Global Safety Bureau Ltd (“Global Safety Bureau”, “Hugo”, “Hugo Audit”, “we”, “our” or “us”) is committed to protecting your privacy and handling your personal information responsibly.

This Privacy Policy explains how we collect, use, store and protect your information when you use:

• the Hugo website;
• the Hugo web application;
• the Hugo mobile application;
• our customer support services; and
• any related products or services (collectively, the “Services”).

By using our Services, you agree to the collection and use of information in accordance with this Privacy Policy.

 
1. Who We Are

Data Controller

Global Safety Bureau Ltd

The Point
Granite Way
Mountsorrel
Loughborough
LE12 7TZ
United Kingdom

Email: privacy@hugoaudit.com

2. Information We Collect

Depending on how you use Hugo, we may collect:

Account Information

• Name
• Business email address
• Telephone number
• Company name
• Job title
• Username
• Encrypted password

Organisation Information

• Company details
• Sites and locations
• Audit templates
• User roles and permissions
• Organisational settings

Audit Information

During use of Hugo, users may record:

• Audit responses
• Notes
• Corrective actions
• Action plans
• Photographs
• Supporting documents
• Signatures
• Time and date of inspections
• Audit outcomes
• Training completion records
• Compliance records

This information belongs to the customer organisation using Hugo.

Device Information

When using our mobile application we may collect:

• Device model
• Operating system
• App version
• IP address
• Crash reports
• Diagnostic information

Usage Information

We may collect information regarding:

• Login activity
• Features used
• Session duration
• Pages visited
• Performance metrics
• Error logs

This information helps us improve the reliability, security and performance of Hugo.

 
3. Permissions Used by the Mobile Application

Depending upon how your organisation configures Hugo, the mobile application may request permission to access:

Camera

To capture photographs as audit evidence.

Photo Library

To upload existing images where permitted.

Notifications

To send reminders regarding:

• Upcoming audits
• Assigned actions
• Overdue corrective actions
• Training notifications
• Important service updates

Location (Optional)

Where enabled by your organisation, location information may be used to:

• Verify attendance at audit locations
• Improve audit accuracy
• Support scheduling
• Assist operational reporting

Location services are optional unless required by your organisation.

4. Offline Working

Hugo supports offline auditing.

When offline, audit information may be temporarily stored securely on your device until an internet connection becomes available and data can be synchronised with our secure cloud infrastructure.

Users are encouraged to protect their devices using passwords, biometric authentication and device encryption where available.

5. How We Use Your Information

We use information to:

• provide and maintain our Services;
• authenticate users and manage accounts;
• facilitate audits, inspections and assessments;
• generate reports, dashboards and analytics;
• manage corrective actions and Remedial Learning Pathways;
• provide customer support;
• improve platform performance, reliability and security;
• detect, prevent and investigate fraud, misuse or security incidents;
• communicate important service updates;
• comply with legal and regulatory obligations;
• develop new features and functionality; and
• create aggregated and anonymised statistical information to improve our Services, identify industry trends and produce benchmarking insights.

We do not sell personal information or identifiable customer data.

6. Legal Basis for Processing

Where UK GDPR or EU GDPR applies, we process personal information under one or more of the following legal bases:

• Performance of a contract
• Legitimate interests
• Compliance with legal obligations
• Consent (where required)
  
  
  
  

   

   

   

7. Data Ownership

Customers retain ownership of all audit content, documents, photographs, reports, templates, action plans, training records and other information uploaded to or generated within Hugo (“Customer Data”).

Where Global Safety Bureau Ltd processes Customer Data on behalf of a customer organisation, we do so as a data processor where required under applicable data protection legislation. The customer organisation remains the data controller for its Customer Data.

Global Safety Bureau Ltd does not acquire ownership of Customer Data through use of the Services.

We will never sell, rent or otherwise disclose identifiable Customer Data to third parties for marketing or commercial purposes.

However, we may use Customer Data to create aggregated and anonymised datasets for purposes including:

• Identifying industry trends
• Producing benchmarking reports
• Generating statistical insights
• Improving platform functionality
• Enhancing reporting and analytics
• Conducting research and product development
• Improving automated and artificial intelligence features

Any information used for these purposes will be aggregated and anonymised so that no individual, customer organisation, site or commercially sensitive information can reasonably be identified.

 
8. Artificial Intelligence and Analytics

Hugo may incorporate artificial intelligence (“AI”) and machine learning technologies to improve the functionality of the Services.

These technologies may be used for activities including:

• Interpreting uploaded audit templates
• Assisting with report generation
• Identifying compliance trends
• Highlighting potential risks
• Recommending corrective actions
• Improving audit quality and consistency
• Generating benchmarking and operational insights

Unless a customer has expressly agreed otherwise in writing:

• Identifiable Customer Data will not be used to train publicly available or shared AI models.
• Confidential customer information will not be disclosed through AI-generated outputs.
• AI-generated recommendations are intended to assist users and should not replace professional judgement.
• Any data used to improve Hugo’s AI capabilities will be aggregated and anonymised wherever reasonably practicable.

We continually review our AI practices to ensure they remain aligned with applicable data protection legislation, recognised industry standards and our commitment to protecting customer information.

9. Sharing Information

We may share information with carefully selected service providers who assist in operating Hugo.

These services may include:

• Cloud hosting
• Secure data storage
• Authentication
• Email delivery
• Customer support
• Analytics
• Infrastructure monitoring

These providers are contractually required to protect personal information and may only process data on our instructions.

We may also disclose information:

• Where required by law
• To protect our legal rights
• During a merger, acquisition or business transfer
• With your consent
  
  
  
  

   

10. International Transfers

Where information is transferred outside the United Kingdom or European Economic Area, appropriate safeguards will be implemented, including Standard Contractual Clauses or other lawful transfer mechanisms where required.

11. Data Security

We implement appropriate technical and organisational measures designed to protect information against unauthorised access, alteration, disclosure or destruction.

These measures may include:

• Encryption in transit
• Encryption at rest
• Secure authentication
• Role-based access controls
• Audit logging
• Routine backups
• Infrastructure monitoring
• Vulnerability management

Although no system can ever be guaranteed completely secure, we continually review and strengthen our security practices.

12. Data Retention

We retain personal information only for as long as necessary to:

• Provide our Services
• Meet contractual obligations
• Comply with legal requirements
• Resolve disputes
• Enforce agreements

Retention periods may vary depending upon customer configuration and applicable law.

13. Your Rights

Subject to applicable law, individuals may have the right to:

• Access personal information
• Correct inaccurate information
• Request deletion
• Restrict processing
• Object to processing
• Request portability
• Withdraw consent where applicable

Employees using Hugo through their employer should normally direct these requests to their employer, who acts as the primary data controller for organisational audit data.

14. Cookies

Our website may use cookies and similar technologies to:

• Improve website functionality
• Remember preferences
• Analyse website traffic
• Enhance user experience

Users may control cookies through their browser settings.

15. Children’s Privacy

Hugo is intended solely for business use and is not directed towards children under the age of 16.

We do not knowingly collect personal information from children.

16. Third-Party Services

Our Services may contain links to third-party websites or integrate with third-party services.

We are not responsible for the privacy practices of those third parties, and users should review their respective privacy policies.

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

Where appropriate, material changes will be communicated through the Hugo platform, our website or by email.

The latest version will always be available on our website.

18. Benchmarking Commitment

Any benchmarking reports, industry insights or research published by Global Safety Bureau Ltd are derived solely from aggregated and anonymised information.

We will never identify, rank, compare or disclose an individual customer, organisation, site or user in any published benchmark, report or research without that customer’s prior written consent.

19. Contact Us

If you have any questions regarding this Privacy Policy or our privacy practices, please contact:

Privacy Officer

Global Safety Bureau Ltd

The Point
Granite Way
Mountsorrel
Loughborough
LE12 7TZ
United Kingdom

Email: privacy@hugoaudit.com

Last Updated: 20th July 2026