Nightingale Software Group — Privacy Notice
Effective date: 10 November 2026 · Version: 2026-11-10/v1.3
1. Who we are
"Nightingale", "we", "us" and "our" means Nightingale Software Group, and — from the date it is incorporated — Nightingale Software Group Limited, which will take over this notice and all of our responsibilities under it automatically.
- Email (including all privacy requests): team@nightingalesoftware.co.uk — please put "Privacy" in the subject line
- Phone: 01473 487485
Contact us at team@nightingalesoftware.co.uk.
We are a small business. We have not appointed a statutory Data Protection Officer because we are not required to, but privacy questions are handled directly by the business owner.
2. Two different roles — controller and processor
Where we are the controller (we decide why and how the data is used), this notice tells you everything you need to know. That covers:
- visitors to our website and Admin Centre;
- people who sign up for, buy, or manage a Nightingale subscription (account holders, admins, billing contacts);
- people who contact us, book a demo, or join our partner programme;
- business contacts we approach about our own products (see section 8).
Where we are the processor (our customer decides why and how), the customer — usually your employer or a business you deal with — is the controller. That covers the content customers put into our apps: for example staff time records in PunchLine, right-to-work checks in Onboardly, driver locations in Rekuver, temperature logs in Ekspedite, or prospect lists in GaleCast. For that data we act only on our customer's written instructions under our Data Processing Agreement (nightingalesoftware.co.uk/legal/dpa). If you have a question about how a business uses your data inside one of our apps, contact that business first; we will help them answer you.
App-by-app details of what processing happens inside each app are in our App-Specific Processing Schedules, part of our Data Processing Agreement (nightingalesoftware.co.uk/legal/dpa).
3. What we collect, why, and our lawful basis
| What | Examples | Why we use it | Lawful basis (UK GDPR Art 6) |
|---|---|---|---|
| Account & identity data | Name, work email, job title, company name, password hash, sign-in records | To create and secure your account and give you access to the apps you subscribe to | Contract (6(1)(b)) — and, where the account holder is a business rather than you personally, our legitimate interest in running the service the business bought (6(1)(f)) |
| Billing data | Billing contact, company address, VAT number, subscription and invoice history. Card details are collected and held by Stripe, never by us. | To take payment, issue invoices and keep accounts | Contract (6(1)(b)); legal obligation for tax records (6(1)(c)) |
| Business-use declaration and terms acceptance | The tick-box record, time, IP address, version of terms accepted | To prove the contract was formed with a business and on which terms | Legitimate interests (6(1)(f)); legal claims |
| Service usage & security logs | IP address, device/browser type, pages and features used, error logs, audit trail of changes | To keep the service secure, fix faults, prevent abuse and show customers an audit trail | Legitimate interests (6(1)(f)) |
| Support & communications | Emails, chat messages, call notes | To answer you and improve support | Contract or legitimate interests |
| Service emails | Trial reminders, renewal notices, security alerts, invoices | To operate your subscription | Contract (6(1)(b)) — you cannot opt out of essential service emails while you have an account |
| Marketing to business contacts | Name, work email, company, role | To tell you about Nightingale products | Legitimate interests (6(1)(f)), subject to PECR — see section 8. You can object at any time |
| Website analytics (only if you accept analytics cookies) | Pages viewed, approximate location, device type, how you arrived | To understand how the website is used and improve it | Consent (6(1)(a)) under PECR reg 6 — see the Cookie Notice (nightingalesoftware.co.uk/legal/cookies) |
| Partner referral data | Which partner referred you | To pay our partners the right commission | Legitimate interests (6(1)(f)) and, for the browser cookie, consent — see the Cookie Notice |
We do not knowingly collect special category data (health, ethnicity, religion etc.) as a controller. Some customers may put special category or criminal-offence data into our apps (for example a right-to-work record); in that case the customer is the controller and must have its own Article 9/10 condition.
Our services are for businesses only. We do not knowingly provide services to consumers or to children.
4. Where we get data from
Mostly from you directly. We also receive data from: your employer or colleague (if they invite you to an account); Stripe (payment status); our partners (if they refer you); public sources such as Companies House and your company website (to confirm a business exists and for B2B prospecting); and, for our own outreach, commercial business-data providers (see section 8).
5. Who we share data with
We do not sell personal data. We share it only with:
- Service providers (sub-processors) who host and run our services for us, under written contracts with confidentiality and security obligations. By category these are: cloud database and authentication hosting; application hosting, content delivery and network security; payment processing (Stripe); transactional email delivery; telephony and SMS (for apps with calling, phone clocking or text features); AI language-model and voice-processing providers (for AI features); business-data and research providers (GaleCast); encrypted backup storage; and website analytics (only with your consent). An up-to-date list of the providers in each category is available to customers on request (and, for certain specialist providers, under a non-disclosure agreement) by emailing team@nightingalesoftware.co.uk. If you are making a subject access request we will always tell you the recipients of your data as the law requires.
- Professional advisers (accountants, lawyers, insurers) where needed.
- Authorities where the law requires it, or to protect our rights.
- A buyer or successor business, including Nightingale Software Group Limited on incorporation.
6. International transfers
Our main hosting is in the UK/EU. Some providers (for example payment, email and AI providers) may process data in the United States or elsewhere. Where data leaves the UK we rely on UK adequacy regulations (including the UK–US "data bridge" where the provider is certified) or the ICO's International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment.
7. How long we keep data
| Data | How long |
|---|---|
| Account data | For as long as the account is open, then deleted or anonymised within 90 days of closure |
| App content (customer data we process as processor) | Returned/exportable during the subscription; deleted within 30 days after the subscription ends unless the customer asks otherwise or the law requires longer |
| Security and audit logs | 24 months |
| Billing, invoice and tax records | 6 years from the end of the financial year (31 March) they relate to. This meets HMRC's record-keeping rules and the limitation period for contract claims. |
| Terms-acceptance and business-use declaration records | For the life of the contract plus 6 years (limitation period) |
| Support correspondence | 24 months after the issue is closed |
| Marketing and prospect contact data | Never contacted: deleted 90 days after we collect it. Contacted: 12 months after our last contact, or sooner if you object or unsubscribe. Suppression entries (so we never contact you again) are kept for as long as needed to honour the objection |
| Call recordings and transcripts (where calls are recorded) | Recordings 90 days; transcripts 12 months |
| Analytics data (with consent) | 14 months maximum |
Deletion at the end of each period is automated.
8. Business-to-business marketing and prospecting by Nightingale
We contact businesses we believe may benefit from our products. When we do:
- We use business contact details (name, role, work email or work phone, company). Sources include public registers such as Companies House, company websites and commercial business-data providers.
- Our lawful basis is legitimate interests. We have carried out a legitimate interests assessment.
- Email: we send unsolicited marketing emails only to corporate addresses (limited companies, LLPs, public bodies). We do not send unsolicited marketing emails to sole traders or partnerships without consent.
- Phone: cold calls are made by a person, never by an automated or AI voice. We only use AI-voiced calls with people who have consented to them or asked us to call back. We keep our own do-not-contact list and check it before every call.
- Every message tells you how to opt out. If you object, we stop, and we keep a minimal suppression record so we do not contact you again.
8A. GaleCast and Rekuver
GaleCast. When one of our customers uses GaleCast to find or contact you, that customer is the controller and we are its processor (see section 2 and our App-Specific Processing Schedules, section B9). When we use GaleCast to contact you about our own products, we are the controller and section 8 applies; our prospect notice is at nightingalesoftware.co.uk/legal/galecast-prospects. The same rules apply to our own calls and, under our terms, to our customers' calls:
- AI-voiced calls are made only to people who have consented to them or asked for a callback. Cold calls are made by a person.
- You are told at the start of a call if it is recorded or transcribed.
- GaleCast checks its own do-not-contact and suppression lists before every call.
- GaleCast deletes prospect data automatically: never contacted, 90 days after collection; contacted, 12 months after the last contact; call recordings after 90 days; transcripts after 12 months. A minimal suppression record is kept so objections are honoured.
Rekuver. Hauliers use Rekuver to record and evidence HGV waiting time at UK distribution centres. The haulier (usually the driver's employer) is the controller. Rekuver collects a driver's location only while they are on an active shift or verifying waiting time, and only after they allow location access on their device. Rekuver also uses phone numbers to send SMS verification codes that confirm waiting time.
9. Your rights
You have the right to: be informed; access your data (a "subject access request"); have it corrected; have it erased; restrict how we use it; data portability; object to processing based on legitimate interests (and an absolute right to object to direct marketing); and not to be subject to solely automated decisions with legal or similarly significant effects (we do not make such decisions). Where we rely on consent you can withdraw it at any time — for cookies, use the "Cookie preferences" link in the footer.
To exercise a right, email team@nightingalesoftware.co.uk. We will respond within one month (extendable by two months for complex requests). We may need to confirm your identity.
10. Security
We use encryption in transit, access controls, tenant isolation (each customer's data is segregated at the database level), reputable hosting and nightly encrypted backups, and we are adding further logging and monitoring measures. No system is perfectly secure; if a breach is likely to put your rights at risk we will tell you and the ICO as the law requires.
11. Complaints
Please contact us first so we can try to put things right. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.
12. Changes
We will post updates on this page and change the "Effective" date. If a change materially affects how we use your data as controller, we will tell account holders by email.