Cardinus Risk Management Privacy Policy

Who we are
Cardinus Risk Management Limited (“Cardinus”, “we”, “our” or “us”) is committed to protecting and respecting your privacy. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable privacy legislation in the countries in which we operate.

This Privacy Notice explains how we collect, use, store, share and protect personal information when providing our products and services, operating our websites and conducting our business activities.

Where Cardinus processes personal data on behalf of a client, we generally act as a data processor and process personal data only on the documented instructions of that client. Where Cardinus determines the purposes and means of processing personal data, we act as a data controller.

Cardinus is committed to protecting all personal data it holds irrespective of its form or where it is located.
Cardinus adheres to all data protection laws in the countries in which it operates and regularly reviews its controls and procedures to ensure continued compliance.

Cardinus offers various risk management software, services and products to organisations and individuals designed to help them identify and control their own organisational risks.

In offering these products and services, Cardinus will often need to process personal data on behalf of the instructing party (the client) with the specific aim of assisting them in understanding and reducing the risks they face.  When Cardinus collects, records or uses any personal data, all appropriate safeguards will be applied to ensure the relevant legislation is adhered to at all times.

Mandatory fields of personal data stored on our systems include a unique identifier, first name, last name, organisational hierarchy, and work email address.  Optional information depending on configuration may also include test scores, answers to risk assessments and responses to questions (including pain and / or discomfort levels).  Other client services we offer require information of virtual assessment sessions and driving licence data to be stored.

How we use your information
Cardinus processes personal data only for legitimate business purposes and in accordance with applicable law. Depending on the service being provided, personal data may be used to:

• Deliver risk management software, products and services.
• Conduct assessments, evaluations, training and consultancy activities.
• Administer user accounts and provide technical support.
• Monitor and improve the quality and effectiveness of our services.
• Comply with legal, regulatory and contractual obligations.
• Communicate with clients and authorised users regarding our services.
• Protect the security, integrity and availability of our systems and information.

Personal data will not be used for purposes incompatible with those for which it was originally collected unless required or permitted by law.

Who we share your information with
Cardinus may share personal data with carefully selected third parties where necessary to provide services, fulfil contractual obligations or comply with legal requirements.

Recipients may include:

• Data hosting, cloud and technology service providers.
• Independent consultants and assessors engaged by Cardinus, including ergonomists, driver trainers, surveyors and personal safety advisers.
• Professional advisers, auditors and insurers.
• Regulatory bodies, courts, law enforcement agencies or government authorities where required by law.
• Organisations that engage Cardinus to deliver services on their behalf.

All third parties processing personal data on behalf of Cardinus are required to implement appropriate technical and organisational security measures and process personal data only in accordance with contractual obligations and applicable data protection legislation.

Direct Marketing
We act responsibly with personal data and do not share details of our customers or related individuals to other companies. We may contact our customers by mail, e-mail or telephone with details of products and services offered by Cardinus if consent has been granted.  Consent can be withdrawn at any time by emailing [email protected] or contacting via the website https://www.cardinus.com.

Lawful bases for processing
Cardinus processes personal data using one or more of the lawful bases set out under UK GDPR, depending on the specific activity being undertaken. These may include:

• Performance of a contract.
• Compliance with a legal obligation.
• Legitimate interests pursued by Cardinus or our clients.
• Consent, where required by law.
• Protection of vital interests.

Where special category personal data, including health-related information, is processed, Cardinus will only do so where an additional lawful condition under Article 9 UK GDPR applies.
Cardinus adheres to the key principles of data protection:

• Lawfulness, fairness and transparency.
• Purpose limitation.
• Data minimisation.
• Accuracy.
• Storage limitation.
• Integrity and confidentiality (security).
• Accountability.

International Transfers
Cardinus may transfer personal data to service providers, group companies or business partners located outside the United Kingdom.

Where personal data is transferred internationally, Cardinus will ensure that appropriate safeguards are implemented as required by applicable data protection legislation. These safeguards may include adequacy regulations, approved contractual clauses or other recognised transfer mechanisms.
Further information regarding international transfers can be obtained by contacting our Data Protection Officer.

Data Retention
Cardinus retains personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, regulatory, accounting and contractual requirements.

Retention periods vary depending upon the nature of the service provided, the contractual arrangements with our clients and applicable legal obligations. Once personal data is no longer required, it will be securely deleted, anonymised or otherwise disposed of in accordance with our retention policies.

Automated Decision-Making
Cardinus does not routinely make decisions about individuals based solely on automated processing that produce legal or similarly significant effects.

Where automated decision-making or profiling is used, individuals will be provided with appropriate information regarding the processing and their rights under applicable data protection legislation.

Your Rights
Individuals have various rights under privacy legislation.  A summary of these rights is set out below

• The right to be informed
• The right of access
• The right to rectification
• The right to erasure
• The right to restrict processing
• The right to data portability
• The right to object
• Rights in relation to automated decision making and profiling.

To exercise any of these rights, please contact our Data Protection Officer using the contact details provided below. We may request additional information to verify your identity before responding to a request.
Individuals also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) if they believe their personal information has been processed unlawfully.

EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF
In 2023, the European Commission issued an adequacy decision on the EU-U.S. Data Privacy Framework (DPF) and the UK Extension to the EU-U.S. DPF. This new voluntary Framework, which replaces the Privacy Shield program, provides a mechanism for companies to transfer personal data from the EU and UK to the United States in a privacy-protective way consistent with EU and UK law.

Cardinus complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, as set forth by the U.S. Department of Commerce. Cardinus has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

Under the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, Cardinus remains liable if its service provider or agent processes Personal Information received under the DPF in a manner inconsistent with its Principles, unless Cardinus was not responsible for the event giving rise to the damage.

If there is any conflict between the terms in this privacy policy and the DPF principles, the DPF principles shall govern. To learn more about the Data Privacy Framework program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

Cardinus is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC).

To meet the requirements, Cardinus will:

• observe the conditions regarding the fair collection and use of personal data
• meet our obligations to specify the purposes for which personal data is used
• collect and process appropriate personal data only to the extent that it is needed to fulfil operational needs or to comply with any legal requirements
• ensure the quality of personal data used
• apply strict checks to determine the length of time personal data is held
• ensure that the rights of individuals about whom the personal data is held, can be fully exercised
• take appropriate security measures to safeguard personal data
• ensure that personal data is not transferred abroad without suitable safeguards.

Cardinus will only disclose an individual’s non-public personal information to third parties where required to the extent necessary to meet a legal obligation, including a lawful request by public authorities and national security or law enforcement obligations and applicable law, rule, order, or regulation.
If personal data covered by this Privacy Policy is to be used for a new purpose that is materially different from that for which the personal data was originally collected or subsequently authorised, or is to be disclosed to a non-agent third party in a manner not specified in this Policy, Cardinus will provide you with an opportunity to choose whether to have your personal data so used or disclosed.  Requests to opt out of such uses or disclosures of Personal Data should be sent to us as specified below.
Certain personal data, such as information about medical or health conditions, racial or ethnic origin, political opinions, religious or philosophical beliefs, is considered “Sensitive Information”.  Cardinus will not use Sensitive Personal for a purpose other than the purpose for which it was originally collected or subsequently authorised by the individual unless Cardinus has received your affirmative and explicitly consent (opt-in).

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, Cardinus commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU and UK individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF should first contact our Data Protection Officer (contact details below).

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, Cardinus commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) with regard to unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF.

You may also have the possibility, under certain conditions, to invoke binding arbitration for complaints regarding DPF compliance not resolved by any of the other DPF mechanisms.  Additional information can be found here: https://www.dataprivacyframework.gov/framework-article/G%E2%80%93Arbitration-Procedures

Changes to This Privacy Notice
Cardinus may update this Privacy Notice from time to time to reflect changes in legal, regulatory or operational requirements.

The most current version will always be published on our website and the “Last Reviewed” date will indicate when the notice was most recently updated.

Questions and complaints
If you have any questions or complaints about our processing of your personal data, you can contact us in writing at the address or email below.

Further information can be found at
https://www.ico.org.uk
https://ico.org.uk/ESDWebPages/Entry/Z658762X
https://www.dataprivacyframework.gov/Program-Overview

Last Reviewed: 30 October 2026