TruRisk Privacy Notice

Last updated: 3 November 2026

1. About this notice

This information has been produced to help you understand everything you need to know about the way TruRisk collects, uses, and shares personal data, what your legal rights are and how to exercise them.

We hope you’ll take some time to read this document; we’ve tried to keep it all as simple as possible and to avoid jargon, and we’ll make our best efforts to keep you informed if there are any changes to the way we process your personal data in the future.

TruRisk takes its responsibility for protecting your data very seriously and we do advise you get to know our practices. If there’s anything here you don’t understand, or if you want to ask any questions, please feel free to contact us.

2. Who is the Controller?

TruRisk Limited is the Controller. In this document TruRisk Limited may be referred to as “we”, “us”, “our”, or “TruRisk”.

Registered address: TruRisk Ltd., Leahy O’Riordan, 1-2 Marino Mart, Dublin 3, D03T3P1, Ireland
Registration number: 680484

3. What kinds of Personal Data does TruRisk Process?

TruRisk collects personal data for various purposes; with that in mind we have created a list of the types of personal data that we may collect, either directly from yourself or from other sources, in order to achieve those purposes.

The kinds of personal data we may collect (and which we will delete on request, see below) include:

• Name
• Email Address
• Telephone number
• Log in ID
• Location (GPS coordinates)
• In-app message content

3.1 Data held on the risk engineering platform

When our business customers use the TruRisk risk engineering platform, it may also hold:

• names, job titles and business contact details of client and site contacts;
• survey records, site photographs and documents uploaded by risk engineers or clients, which may show or name individuals;
• messages exchanged between risk engineers, brokers and clients about risk improvement recommendations.

4. What are the reasons TruRisk collects Personal Data?

We only process personal data where the law gives us a lawful basis to do so. The bases we rely on are set out below.

4.1 Performance of a contract

TruRisk uses personal data firstly to fulfil any contractual obligations that exist between us and yourself. Where we request personal data be provided to enter into, or meet the terms of any such contract, you will be required to provide the relevant personal data or we will not be able to deliver the goods or services you want. In such cases the lawful basis of us processing the personal data is that it is necessary for the performance of a contract.

4.2 Legal obligations

We are required by law to process personal data for purposes relating to our legal obligations, these include:

• To provide for our financial and regulatory commitments.
• To carry out required business operations and due diligence.
• To cooperate with relevant authorities.
• To investigate any data or other claims whereby the organisation may have to defend itself.

4.3 Legitimate interests

TruRisk may process Personal Data for any of the following purposes, which are considered to be within our legitimate business interests:

• To provide goods and services where it has been requested.
• To send notifications of any changes to the goods and/or services provided that may affect people.
• To allow the organisation to support and maintain our products in active service.
• To enhance the security measures in place that protect data we are responsible for.

4.4 Consent

We ask for your consent before collecting your device’s location (GPS coordinates) in the app. You can withdraw consent at any time in your device settings or by contacting us. Withdrawing consent does not affect processing carried out before you withdrew it.

4.5 Automated decision making

TruRisk uses automated decision making to derive a company’s Risk Score. This is carried out using data provided by users of the TruRisk mobile applications and website. If you would like any information about the data we use to ascertain the score please contact us. The Risk Score assesses businesses and their sites, not individuals, and is not used on its own to make decisions that have legal or similarly significant effects on you.

5. Where does TruRisk obtain Personal Data from?

We will collect personal data directly from you in various ways. This could include downloading, or using the app, or if you provide the data directly to a representative of TruRisk.

We may also gather personal data by any of the following methods:

• From technical functionality that gathers data automatically from computer equipment when people visit our online platforms, or download or use the app.

6. Who will TruRisk share your Personal Data with?

To achieve the above stated purposes for which we process your personal data, we may have to share your personal data with certain third parties. We shall make all reasonable efforts to ensure that any third-party we share your personal data with is also compliant with data protection law.

The kinds of third parties we may share your personal data with include organisations where it is necessary to provide services. The specific types of third-parties TruRisk may share your personal data with include:

7. Where will TruRisk store your Personal Data?

As a part of our standard business practices, we only transfer your personal data to organisations based in the UK or the EU.

The TruRisk platform is hosted on Amazon Web Services (AWS) in its EU (Ireland) region. Data is encrypted in transit and at rest. Customer logins are managed by Amazon Cognito, and passwords are never stored by TruRisk in readable form.

The UK and the EU each recognise the other’s data protection standards as adequate, so transfers between them need no further safeguards. If we ever need to transfer personal data outside the UK or EU, we will only do so with appropriate safeguards in place, such as the European Commission’s standard contractual clauses.

8. How long will TruRisk keep your Personal Data?

We keep your account data (name, email address, telephone number and log in ID) for as long as your account is active. Accounts that have been inactive for 2 years are deleted automatically.

You can ask us to delete your account at any time through support, as set out in section 9.3. Once data is deleted from our live systems, it expires from our backups automatically within 35 days.

9. Your Rights, Our Responsibility

There are several rights granted to you immediately upon providing us with your personal information; some of these are mentioned above. We’d like you to know that at TruRisk we take your rights seriously and will always conduct ourselves in a way that is considerate of our responsibility to serve your legal rights.

We will respond to any request within one month. If a request is complex, we may extend this by up to two further months and will tell you why. Requests are free of charge, and we may ask you to confirm your identity before acting on one.

9.1 The Right of Access

This grants you the right to confirm whether or not your personal data is being processed, and to be provided with relevant details of what those processing operations are and what personal data of yours is being processed.

If you would like access to the personal data we have about you, we ask that you contact us using the details below.

9.2 The Right to Rectification

This one is fairly straightforward; if you notice that the data we have about you is inaccurate or incomplete, you may request we rectify the mistake. We will make every effort to respond to requests of this type immediately.

9.3 The Right to Erasure

Otherwise known as the ‘right to be forgotten’, this gives you the right to request your personal data be deleted.

How to request your data be deleted: In the app, raise a support ticket by navigating to Profile > ‘…’ > Need Help? > Contact Us. In your message, please mention you wish your account to be deleted. Alternatively, you can also email support@trurisk.io to request your data be deleted.

This is not an absolute right; if you were to request that we erase your personal data, we would erase as much of that data as we could but may have to retain some information if it is necessary. Where we have received a request for personal data to be erased, if it is necessary for us to retain some of that information we shall ensure that the remaining data is used only when and where it is absolutely necessary.

9.4 The Right to Restrict Processing

You can ask us to limit how we use your personal data, for example while we check whether it is accurate or while we consider an objection. We will then store the data but not otherwise use it without your agreement.

9.5 The Right to Data Portability

Where we process data you provided to us under a contract or with your consent, you can ask for it in a structured, commonly used, machine-readable format, or ask us to send it to another organisation where technically feasible.

9.6 The Right to Withdraw Consent

Where we rely on your consent, you can withdraw it at any time. This does not affect processing carried out before you withdrew it.

9.7 Rights Related to Automated Decision Making

You can ask for a person to review any result produced by automated decision making that concerns you, give your point of view, and challenge the result.

9.8 The Right to Objection

The right to object is a basic freedom all democracies enjoy. If you wish to object to the way we use, or have used, your personal data you may do so freely.

9.9 The Right to Complain

We will always try to maintain the highest standards and encourage the confidence our customers have in us as an organisation. To achieve this, we request that any complaints be first brought to our attention so we can properly investigate matters. If you would like to complain about TruRisk to a regulatory body, you may do so by contacting your local data protection supervisory authority. Our lead supervisory authority is the Data Protection Commission in Ireland. If you are in the UK, you can also complain to the Information Commissioner’s Office.

10. California privacy rights (CCPA)

This section applies to residents of California. It explains how we handle “personal information” as defined in the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA”). Personal information means information that identifies, relates to, describes, or could reasonably be linked, directly or indirectly, with a particular California consumer or household.

TruRisk extends the rights below to California residents whether or not the CCPA legally requires us to. Where we process personal information on behalf of a client (for example, an insurer or broker using our platform), we act as that client’s service provider. We will pass any request we receive to the client and help them respond.

10.1 Personal information we collect

In the past 12 months we have collected the following categories of personal information, directly from you or from the organisation that gave you access to TruRisk.

Backups of our systems are kept for 35 days and then expire automatically.

10.2 Sensitive personal information

The GPS location we collect counts as “precise geolocation”, a type of sensitive personal information under the CCPA. We use it only to provide the service you request, and never to infer characteristics about you. Because of this, the CCPA right to limit its use does not apply, but you can switch off location access for the TruRisk app in your device settings at any time (see section 4.4).

10.3 We do not sell or share personal information

TruRisk does not sell personal information, and does not share it for cross-context behavioural advertising, as those terms are defined in the CCPA. We have not done so in the past 12 months. We do not knowingly collect personal information from anyone under 16.

10.4 Your California rights

If you are a California resident, you have the right to:

• Know what personal information we have collected about you, where it came from, why we use it and who we have disclosed it to, and to receive a copy of it.
• Delete personal information we have collected from you, subject to legal exceptions.
• Correct inaccurate personal information we hold about you.
• Opt out of the sale or sharing of your personal information. We do not sell or share it, so there is nothing to opt out of.
• Non-discrimination. We will not deny you service, charge you a different price or give you a different level of service because you exercise any of these rights.

10.5 How to make a request

Email privacy@trurisk.io with the subject line “California privacy request” and tell us which right you want to exercise.

To protect your information, we verify your identity before acting on a request. We will normally ask you to send the request from the email address linked to your TruRisk account, and we may ask you to confirm details about your account. We will only use the information you provide to verify your request.

You can authorise another person to make a request for you. We will ask for your signed permission and may need to verify your identity directly with you.

We will confirm receipt of your request within 10 business days and respond within 45 calendar days. If we need more time, we will tell you why and may take up to a further 45 days.

10.6 Accessibility and more information

If you need this notice in an alternative format, email privacy@trurisk.io. You can read more about the CCPA on the California Attorney General’s website.

This section was last updated on 3 November 2026.

11. Contact details

TruRisk has appointed a UK representative who will liaise between yourself and our head office, and an external organisation to oversee and audit our data protection responsibilities as Data Protection Officer.