Privacy Policy

Nightingale Software Group ("Nightingale", "we", "us") provides business software applications and the Nightingale Admin Centre. This policy explains what personal data we collect, why we collect it, how we handle it, and the rights you have.

This policy covers our own processing. Where we process personal data on behalf of a business customer, that customer is the data controller and our Data Processing Agreement applies.

What personal data we collect

Account data. Name, work email address, organisation, job role, and the role assigned to you within the platform.

Authentication data. Sign-in timestamps, session identifiers, IP address and browser/device information used to secure your account. We never store your password in readable form.

Usage data. Pages and features used, actions taken within an application, and diagnostic events. This is linked to your account so that administrators of your organisation can audit activity.

Billing data. Organisation billing contact, subscription tier and invoice history. Card details are handled entirely by our payment provider and are never stored by Nightingale.

Support data. The content of support requests you send us, and any information you choose to include in them.

Application data. Business records you or your organisation enter into a Nightingale application. This may include personal data about your own staff, customers or candidates. We process this only on your organisation's instructions.

Why we collect it and our lawful basis

| Purpose | Lawful basis | | --- | --- | | Providing and operating the services you subscribe to | Performance of a contract | | Authenticating users and securing accounts | Legitimate interests; legal obligation | | Billing, invoicing and collecting payment | Performance of a contract | | Providing support and responding to enquiries | Performance of a contract; legitimate interests | | Improving reliability, performance and product quality | Legitimate interests | | Meeting legal, tax and regulatory obligations | Legal obligation | | Marketing communications to business contacts | Legitimate interests, with an opt-out in every message |

We do not sell personal data, and we do not use customer application data to train general-purpose AI models.

How data is processed

Personal data is processed to authenticate you, to deliver the applications your organisation subscribes to, to keep an audit trail of significant actions, to bill for the service, and to support you when you contact us.

Access within Nightingale is limited to staff who need it for one of these purposes. Administrative access to production systems is restricted, individually attributed and logged.

Some Nightingale features use AI services to summarise or analyse data you submit. Where this happens, the request is sent to the provider listed on our subprocessors page and is not used by that provider to train their models.

Where data is stored

Nightingale services are hosted on managed cloud infrastructure. Primary data storage for the platform database is in the European Union or the United Kingdom. Certain subprocessors listed on our subprocessors page may process limited data outside that region; where they do, transfers are covered by UK/EU Standard Contractual Clauses or an equivalent approved safeguard.

Security measures

Data is encrypted in transit using TLS and encrypted at rest by the underlying storage platform. Access is controlled by role-based permissions and enforced at the database layer so that one organisation cannot read another organisation's records. Significant actions are recorded in an append-only audit log. Full details are in our Security & Trust Centre.

Data retention

• Account and profile data — kept while the account is active, then deleted or anonymised within 90 days of account closure.
• Application data — kept for the life of the subscription. On termination, data is retained for 30 days to allow export, then deleted.
• Audit and security logs — retained for up to 24 months to support investigation and compliance.
• Billing records — retained for 7 years to meet statutory accounting obligations.
• Support correspondence — retained for 24 months.

Business customers can configure shorter retention for application data through the platform where a feature supports it.

Your rights

Depending on where you are located, you have the right to access your personal data, to have inaccurate data corrected, to have data erased, to restrict or object to processing, to data portability, and to withdraw consent where processing relies on consent.

If Nightingale is the processor rather than the controller — that is, the data belongs to a business customer's own records — please contact that organisation directly. We will support them in responding to you.

You also have the right to complain to a supervisory authority. In the UK this is the Information Commissioner's Office.

Contact

Data protection enquiries: privacy@nightingalesoftware.co.uk

Nightingale Software Group *[Registered address to be confirmed]*

Changes to this policy

We publish every version of this policy with a version number and an effective date. Previous versions remain available for reference. Where a change materially affects you, we will notify account administrators before it takes effect.