ISDSS™ Privacy Policy

1. About this policy

This Privacy Policy explains how personal data is collected and used when you visit or use ISDSS™ (International Safety Data Sheet Service), including its website, accounts, Personal Library, Safety Data Sheet (SDS) and Chemical Risk Assessment (CRA) services, support channels and related features (the Service).

The Service is intended mainly for businesses, organisations and people involved in workplace safety, chemical management and regulatory compliance.

2. Who is responsible for your personal data

The Knights of Safety Limited is the data controller responsible for personal data processed through the Service.

3. Personal data we collect

The personal data we collect depends on how you use the Service.

Information you provide

• Name, email address, telephone number, company or organisation, country and job role.
• Account credentials and profile information.
• Answers provided during registration, including how you use SDSs and chemical-safety services.
• Marketing preferences.
• SDSs, CRAs and other information you save or upload to your Personal Library.
• Enquiries, feedback and correspondence.
• Any other information you choose to provide.

Information collected when you use the Service

• IP address, browser, operating system, device and referring-page information.
• Pages viewed, searches performed, features used, downloads and session information.
• Account login, library and download activity.
• Cookie and consent choices.
• Diagnostic, performance and security information.
• Records used to detect fraud, misuse or unauthorised activity.

Information from other sources

We may receive personal data from service providers that support authentication, security, analytics, website operation, customer support or business administration. If another person or organisation creates or manages an account for you, we may also receive information from them.

4. How and why we use personal data

Where we rely on legitimate interests, those interests are to operate, secure, support and improve the Service, prevent misuse and protect our legal rights. We consider whether those interests are overridden by your rights and interests before relying on this basis.

You may withdraw consent at any time. Withdrawal does not affect processing that took place before consent was withdrawn.

5. Cookies and analytics

We use strictly necessary technologies to provide and secure the Service. With your consent, we may also use analytics technologies to understand how visitors use the Service and improve it.

Optional analytics technologies are disabled unless you consent. You can accept or reject optional cookies and change your preferences at any time through Cookie Settings. Our Cookie Policy identifies the analytics services currently in use and explains the available controls.

The cookie used to remember your cookie preferences lasts for up to 12 months. An authenticated login session normally lasts for up to 7 days unless it ends earlier, for example when you sign out or the session is invalidated.

6. Who we share personal data with

We do not sell personal data. Where necessary for the purposes described in this Policy, we may share personal data with:

• Hosting, infrastructure and database providers.
• Search and content-delivery providers.
• Analytics and user-experience providers, where you have consented.
• Customer-support and communications providers.
• Customer-relationship and business-administration providers.
• Security, fraud-prevention and authentication providers.
• Professional advisers, insurers and auditors.
• Regulators, courts, law-enforcement agencies and public authorities where disclosure is required or permitted by law.
• A buyer, investor or successor involved in a genuine or proposed merger, acquisition, restructuring or sale, subject to appropriate confidentiality and data-protection safeguards.

Service providers acting on our behalf may process personal data only for authorised purposes and under appropriate contractual and data-protection obligations.

7. International transfers

Some service providers may process personal data outside the United Kingdom. Where required, we use an applicable adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful safeguard. You may contact us for information about the safeguard relevant to your personal data.

8. How long we keep personal data

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, and for any period needed to meet legal, accounting, security or dispute-resolution requirements.

The retention period depends on the type of record, including:

• Whether your account remains active and the information is needed to provide the Service.
• Whether information remains in your Personal Library.
• Legal, regulatory, tax, accounting or reporting requirements.
• The time reasonably needed to detect and investigate security incidents, fraud or misuse.
• Applicable limitation periods and the need to establish, exercise or defend legal claims.
• The retention settings and contractual terms of service providers acting on our behalf.

Password-reset links expire after 60 minutes. Cookie preferences are retained for up to 12 months, and authenticated sessions normally last for up to 7 days. Other account, library, download, login and correspondence records are retained according to the criteria above.

When personal data is no longer required, we delete it, anonymise it or place it beyond use, unless the law requires longer retention. Backup copies may remain for a limited period until they are overwritten or securely deleted.

9. Security

We use reasonable technical and organisational measures designed to protect personal data against accidental or unlawful loss, alteration, disclosure or access. These measures include access controls, encrypted communications, secure authentication, monitoring, logging, software maintenance and vulnerability management where appropriate.

No internet service can guarantee absolute security. You are responsible for keeping your login credentials confidential and notifying us promptly if you believe your account has been compromised.

10. Your data-protection rights

Depending on the circumstances and the lawful basis used, you may have the right to:

• Request access to your personal data.
• Ask us to correct inaccurate or incomplete personal data.
• Ask us to erase personal data.
• Ask us to restrict processing.
• Object to processing based on legitimate interests or to direct marketing.
• Receive certain personal data in a portable format.
• Withdraw consent at any time.
• Complain to a data-protection supervisory authority.

You have the right to object to processing based on our legitimate interests. You also have an absolute right to object to direct marketing.

To exercise a right, contact us using the details in section 2. We may need to verify your identity. Rights are not absolute, and an exemption may apply. We normally respond within one month, although the law permits an extension for complex or numerous requests.

You may complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or telephone 0303 123 1113. We would appreciate the opportunity to address your concern first, but you do not have to contact us before approaching the ICO.

11. Marketing communications

We send marketing communications only where we have an appropriate lawful basis. You may unsubscribe using the link in a marketing message or by contacting us. Essential account, security and service messages may continue because they are not marketing.

12. Artificial intelligence and automated processing

The Service may use artificial intelligence, machine learning or other automated technologies to help users search, organise, analyse or summarise information. Where these features process personal data, we apply this Policy and applicable data-protection law.

AI-generated material is an aid only. It is not a substitute for a manufacturer's SDS, a workplace assessment, professional advice or the judgement of a competent person. Users must review outputs before relying on them.

We do not currently use solely automated processing to make decisions about individuals that produce legal or similarly significant effects. If this changes, we will provide the information and safeguards required by law.

13. Children

The Service is not directed at children under 18, and we do not knowingly collect their personal data. If you believe a child has provided personal data through the Service, contact us so that we can investigate and take appropriate action.

14. Third-party websites and content

The Service may link to manufacturer websites, SDSs and other third-party resources. This Policy does not govern third parties' own processing. Review their privacy information before providing personal data to them.

15. Changes to this policy

We may update this Policy when the Service, our processing or the law changes. The Last updated date shows when it was most recently revised. Where a change materially affects how we use personal data, we will take reasonable steps to notify affected users before it takes effect.

16. Contact us

Questions, requests and complaints about privacy may be sent to contact@thechemicalsafetyassociation.org or to The Knights of Safety Limited at the registered-office address in section 2.

Last updated: 12 August 2026