Privacy notice
How Trent GECO Limited uses personal information about the people who use Trivet, contact us or visit our website, and the rights you have.
Who we are
Trivet is provided by Trent GECO Limited, a company registered in England and Wales (company number 17556880). Registered office: 82a James Carter Road, Mildenhall, United Kingdom, IP28 7DE. In this notice, "we" and "us" mean Trent GECO Limited.
For the information in this notice we are the controller: we decide why and how it is used. Contact us about anything in it at hello@trivet.digital, or by post at our registered office.
We haven't appointed a data protection officer, as the law doesn't require one for a company like ours. Our directors are responsible for data protection.
Information your organisation puts in the app
Organisations use Trivet to record their buildings, vehicles, drivers, bookings, meetings and more. For that information, the organisation is the controller and we are its processor: we only use it to provide the service, on its instructions. If you have a question about it, such as a driving licence check, ask the organisation first. How we process your organisation’s data explains this in more detail.
What we collect, why, and our lawful basis
| Whose information | What we collect | Why | Lawful basis |
|---|---|---|---|
| People with an account (owners, admins and invited members) | Name, email address, photo if you sign in with Google, how and when you signed in, your notification settings, which organisations you belong to and your role in each, and a token for each browser you turn push notifications on in (with a scrambled form of the browser details) | To give you an account, sign you in securely, show you the right organisations, and send the emails and notifications the service needs. Our team can see your name, email address and role in each organisation, to support and bill it | Legitimate interests: running the service your organisation has chosen and keeping it secure |
| People with an account | Whether emails to your address bounce or are reported as spam | To stop sending email that isn’t arriving, and to tell your organisation’s admins | Legitimate interests: reliable delivery |
| Everyone who uses the app | Your IP address and browser details in our server request logs; a record of significant actions (the audit log), which holds your account ID, never your name | To keep the service and your organisation’s data secure, investigate problems and prevent misuse | Legitimate interests: security and fraud prevention |
| Owners and billing contacts of customer organisations | Name, email address, billing address, payment method, invoices and payments. Card and bank details are handled by Stripe and never reach us | To bill the organisation and keep accounts | Our contract with the organisation; legal obligation for accounting records |
| People who contact us | Name, email address, your organisation, your message and any attachments, and our replies and internal notes. Emails to hello@trivet.digital arrive in our mailbox at MXroute and the app copies their text and attachments into your request. From the app we also attach the screen you were on, the app version, the type of device and whether you were online, and show you this before you send | To answer you and keep a record of what we said | Legitimate interests: supporting our customers. For a data protection request: legal obligation |
| People at organisations that might use the service (sales leads) | Business contact details: name, role, organisation, work email address and phone number, and notes of our conversations. They come from you, from people who introduce us, or from public sources such as an organisation’s website or the Charity Commission register | To talk to organisations about whether the service suits them | Legitimate interests: telling organisations about a service for their work. We never send marketing emails without your consent, and you can ask us to stop contacting you at any time |
| Trustees of charities whose number an organisation enters in the app | Name, whether they are the chair and their appointment date, as shown on the Charity Commission register | To help that organisation keep its trustee register up to date | Legitimate interests: ours and the organisation’s, in accurate governance records |
| People invited to set up an organisation during the pilot | A keyed, one-way scrambled form of your email address, not the address itself | To check the invitation when you set up the organisation | Legitimate interests: running an invitation-only pilot |
| Visitors to the app and website | Small items stored in your browser, and the signals Google’s reCAPTCHA reads from your browser and device | To make the app work, including offline, and to keep automated attacks out | Legitimate interests: making the app work and keeping it secure. The storage is strictly necessary, so it needs no consent under the electronic communications rules |
More on what is stored in your browser, and why we don’t need a cookie banner: Device storage.
Where we rely on legitimate interests, we have weighed them against your interests and expect the use to be what you would reasonably expect. You can object at any time (see "Your rights").
You don’t have to give us any information, but without an email address we can’t give you an account, and without billing details an organisation can’t move onto a paid plan.
Emails we send
We send service emails: sign-in links, invitations, reminders, summaries, notices about your organisation and replies to your questions. You can turn reminders and summaries down or off in My settings. Sign-in and security emails always go.
We don’t send marketing emails to anyone who hasn’t asked for them. If you sign up for news from us, every email will have a way to unsubscribe.
Our email provider, Brevo, adds a tiny image to each email and changes links so that it can count how many emails are opened and links followed. We have set this to anonymous, so the counts aren’t linked to your address in Brevo’s records, and we don’t use them to profile anyone. You can stop the image loading by turning off images in your email program, or tell us at hello@trivet.digital and we’ll explain your options.
Outside the UK
The app’s database, files, backups and server functions are in London. Some services work globally: Google’s sign-in, push notifications and reCAPTCHA may process information in the United States, Brevo works in the European Union, MXroute in the United States, and Stripe in the European Union and the United States.
Transfers to the European Economic Area rely on UK adequacy regulations. Other transfers are protected by the UK International Data Transfer Agreement or Addendum, or by the UK Extension to the EU-US Data Privacy Framework where the company is certified. Ask us for a copy of the relevant safeguard.
Stripe (Stripe Payments Europe Limited, Ireland, and its affiliates): UK adequacy regulations for the EEA, and the safeguards in Stripe’s own data processing terms for the United States.
How long we keep it
| Information | How long |
|---|---|
| Your account and profile | Until you delete your account, which you can do in My settings |
| In-app notifications | 90 days |
| Invitations | Valid for 7 days, then deleted 30 days after they expire |
| Server request logs | 30 days |
| The audit log | 6 years. Once your account is deleted, its entries no longer identify you |
| Support requests and emails to us | 24 months after the request is closed, with its messages and attachments. Emails in our mailbox are deleted 24 months after they arrive |
| Sales leads | 24 months after we last updated the record, which includes noting a call or email. If you ask us not to contact you, we mark your details "do not contact", which hides every way of contacting you in our records |
| Billing records | 6 years after the end of the financial year they belong to |
| Trustee details from the Charity Commission register | Checked each week. Deleted when a trustee who isn’t matched to an account leaves the register, when the organisation removes or changes its charity number, or when the Charity Commission tells us to |
| Backups | Daily backups for 14 days and weekly backups for 8 weeks, so anything deleted is gone from them within 8 weeks |
Your rights
You have the right to:
- ask for a copy of your information
- have it corrected if it is wrong
- have it deleted
- ask us to limit how we use it
- object to how we use it, including any marketing (we will always stop marketing)
- have information you gave us sent to you, or to another organisation, in a common format
- withdraw consent where you gave it, without affecting what we did before
Some rights depend on the circumstances. We will tell you if one doesn’t apply, and why. We don’t make decisions about you by automated means.
To use a right, email hello@trivet.digital or use "Contact us" in the app. We reply within one month. If a request is complex we may need up to two more months, and we will tell you why within the first month. You can change your name and settings yourself in My settings, and delete your account there.
Complaints
If you are unhappy with how we have handled your information, please tell us first at hello@trivet.digital. We will acknowledge your complaint within 30 days, look into it and tell you the outcome without undue delay. We aim to acknowledge within 2 working days. Our complaints procedure has the details.
You can also complain to the data protection regulator, the Information Commission (ICO): ico.org.uk/make-a-complaint.
Children and young people
Trivet is for adults running organisations. You must be 16 or over to have an account. Organisations must not record the names of young people in the app: bookings record how many people travel, never who, and incident reports ask for "a young person", not a name.
Changes to this notice
We will update this notice when what we do changes. The version and date are at the top. If a change matters to you, we will tell you by email or in the app before it takes effect.