier;
• login and authentication information;
• account permissions;
• profile photograph, where provided; and
• communications preferences.

3.2 Property and inspection information

This may include:

• property address and unit or room identifiers;
• property type and occupancy information;
• inspection date, time and status;
• health and safety observations;
• inspection questions and responses;
• hazards, defects and remedial actions;
• compliance classifications and risk ratings;
• maintenance information;
• certificates, reports and supporting documents;
• photographs, videos or audio notes;
• annotations, comments and signatures;
• names or contact details entered into inspection records;
• contractor or responsible-person details;
• timestamps and audit history; and
• information about tenants, occupants, employees, visitors or other individuals appearing in inspection material.

Inspection photographs or notes may unintentionally reveal faces, names, possessions, accessibility needs, health information, religious items, family circumstances or other sensitive details. Users must avoid capturing such information unless it is necessary, lawful and authorised.

3.3 Location information

With the device user’s permission, Hybrid may collect:

• precise or approximate device location;
• the location at which an inspection, photograph or record was created;
• location-related timestamps; and
• location metadata attached to uploaded content.

Location information is used to support inspection verification, record accuracy, fraud prevention and compliance reporting.

Users can manage location permissions through their device settings. Disabling location access may prevent certain verification or inspection features from working properly.

Hybrid must not use background location tracking unless:

• the feature is necessary for a clearly identified service;
• the user receives a prominent explanation;
• appropriate consent or another valid legal basis has been established; and
• the user can control the permission through the application or device.

3.4 Device and technical information

This may include:

• device type and model;
• operating system and app version;
• device and application identifiers;
• internet protocol address;
• language and regional settings;
• login records;
• crash and diagnostic information;
• network information;
• security events;
• activity logs;
• feature interactions; and
• consent and preference records.

3.5 Payment and billing information

This may include:

• billing name and address;
• subscription plan;
• payment status;
• invoices and transaction references;
• VAT or tax information;
• the last four digits and expiry information associated with a payment method, where supplied by our payment provider; and
• records of refunds, failed payments and billing correspondence.

Full card details should be collected and processed directly by our authorised payment service provider. Hybrid does not intend to store complete payment-card numbers or card security codes.

3.6 Customer-support and communication information

This may include:

• messages sent to our support team;
• reported technical problems;
• feedback and survey responses;
• telephone or video-call notes;
• screenshots or files supplied to support a request; and
• records of complaints and their resolution.

3.7 Information from customers and third parties

We may receive personal data from:

• an organisation that creates an account for a user;
• a landlord, agent, school, employer or property owner;
• an inspector or contractor;
• payment processors;
• authentication providers;
• customer-authorised integrations;
• app stores;
• analytics and security providers; and
• public authorities where legally permitted or required.

Customers must ensure that they have a lawful basis for entering third-party personal data into Hybrid and that required privacy information has been given to those individuals.

4. Why we use personal data and our lawful bases

We process personal data only where a lawful basis applies.

Where we rely on legitimate interests, our interests may include operating and securing Hybrid, supporting customers, improving service reliability, preventing misuse, maintaining business records and establishing or defending legal claims.

We will consider whether those interests are necessary and balanced against the rights and reasonable expectations of affected individuals.

Where we rely on consent, consent may be withdrawn at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

5. Special-category and highly sensitive data

Hybrid is not designed for the routine collection of special-category data, such as information revealing:

• racial or ethnic origin;
• political opinions;
• religious or philosophical beliefs;
• trade-union membership;
• genetic or biometric identity;
• physical or mental health;
• sex life; or
• sexual orientation.

Inspection photographs, videos, documents or notes may nevertheless reveal such information. Customers and users must:

• collect sensitive information only where it is strictly necessary;
• establish both an Article 6 lawful basis and an applicable special-category condition;
• restrict access to authorised individuals;
• avoid photographing people or personal possessions where possible;
• redact or crop unnecessary information;
• follow applicable safeguarding and workplace policies; and
• not use Hybrid as a medical-record, pupil-record or general employee-monitoring system.

Hybrid may remove, restrict or quarantine content that appears to have been collected unlawfully or presents a serious privacy or safeguarding risk.

6. Photographs, video and inspection evidence

Users must take reasonable steps before capturing inspection media to:

• inform occupants or responsible persons that an inspection is taking place;
• avoid including identifiable people unless necessary;
• avoid capturing children wherever possible;
• avoid private documents, computer screens, photographs and personal belongings;
• limit images to the defect, hazard or compliance issue;
• use redaction or cropping tools where available;
• confirm that entry to and photography within the property are authorised; and
• comply with their organisation’s privacy, safeguarding and inspection procedures.

Hybrid may preserve the original upload, metadata, annotations and editing history where necessary to maintain an evidential audit trail.

The availability of redaction tools does not transfer responsibility for lawful collection from the customer or user to Hybrid.

7. Schools and children’s information

Hybrid is intended for use by authorised adults acting in a professional or property-management capacity. It is not directed to children and children must not create their own Hybrid accounts.

Where Hybrid is used in a school, nursery, residential facility, leisure centre or other place attended by children:

• users must avoid capturing children in photographs or video;
• inspections should be scheduled or framed to minimise the presence of children;
• images must focus on the property condition or safety issue;
• names, pupil work, timetables, medical notices and safeguarding records should not be captured;
• access to inspection records must be limited to authorised personnel;
• the customer must follow its safeguarding and data-protection policies; and
• any necessary processing of children’s personal data must be supported by an appropriate lawful basis and enhanced safeguards.

Customers must promptly notify Hybrid if inspection content contains a safeguarding disclosure or information that presents an immediate risk to a child. Hybrid is not an emergency or safeguarding-reporting service.

8. Automated decisions and compliance ratings

Hybrid may use rules, calculations or configurable criteria to:

• generate risk levels;
• identify incomplete inspections;
• flag potential non-compliance;
• recommend remedial actions; or
• produce draft compliance reports.

Unless we state otherwise, these features are decision-support tools and do not make solely automated decisions that produce legal or similarly significant effects on individuals.

Customers remain responsible for:

• checking the accuracy of inspection inputs;
• reviewing generated reports;
• applying professional judgement;
• correcting errors; and
• making final property, safety, tenancy, employment or compliance decisions.

We will provide additional information and appropriate rights where we introduce qualifying solely automated decision-making.

9. How we share personal data

We may share personal data with the following recipients where necessary.

9.1 Customer-authorised users

Inspection and property information may be visible to authorised users within the relevant customer account, including owners, administrators, inspectors, agents, contractors or report recipients.

Customer administrators control user access and are responsible for removing access when it is no longer required.

9.2 Service providers

We may use vetted service providers for:

• cloud hosting and data storage;
• account authentication;
• email, SMS and service notifications;
• payment processing;
• customer support;
• crash reporting and diagnostics;
• app analytics;
• security monitoring;
• data backup;
• document or report generation; and
• professional legal, accounting and insurance services.

These providers may process personal data only for authorised purposes and under appropriate contractual and security obligations.

A current subprocessor list is available on request from hello@hybrid-hq.co.uk.

9.3 Customer-directed recipients and integrations

We may disclose data where a customer instructs us to:

• send a report to a landlord, tenant, contractor or regulator;
• export information;
• connect Hybrid to another platform; or
• make records available through an integration.

Customers are responsible for confirming that recipients are authorised and that transfers are lawful.

9.4 Legal and safety disclosures

We may disclose personal data where reasonably necessary to:

• comply with a court order, law or regulatory requirement;
• respond to a lawful request from a public authority;
• investigate fraud, cybercrime or misuse;
• protect the rights, safety or property of Hybrid, our users or others;
• establish, exercise or defend legal claims; or
• respond to an emergency involving a serious threat to life or safety.

9.5 Corporate transactions

If Hybrid is involved in an investment, financing, merger, reorganisation, acquisition, sale or insolvency process, relevant personal data may be disclosed under confidentiality safeguards.

We do not sell personal data.

We do not permit third parties to use customer inspection data for their own advertising.

10. International data transfers

We aim to host and process customer data in the United Kingdom or another approved location specified in our service documentation.

Some suppliers may process personal data outside the United Kingdom. Where an international transfer is restricted, we will use an appropriate transfer mechanism, such as:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to the EU Standard Contractual Clauses; or
• another legally recognised safeguard.

We will carry out a transfer risk assessment where required and implement supplementary measures appropriate to the risks.

Further information about transfer safeguards can be requested at hello@hybrid-hq.co.uk.

11. How long we retain personal data

We retain personal data only for as long as reasonably necessary for the relevant purpose, including contractual, legal, tax, regulatory, evidential and dispute-resolution requirements.

Our proposed baseline retention periods are:

Customers may configure shorter or longer periods where permitted by their contract and applicable law.

When data is no longer required, it will be deleted, anonymised or securely isolated from ordinary use. Deleted data may remain temporarily in encrypted backups until the relevant backup cycle expires.

12. Security

We use risk-appropriate technical and organisational safeguards designed to protect personal data. These may include:

• encryption in transit;
• encryption at rest for production databases and file storage;
• role-based access controls;
• strong authentication and optional multi-factor authentication;
• least-privilege access;
• tenant or customer-account separation;
• secure software-development practices;
• vulnerability and dependency management;
• logging and security monitoring;
• backup and recovery controls;
• incident-response procedures;
• staff confidentiality obligations;
• employee privacy and security training;
• supplier due diligence; and
• periodic access reviews and security testing.

No digital service is completely secure. Users must protect their credentials, use strong unique passwords, enable available security features and promptly report suspected unauthorised access.

Security concerns should be reported to hello@hybrid-hq.co.uk.

13. Personal data breaches

Hybrid maintains procedures for identifying, containing, assessing, recording and responding to personal data breaches.

Where Hybrid acts as a processor, we will notify the affected customer without undue delay after becoming aware of a relevant breach and provide available information to support the customer’s legal duties.

Where Hybrid acts as controller, we will assess whether the breach must be reported to the Information Commissioner’s Office and whether affected individuals must be informed.

Not every security incident is legally reportable, but we will maintain an internal record of relevant incidents, assessments and actions.

14. Mobile permissions and similar technologies

Depending on the features used, Hybrid may request permission to access:

• the device camera;
• photo or media storage;
• precise or approximate location;
• notifications;
• files or documents;
• microphone access for voice notes; and
• biometric authentication controlled by the device.

We request permissions when they are needed and explain their purpose in the app. Users can withdraw permissions through device settings, although this may disable relevant features.

Hybrid may use local storage, software development kits, device identifiers or similar technologies for:

• authentication;
• security;
• remembering settings;
• crash diagnostics;
• performance measurement; and
• analytics.

Non-essential technologies will not be activated until valid consent has been obtained where consent is required. Users must be able to reject non-essential technologies as easily as they accept them and later change their preferences.

Details of each analytics, advertising or diagnostic provider, the information collected, its purpose and retention period must be listed in the separate Cookie and Mobile Tracking Notice.

Hybrid should not include third-party behavioural advertising SDKs unless separately assessed, clearly disclosed and supported by valid consent.

15. Marketing communications

We may send operational messages concerning:

• account security;
• inspections or assigned actions;
• reports;
• subscriptions and payments;
• service changes;
• maintenance; and
• changes to legal terms or this policy.

These service communications are not marketing and may be necessary to provide Hybrid.

We will send optional promotional email, SMS or push notifications only where permitted by law. Users can opt out through:

• the unsubscribe link in a message;
• notification or communication settings;
• device settings; or
• a request to hello@hybrid-hq.co.uk.

Opting out of marketing does not prevent necessary service communications.

16. Your data-protection rights

Depending on the circumstances, individuals may have the right to:

• be informed about how their data is used;
• request access to personal data;
• request correction of inaccurate or incomplete data;
• request deletion of data;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive certain data in a portable format;
• withdraw consent;
• object to direct marketing; and
• request safeguards concerning qualifying automated decisions.

These rights are not absolute and may be subject to legal exceptions.

To exercise a right relating to data controlled directly by Hybrid, contact hello@hybrid-hq.co.uk. We may request information necessary to confirm identity and locate the relevant records.

Where the request concerns inspection information controlled by a Hybrid customer, we may refer the request to that customer or assist the customer in responding.

We normally respond without undue delay and within the legally applicable period. We will explain any lawful extension, refusal or limitation.

17. Complaints

Please contact us first so that we can investigate your concern:

Privacy contact: JAMES, Jenson
Email: hello@hybrid-hq.co.uk

You also have the right to complain to the UK Information Commissioner’s Office.

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
United Kingdom

The right to complain to the ICO does not prevent you from seeking another legal remedy.

18. Customer responsibilities

Customers using Hybrid must:

• determine and document their lawful basis for inspection processing;
• provide appropriate privacy information to tenants, occupants, employees, pupils, visitors and other affected individuals;
• ensure users are properly authorised and trained;
• apply role-based access and regularly review user permissions;
• collect only information necessary for inspection and compliance purposes;
• avoid excessive or intrusive photography;
• establish an appropriate retention schedule;
• respond to data-subject requests;
• report suspected breaches to Hybrid promptly;
• use exports and reports securely;
• assess third-party integrations before enabling them;
• comply with safeguarding, employment, housing and sector-specific requirements; and
• enter into a Data Processing Agreement with Hybrid where Hybrid acts as processor.

Customers must not use Hybrid:

• for unlawful surveillance;
• to discriminate unlawfully;
• to collect information unrelated to property health, safety or compliance;
• to covertly monitor tenants, employees, pupils or visitors;
• to store criminal-offence, medical or safeguarding records unless expressly supported and appropriately protected;
• to capture intimate or highly private areas without lawful authority and necessity; or
• in any way that violates another person’s privacy, tenancy, employment or human rights.

19. Data protection by design

We will incorporate privacy and data-protection considerations into product planning, development and operation.

This includes, where appropriate:

• collecting the minimum information required;
• making optional fields clearly optional;
• using privacy-protective defaults;
• reducing unnecessary location precision;
• providing configurable retention controls;
• supporting redaction and controlled sharing;
• limiting administrator and staff access;
• assessing new suppliers and integrations;
• completing Data Protection Impact Assessments for high-risk features;
• testing deletion and export functions; and
• reviewing privacy impacts before materially changing Hybrid.

20. Changes to this policy

We may update this policy to reflect changes to Hybrid, our suppliers, legal requirements or data practices.

When changes are material, we will provide reasonable notice through the app, by email or through another appropriate method. We will not materially expand how we use previously collected personal data without establishing an appropriate lawful basis and providing any required notice or choice.

The “Last updated” date at the beginning of this policy identifies the latest version.

21. Contact us

Questions about this policy or Hybrid’s data practices should be sent to:

HYBRID HQ LTD
Address: 142-143 Parrock Street, Gravesend, Kent, United Kingdom, DA12 1EY
Email: hello@hybrid-hq.co.uk