Privacy Policy

1. Introduction

RhinoCert® is operated by RHINOCERT LTD, a company registered in England and Wales with company number 17150289 (VAT No. GB517421019), whose registered office is at S08 The Genesis Centre, Innovation Way, Stoke-on-Trent, ST6 4BF ("we", "our", or "us"). RHINOCERT LTD is the data controller for the personal information described in this Privacy Policy and is registered with the UK Information Commissioner's Office under reference ZC144494.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our electrical certification platform and related services (the "Service").

Please read this Privacy Policy carefully. If you do not agree with the terms of this Privacy Policy, please do not access the Service.

2. Information We Collect

2.1 Personal Information

We collect personal information that you voluntarily provide when you:

• Register for an account
• Create electrical certificates
• Contact us for support
• Subscribe to our services

This information may include:

• Name and contact information (email, phone, address)
• Company information and business details
• Professional qualifications and certifications
• Payment information (processed securely through Stripe)
• Certificate data and client information

2.2 Technical Information

We automatically collect certain technical information when you use our Service:

• Device information (type, operating system, browser)
• IP address and location data
• Usage data and analytics
• Log files and error reports

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain our Service
• Process your transactions and manage your account
• Generate and store your electrical certificates
• Communicate with you about your account and our services
• Provide customer support and technical assistance
• Improve our Service and develop new features
• Train and improve our AI features (including AI Circuit Detection) using photographs you upload (such as consumer unit images)
• Ensure security and prevent fraud
• Comply with legal obligations

3.1 Certificate Pre-population

To streamline your workflow and reduce data entry, information you provide during account registration (such as your name, company details, business address, and professional qualifications) is automatically used to pre-populate relevant fields in your electrical certificates. This includes:

• Your name and professional details in certificate signature sections
• Company name, address, and contact information in certificate headers
• Business registration and scheme membership details where applicable
• Professional qualifications and certification numbers

Some pre-populated fields (such as your name and company address) are locked to ensure consistency and prevent errors, while other fields can be modified as needed for each specific certificate. This feature is designed to save time while maintaining accuracy and professional standards.

4. Legal Basis for Processing

Under the UK GDPR, we process your personal information on the following legal bases:

5. Information Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information in the following circumstances:

4.1 Service Providers

We share information with the following trusted third-party service providers who assist us in operating our Service:

• Google Cloud Platform / Firebase — hosting, database, authentication, file storage
• Google reCAPTCHA Enterprise — bot detection and abuse protection (see Section 9.1)
• Firebase Analytics (Google) — collects default app-lifecycle events (such as first launch, session start, screen views, and app removal) linked to your Firebase Auth user ID, used solely to understand how the app is used and improve the product. We do not log custom analytics events and we do not use this data for cross-app tracking or advertising.
• Stripe — payment processing and subscription management
• Apple Pay (Apple Inc.) — wallet-based payment method available to users on Safari / iOS / iPadOS. Tokenises your payment card via Apple's Wallet and returns a one-time token to our payment processor (Stripe). Apple may process device and transaction context as an independent data controller.
• Google Pay (Google LLC) — wallet-based payment method available to users with a payment card saved in their Google account. Tokenises your payment card via Google's wallet and returns a one-time token to our payment processor (Stripe). Google may process device and transaction context as an independent data controller.
• Resend — transactional email delivery
• Vercel — web application hosting
• Microsoft (Microsoft Corporation) — website analytics. If you consent to analytics cookies, Microsoft Clarity records how you use our public website, sign-up and checkout pages — the pages you view, clicks, scrolling and mouse movement — as session recordings and heatmaps, so we can see where the site works and where it doesn't. Clarity hides what you type into forms, and it never runs in the signed-in portal where you work with certificates or your customers' details. It uses cookies (_clck, _clsk) together with your IP address and browser user-agent. If you also consent to marketing cookies, Microsoft may link this data to its advertising cookie (MUID) and use it for its own advertising and analytics. Microsoft processes this data under the Microsoft Privacy Statement. This is off by default and only active with your consent; you can withdraw it at any time via the “Cookie preferences” link in our footer.
• Meta (Meta Platforms Ireland Limited) — advertising on Facebook and Instagram. If you consent to marketing cookies, the Meta Pixel records your visits, interactions (such as button clicks) and key steps (such as opening the sign-up page, creating an account, starting checkout or subscribing), so we can measure which ads work, show our ads to people who have visited, and let Meta find people with similar characteristics (“lookalike” audiences). To match these actions to your Meta account, the pixel sends a hashed (pseudonymised) copy of the details you enter in our sign-up form, such as your name and email address — scrambled in your browser before they are sent — together with your IP address, browser user-agent, and Meta's cookies and click identifiers (_fbp, _fbc). We and Meta are joint controllers for collecting and sending this data; Meta is an independent data controller for how it then uses it, including for its own advertising, optimisation and measurement purposes, under its own privacy policy. This is off by default and only active with your consent; you can withdraw it at any time via the “Cookie preferences” link in our footer.
• TikTok (TikTok Information Technologies UK Limited) — advertising on TikTok. If you consent to marketing cookies, the TikTok pixel (and our server) record your visits, interactions (such as button clicks) and key steps (such as opening the sign-up page, creating an account, starting checkout or subscribing), so we can measure and improve our advertising, show our ads to people who have visited, and let TikTok find people with similar characteristics (“lookalike” audiences). To match these actions, we share a limited set of data with TikTok — a hashed (pseudonymised) copy of your email address and any other contact details you enter in our sign-up form, your IP address, browser user-agent, and ad/click identifiers (such as the TikTok click ID and the _ttp cookie); we never send plain-text contact details. TikTok acts as an independent (and, for some purposes, joint) data controller and may use this data for its own advertising, optimisation and measurement purposes under its own privacy policy. This is off by default and only active with your consent; you can withdraw it at any time via the “Cookie preferences” link in our footer.
• Google Ads (Google Ireland Limited) — advertising on Google Search, YouTube and Google's partner sites. If you consent to marketing cookies, the Google Ads tag records your visits to our public website and key steps (creating an account, subscribing), so we can measure which ads work and show our ads to people who have visited. To match a sign-up or subscription to the ad that led to it (“enhanced conversions”), the tag sends a hashed (pseudonymised) copy of the email address you enter in our sign-up form — scrambled in your browser before it is sent — together with your IP address, browser user-agent, and Google's cookies and click identifiers (such as _gcl_au, _gcl_aw and the Google click ID). Google also uses that hashed email to keep lists of people who have signed up or subscribed (“customer lists”), so we can stop showing them sign-up ads, or show them more relevant ones. Google processes the hashed details on our behalf under the Google Ads Data Processing Terms, and acts as an independent data controller for its own advertising and measurement purposes under its own privacy policy. This is off by default and only active with your consent; you can withdraw it at any time via the “Cookie preferences” link in our footer.
• OpenStreetMap Foundation (Nominatim) — reverse-geocoding used to convert your device's GPS coordinates into a postal address when you tap “Use current location” on a certificate. Only latitude and longitude are sent; no account identifier or other personal data is included.
• HaveIBeenPwned (Pwned Passwords API) — checks whether a password you choose has appeared in known data breaches, using k-anonymity. Only the first five characters of a one-way SHA-1 hash of your password are sent; your password itself is never transmitted.

Advertising pixels run only on our public website, sign-up and checkout pages. We never share your certificates, your customers' details or anything about your jobs with any advertising platform.

5.2 Legal Requirements

We may disclose your information if required by law or in response to valid legal requests from public authorities.

5.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

6. Data Security

We implement appropriate technical and organizational security measures to protect your personal information:

• Encryption of data in transit and at rest
• Secure authentication and access controls
• Regular security assessments and updates
• Secure cloud infrastructure (Firebase/Google Cloud)
• PCI DSS compliant payment processing

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

7. Data Retention

We retain your personal information for as long as necessary to provide our services, comply with legal obligations, resolve disputes, and enforce agreements.

7.1 When You Delete Your Account

You can delete your account at any time from within the app (Settings → Delete your account) or from the web portal (Account → Delete your account). When you delete your account, we immediately and permanently delete:

• Your user profile and login credentials
• Your company memberships
• Any companies where you are the sole owner, along with all company data (certificates, team data, invitations, logos, and stored files)

7.2 Data Retained After Account Deletion

The following data is retained after account deletion for the reasons stated:

• Financial records (tax compliance): Billing history, invoices, and payment records are retained for 6 years by our payment processor Stripe, as required by UK tax law (HMRC). RhinoCert does not store payment card details directly. Legal basis: legal obligation (Article 6(1)(c) UK GDPR).
• Security audit logs: Records of account actions (e.g. "account deleted") are retained for security and compliance purposes. These contain only a user identifier, the action performed, and a timestamp. Legal basis: legitimate interest in security (Article 6(1)(f) UK GDPR).
• Certificates belonging to other companies: If you created certificates as a team member of another company, those certificates remain with the company. Electrical certificates are legal compliance documents under BS 7671 and the company is the data controller for them — see Section 7.3 below.

7.3 Electrical Certificate Data

Electrical certificates created through RhinoCert contain information about electrical installations and the professionals who inspected or installed them. This data has a specific regulatory context:

• The company account holder (the electrical business) is the data controller for certificate data and any client information within certificates.
• RhinoCert is the data processor — we store and process certificate data on behalf of the company account holder.
• Electrical certificates must be retained in accordance with BS 7671 (IET Wiring Regulations) and relevant building regulations. They are legal compliance documents, not personal data belonging to the individual who created them.
• If a homeowner or client wishes to request deletion of their data from a certificate, they should contact the electrical company that issued the certificate (the data controller), not RhinoCert.

8. Your Rights and Choices

Under the UK GDPR, you have the following rights regarding your personal information:

• Access: Request access to your personal information
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your personal information (see Section 7.1 for what is deleted and Section 7.2 for what is retained and why)
• Portability: Request a copy of your data in a portable format
• Restriction: Request restriction of processing
• Objection: Object to processing based on legitimate interest

8.1 How to Delete Your Account

You can delete your account directly without contacting us:

• In the mobile app: Go to Settings, then tap "Delete your account" at the bottom of the page
• On the web portal: Go to Account, then click "Delete your account" at the bottom of the page
• By email: Contact support@rhinocert.com and we will process your request within 30 days

Account deletion is immediate when done through the app or web portal. You will receive a confirmation email after your account has been deleted. If you are the owner of a company with other team members, you will need to transfer ownership or close the company before deleting your account.

8.2 Complaints

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint. RHINOCERT LTD's ICO registration reference is ZC144494.

9. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience:

• Essential cookies: Required for the Service to function
• Analytics cookies: Help us understand how you use our Service (Vercel, and Microsoft Clarity session recordings on our public website). Clarity is off by default and set only with your consent
• Preference cookies: Remember your settings and preferences
• Marketing cookies: Measure and target our advertising (the Meta and TikTok pixels, the Google Ads tag, and Microsoft's advertising cookie). Off by default and set only with your consent; see our Cookie Policy.

You can control cookies through your browser settings, but disabling certain cookies may affect Service functionality.

9.1 Bot Protection (Google reCAPTCHA Enterprise)

Our website and mobile applications use Google reCAPTCHA Enterprise to protect against automated abuse, credential stuffing, and other malicious activity. reCAPTCHA collects hardware and software information about your device (such as device and application data) and sends it to Google for analysis. This information is used to provide, maintain, and improve reCAPTCHA, and for general security purposes — it is not used to target advertising.

Our Service is protected by Google reCAPTCHA Enterprise. Google's Privacy Policy and Terms of Service apply to its use.

10. International Data Transfers

Your information may be transferred to and processed in countries outside the United Kingdom, including the United States and European Economic Area. Our service providers (Google Cloud Platform, Stripe, Vercel, — when you use a digital wallet to pay — Apple Inc. for Apple Pay or Google LLC for Google Pay, and — if you consent to analytics or marketing cookies — Microsoft, Meta, TikTok and Google for Google Ads) process data internationally under appropriate safeguards, including Standard Contractual Clauses and applicable data transfer frameworks. We ensure these transfers comply with UK GDPR requirements for the protection of your personal data.

11. Children's Privacy

Our Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected such information, we will take steps to delete it.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the updated policy on our website
• Sending you an email notification
• Providing notice through our Service

13. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact the data controller:

RHINOCERT LTD
Company No. 17150289 (registered in England and Wales)
VAT No. GB517421019
UK Registered Trade Mark No. UK00004374368
Registered office: S08 The Genesis Centre, Innovation Way, Stoke-on-Trent, ST6 4BF
Email: support@rhinocert.com
Website: https://rhinocert.com