Privacy Policy

This Privacy Policy explains how Nightingale Software Group ("Nightingale", "we", "us") collects, uses and shares personal data when you use our websites and products (the "Services").

Who we are: Nightingale Software Group, a software business operating in the United Kingdom. Contact: team@nightingalesoftware.co.uk · 01473 487485 · United Kingdom. We are registered with the Information Commissioner's Office as a data controller for our own websites and account data.

1. Data we collect

• Account data: name, work email, company and role. Passwords are never held by the individual apps — see section 1a.
• Usage data: pages visited, features used, device and browser metadata.
• Customer content: data you submit to our products in the course of using them. Depending on the product this can include records about your staff and employees (shifts, onboarding, training, attendance), drivers (walk-around checks, defect reports, GPS-verified wait sessions, licence and CPC dates), contractors and visitors, and operational records such as assets, stock, waste transfers and claims.
• Communications: messages you send us through forms or email.

1a. Identity, passwords and multi-tenancy

Nightingale is a multi-tenant SaaS platform. Each customer has an isolated workspace (tenant), and data is separated at the database level using row-level security so one customer's records are never visible to another.

The Nightingale Admin Centre is the identity provider for the whole ecosystem. Authentication, password storage, password resets, sessions, multi-factor settings and user/role provisioning are handled centrally there. The individual apps (for example Rekuver, Ekspedite, Rampify) do not store passwords — they verify a token issued by the Admin Centre and hold only the profile and permission data needed to run the app. Passwords are stored only as salted hashes by our identity infrastructure and are never visible to us in plain text.

Where your workspace records personal data about your own staff, drivers or customers, you are the data controller and Nightingale acts as your processor under our Data Processing Agreement. Requests from those individuals should be raised with your own administrator in the first instance; we will support you in responding.

2. How we use data

We use personal data to:

• Provide, secure and improve the Services.
• Authenticate users and prevent abuse.
• Respond to enquiries and provide support.
• Send essential service notifications and, where you've opted in, product updates.

3. Legal bases

Under UK GDPR we rely on contract, legitimate interests, consent (where required) and legal obligations as appropriate bases for processing your personal data.

4. Sharing

We share data with trusted service providers (such as cloud hosting, email and analytics) that act on our instructions under contract. We do not sell your personal data.

5. International transfers

Some providers may process data outside the UK. Where they do, we use appropriate safeguards such as the UK International Data Transfer Agreement or Standard Contractual Clauses.

6. Retention

We retain personal data for as long as your account is active and for a reasonable period afterwards to comply with our legal obligations and enforce our agreements. Workspace content — including records relating to users, drivers and employees — is retained for the life of your subscription and deleted or returned on request after termination, subject to any legal retention period that applies to compliance records.

7. Your rights

Depending on your location, you have rights to access, correct, export or delete your personal data, and to object to or restrict certain processing. Contact us to exercise these rights.

8. Security

We apply industry-standard technical and organisational measures to protect personal data, including encryption in transit, role-based access controls and audit logging.

9. Cookies

We use a small number of strictly necessary cookies and similar storage to keep you signed in, to process checkout, and to remember your cookie choice. These do not require consent under UK PECR.

With your consent we also use analytics cookies from Google Analytics 4 to understand which pages visitors use so we can improve the site. Analytics tags are loaded in Google Consent Mode v2 with all storage denied by default — they only set cookies and send identifiable data after you click "Accept" on our cookie banner. IP addresses are anonymised and not stored by GA4. We do not use advertising, retargeting or cross-site tracking cookies.

You can change or withdraw your consent at any time using the Cookie preferences link in the footer of every page.

10. Contact

For any privacy questions or requests, email team@nightingalesoftware.co.uk.