YOUR INFORMATION
Privacy & client documents
How information is used when you enquire, register for the portal or share a report.
Effective date: 13 October 2026. This notice covers the website, client portal and related business enquiries.
Who to contact
1st Aid Fire Limited (company number 07586711), 150 Darland Avenue, Gillingham, Kent ME7 3AS, is the controller responsible for the business information described here. Contact Darren J Young MIFSM at darren.young@1staidfire.com about your information or documents.
Information used by this website
Enquiries include the contact and premises details you provide. The public enquiry form sends your enquiry through our email provider when you submit it. If sending is unavailable, you can copy the details and email us directly. Portal registration and use involve your sign-in identity, account and contact details, property information, uploaded reports, advice conversations and service notification records.
Why we use it
Information is used to respond to enquiries, assess access applications, provide agreed services, organise client documents, prepare quotations and communicate about your account. Access is restricted to the relevant approved account and website administrators.
Our lawful bases
- Enquiries, quotations and services requested by an individual: taking steps at your request before a contract and performing that contract.
- Business contacts, account approval, security and necessary service records: our legitimate interests in responding to business requests, administering services, preventing unauthorised access and retaining proportionate evidence of our work. We consider the impact on individuals and their right to object.
- Accounting and required disclosures: compliance with applicable legal obligations.
- Optional marketing: separate consent where required. A service enquiry does not subscribe you to marketing. You may withdraw marketing consent at any time without affecting earlier lawful use.
Required form fields are needed to assess your request or administer access; without them we may be unable to provide the requested service. Information about other people may come from the client who supplies a report. Please make this notice available to those people where appropriate.
Reports and contractors
Only upload reports you are authorised to share. Remove unnecessary tenant identifiers and all identifiable health information before uploading. Do not upload medical records, named health or disability details, payment-card details or other highly sensitive records. Describe relevant premises risks without identifying individuals; contact us to agree a suitable alternative if sensitive information is essential. Contractor involvement and any sharing of your report will be agreed with you before it happens. Storing a third-party report does not mean we have assessed or endorsed it.
How long we keep information
The periods below are our normal business retention policy, not a claim that every category has a fixed legal deadline. We review records for deletion or anonymisation when their period ends.
| Record | Normal retention period |
|---|---|
| Enquiries and quotations that do not proceed | 12 months after the last substantive contact or quotation closure. |
| Rejected, withdrawn or expired portal applications | 90 days after closure or expiry, unless needed to investigate misuse or a dispute. |
| Third-party FRAs submitted only for a works quotation that does not proceed | 6 months after the quotation is declined or closed. We retain only the minimal enquiry record for the 12-month period above. |
| Account profile and logo | While the account is active, then 90 days after closure. Details necessary for retained service records are kept with those records. |
| Completed FRAs, service evidence, agreed works records and substantive advice | Normally 6 years after completion of the relevant instruction or closure of the advice matter. A longer period may apply where a particular contract, insurer requirement, investigation or potential claim requires it. |
| Invoices and accounting records | At least 6 years from the end of the company financial year concerned; longer where applicable tax or accounting requirements require it. |
| Routine service-email delivery records held in our portal | 12 months after the notification. Where content forms part of substantive advice, a works instruction or a complaint, the relevant service-record period applies. |
A superseded FRA may still be retained as evidence of advice provided at the time; this does not mean it remains a current assessment. Closing access does not automatically erase service records. An administrator can permanently delete a portal and its stored documents after checking what must be retained. Records held separately by the business follow the retention policy above. We restrict records retained for a complaint, investigation, insurance matter or legal claim and review the need for continued retention when the matter concludes.
Retention is administered by the business through periodic manual reviews, rather than an automatic deletion timer. The seven-day correction deadline closes the application’s resubmission window; it does not erase the record immediately. Copies in provider backups or logs are subject to the provider’s applicable deletion and backup arrangements; we do not promise immediate deletion from every backup.
Removing a document
The portal’s remove action hides a document from your client view. It does not erase the administrator’s retained copy. Contact us if you want to request deletion or ask how long a record will be retained; service, insurance and legal requirements may affect that decision.
Website suppliers and external services
The portal uses ChatGPT sign-in, hosted application and document storage services, and Resend for service emails. Stripe processes live one-off FRA review payments and optional monthly memberships. We record the agreed scope, terms version, acceptance time, early-start request and payment-confirmation records to administer and evidence your instruction. Card details are handled by Stripe; do not put them into enquiry or upload fields. We do not ask you to enter card details into a general enquiry form. Links to Amazon and other external websites take you to services with their own privacy information. The current site also loads fonts from Google Fonts.
International processing
Our hosting, authentication and email providers may process information outside the UK. This website does not promise UK-only storage. Applicable provider agreements govern processing and any required transfer safeguards, such as adequacy arrangements or approved contractual safeguards. Contact us for information about the arrangements relevant to your data. OpenAI Sites privacy information and Resend data-processing information explain their services.
AI service assistant
The optional AI chat sends your question and up to six recent conversation messages to OpenAI to generate a reply. It uses public service information and cannot access your client portfolio or documents. Do not enter confidential reports, tenant details, health information or passwords. Replies may be incorrect and are not a fire risk assessment, compliance approval or a substitute for Darren’s professional review.
We do not save chat transcripts in our website database. The current conversation is held in page memory. If you choose to send an enquiry to Darren, a temporary browser session copy is used to fill the contact form for you to review; nothing is emailed automatically. A submitted enquiry is handled under the enquiry retention policy above. OpenAI responses are requested with storage disabled; OpenAI may still retain abuse-monitoring records for up to 30 days under its standard API policy. See OpenAI’s privacy policy. Processing may occur outside the UK under applicable transfer safeguards. To limit misuse and cost, we store a daily salted hash of the connection address and request time for up to 24 hours, removed on subsequent chat requests.
Cookies and external connections
Sign-in and hosting may use essential cookies or similar session technologies. Optional Google Analytics runs only after you accept analytics cookies. It helps us measure public page visits, successful quote enquiries and telephone or email link clicks. We do not send form contents, client documents or portal activity to Google Analytics. Advertising features are disabled. We remove query strings and fragments from the page addresses supplied to Analytics. Your cookie choice is stored in your browser for up to 180 days; Analytics cookies are configured to expire after 180 days without renewal. Use Cookie settings in the footer to accept or withdraw consent at any time. Withdrawal stops Analytics and removes its cookies from this website in your browser; it does not delete previously collected data. Google processes Analytics data under its service terms and privacy policy, which may involve processing outside the UK with applicable transfer safeguards. Google Fonts receives connection information when fonts are loaded.
Chat and marketing
The AI service assistant provides general information about our services. It does not assess your premises or make account approval decisions. Portal approvals, substantive advice and works quotations are handled by a person. A works enquiry or portal application is not a newsletter subscription.
Your information requests
You can contact us to ask about access to your information, correction, deletion, restrictions or objections to processing. You may also have a right to data portability and to withdraw consent where processing relies on it. Which rights apply depends on the circumstances. We may need to verify your identity. We normally respond within one month, subject to any permitted extension, and explain any applicable restriction or reason for retaining information. You can also raise concerns with the Information Commissioner’s Office.
Last updated: 13 October 2026.
Website enquiry protection
Enquiries are sent through our email provider to darren.young@1staidfire.com. Your email is used as the reply address. We keep short-lived hashed identifiers and sending status to limit spam and duplicate submissions; these are cleared on a later submission after 24 hours. The website does not retain the enquiry message in this protection table. The enquiry email follows the retention periods above.
Popup preferences and service terms records
Book and discount popups use page memory by default. They do not set a persistent marketing dismissal flag automatically. If you actively choose “Remember my dismissal for 30 days”, a browser-storage preference records only that choice and the dismissal time for the relevant popup. This optional choice is separate from Analytics consent and is not sent to our servers or used for profiling. You can clear it using “Reset popup preferences” on the homepage. Without that choice the popups may appear again on a later page visit.
We retain accepted scope, terms snapshots and early-start requests with the relevant service records, normally for six years after the instruction ends. Checkout instructions that never lead to a paid service are reviewed with unaccepted quotations, normally after 12 months. Free portal acceptance follows the account or application retention period described above. These are manual business retention reviews, not an automated deletion promise.
Read the service terms, portal terms and cancellation information.