DoSA

Privacy Policy

Effective Date: April 7, 2026 | Last Updated: April 7, 2026

DoSA Safety Enhancements Inc — DoSA Safety | dosasafety.com

1. Introduction & Who This Policy Covers

DoSA Safety Enhancements Inc (“we,” “us,” “our”) provides dosasafety.com, an industrial safety management platform, and related subdomains (together, the “Platform”). This Privacy Policy applies to:

  • •The web application and all features therein (incident reporting, inspections, compliance tracking, audits, dashboards)
  • •Our public-facing marketing website and landing pages
  • •Contact forms, lead-generation pages, downloadable resources, and demo-request flows
  • •Our official social media channels (LinkedIn, X/Twitter, Facebook, Instagram, YouTube, and others) and interactions thereon
  • •Email marketing campaigns and related analytics
  • •All data submitted by Customer organizations and their authorized Users (workers, supervisors, EHS managers, contractors)

This Policy governs all personal data, operational safety data, and regulatory compliance data we process, whether as a data controller (for our own marketing and business purposes) or as a data processor / service provider (processing data on behalf of our B2B Customers under a Data Processing Agreement).

2. Applicable Laws & Global Compliance Framework

This Policy is designed to comply with, among others:

  • •EU General Data Protection Regulation (GDPR) 2016/679 & ePrivacy Directive 2002/58/EC
  • •UK GDPR and Data Protection Act 2018
  • •California Consumer Privacy Act (CCPA) / CPRA (Cal. Civ. Code § 1798.100 et seq.)
  • •Canada: PIPEDA and provincial equivalents (PIPA BC/AB, Law 25 Québec / Bill 64)
  • •Australia: Privacy Act 1988 (Cth) and Australian Privacy Principles (APPs)
  • •Brazil: Lei Geral de Proteção de Dados (LGPD — Lei 13.709/2018)
  • •Japan: Act on Protection of Personal Information (APPI, 2022 amendments)
  • •India: Digital Personal Data Protection Act 2023 (DPDPA)
  • •South Africa: Protection of Personal Information Act (POPIA)
  • •United States — OSHA Recordkeeping: 29 CFR Part 1904 (mandatory retention of injury/illness records)
  • •United States — other applicable federal and state occupational safety regulations
  • •EU / national sector-specific occupational health & safety laws where applicable

For B2B enterprise and SMB Customers, the terms of the executed Data Processing Agreement (DPA) govern processing conducted as a processor/service provider. This Policy governs our own controller-capacity processing.

3. Data Controller, Processor Roles & Key Contacts

3.1 When We Are Data Controller

We act as controllers for: marketing and lead data, website visitor analytics, social media interactions, our own employees’ data, and account-level business contact data.

3.2 When We Are Data Processor / Service Provider

For all data that Customer organizations submit to the Platform — including worker personal data, incident records, inspection logs, OSHA reports, and audit documentation — DoSA Safety Enhancements Inc acts solely as a data processor under the Customer’s instructions. The Customer (the employer or EHS operator) is the data controller responsible for the lawfulness of that data collection and for fulfilling worker rights requests related to it. Our DPA is available at dosasafety.com/dpa.

4. Categories of Personal & Operational Data We Process

4.1 Worker & Employee Personal Data [Processor Role]

  • •Identity data: full name, employee ID, job title, department, site/facility location
  • •Contact data: work email, work phone, emergency contact information
  • •Occupational health data: injury and illness details, body parts affected, medical treatment received, work restrictions, return-to-work status
  • •Safety training records: certifications held, training completion status, competency assessments
  • •Behavioral / observation data: safety observations, near-miss reports, behavioral safety assessments
  • •Contractor and visitor data: name, company, site access records, induction completions
  • •Biometric / access data [if applicable]: site access card identifiers, electronic signatures on safety documents

4.2 Safety Incident & Injury Records [OSHA-Regulated]

  • •Incident type, date, time, and location (GPS coordinates if submitted)
  • •Description of events, root cause analysis, and corrective actions
  • •Injury/illness classification (recordable, first aid, lost time, restricted duty, fatality)
  • •Medical details: diagnosis, treatment type, physician/medical facility (where provided)
  • •Workers' compensation claim references
  • •Witness statements and investigation findings
  • •Photos, videos, and attachments uploaded to incident records
  • •OSHA Form 300, 300A, and 301 equivalents generated by the Platform

4.3 Equipment Inspection & Audit Logs

  • •Equipment identifiers: asset ID, serial number, equipment type, location
  • •Inspection results: pass/fail status, deficiency descriptions, severity ratings
  • •Inspector identity and credentials; corrective action assignments and completion timestamps
  • •Regulatory permit references (pressure vessel certificates, crane inspection certs, etc.)
  • •Audit findings, non-conformance reports, and remediation plans
  • •Timestamped digital signatures on inspection records

4.4 OSHA / Regulatory Compliance Data

  • •OSHA 300 Log entries, 300A summaries, and 301 incident reports
  • •Regulatory inspection records and citation histories
  • •Permit-to-work and job hazard analysis documentation
  • •Chemical / MSDS / SDS records and hazardous substance inventories
  • •EHS program documentation; CAPA tracking; Management of Change (MOC) records

4.5 Account & Platform User Data

  • •Account registration: name, work email, job title, organization name
  • •Authentication credentials: password (hashed/salted), MFA tokens
  • •Platform activity logs: login timestamps, features accessed, records created/modified, export activity
  • •Role-based permission assignments; API access keys and integration configurations

4.6 Lead-Generation & Marketing Contact Data [Controller Role]

  • •Contact form submissions: name, work email, company, job title, phone number, inquiry details
  • •Demo and free-trial requests: organization type, industry sector, employee count, use case
  • •Downloadable content gating: name, email, company, role
  • •Webinar and event registrations
  • •Social media interactions: profile handles, comments, direct messages, reactions on our official pages
  • •Email marketing engagement: open rates, click-through rates, unsubscribe actions (pseudonymized)
  • •Advertising platform data: LinkedIn Lead Gen Forms, Meta Lead Ads, Google Ads conversion data

4.7 Website & Marketing Page Technical Data

  • •IP address (truncated for EU/UK visitors), browser type, operating system, device type
  • •Referral source, UTM campaign parameters, landing page URLs
  • •Session data: pages visited, time on page, scroll depth, form interactions
  • •Cookies and similar tracking technologies (see our Cookie Policy)

5. Legal Bases for Processing

5.1 EU / UK GDPR Lawful Bases

  • •Contract performance (Art. 6(1)(b)): Platform delivery, account management, subscription billing, Customer onboarding
  • •Legitimate interests (Art. 6(1)(f)): Fraud prevention, platform security, product improvement, B2B direct marketing to existing contacts — subject to documented balancing tests
  • •Legal obligation (Art. 6(1)(c)): Tax compliance, financial records, lawful government requests; supporting Customers' OSHA recordkeeping obligations
  • •Consent (Art. 6(1)(a)): Email marketing to new prospects, non-essential cookies, retargeting advertisements
  • •Special-category data (Art. 9(2)(b)): Processing occupational health and injury data necessary for the Customer's obligations in employment and social security law

5.2 Other Jurisdictions

  • •CCPA/CPRA: Contractual necessity, legitimate business purpose, consent for sensitive PI; we do not sell personal information
  • •LGPD (Brazil): Consent, legitimate interest, contract performance, legal obligation
  • •PIPEDA/Law 25 (Canada): Knowledge and consent, with exceptions for employment purposes
  • •APPI (Japan): Specified purpose of use; consent for sensitive information
  • •DPDPA (India): Consent or legitimate use as defined by law
  • •POPIA (South Africa): At least one condition for lawful processing

6. How We Use Personal & Operational Data

6.1 Platform Operations (Processor Role)

  • •Hosting, storing, and retrieving safety records, incident reports, inspection logs, and compliance documentation
  • •Powering dashboards, analytics, trend analysis, and regulatory reporting features
  • •Generating OSHA 300/300A/301 logs and equivalent compliance reports
  • •Sending automated platform notifications: overdue inspections, corrective action deadlines, compliance calendar reminders
  • •Enabling data export for Customers to fulfill their own regulatory reporting obligations
  • •Facilitating audit trails and tamper-evident recordkeeping for regulatory purposes

6.2 Our Own Business Operations (Controller Role)

  • •Managing user accounts, subscriptions, and billing
  • •Providing customer support and platform onboarding
  • •Sending platform service communications (security alerts, maintenance notices, policy updates)
  • •Conducting product analytics to improve features and user experience (pseudonymized)
  • •Fraud detection, security monitoring, and abuse prevention
  • •Complying with legal and regulatory obligations

6.3 Marketing & Lead Generation (Controller Role)

  • •Responding to contact form submissions, demo requests, and sales inquiries
  • •Nurturing leads through email marketing campaigns (with consent or legitimate interest + opt-out)
  • •Running targeted digital advertising via LinkedIn, Google Ads, Meta, and similar platforms (with consent for EU/UK/CA)
  • •Hosting and promoting webinars, case studies, and safety resources
  • •Managing our social media presence and engaging with followers, commenters, and direct message senders
  • •Account-based marketing (ABM) targeting of organizations in high-risk industrial sectors

7. Social Media & Marketing Channel Data

  • •We collect data from social media interactions to manage our brand presence, respond to inquiries, and measure engagement
  • •We do not store private social media messages beyond what is necessary to respond to your inquiry
  • •Social media lead forms (LinkedIn Lead Gen Forms) collect name, email, and company data with your consent; this data enters our CRM for follow-up
  • •We may use social media advertising pixels (LinkedIn Insight Tag, Meta Pixel) on our marketing pages — governed by our Cookie Policy
  • •We will not share or amplify content in ways that could identify individuals involved in safety incidents without explicit consent
  • •We maintain separate Social Media Community Guidelines at dosasafety.com/social-guidelines

8. Data Sharing & Disclosure

We do not sell personal data or workers’ safety records. We share data only as follows:

8.1 Within Customer Organizations

Platform data is accessible to authorized users within that Customer organization as configured by the Customer. DoSA Safety Enhancements Inc has no control over internal sharing decisions.

8.2 Service Providers & Sub-Processors

Vetted vendors operating under DPAs, including: cloud infrastructure (AWS/GCP/Azure), payment processors (PCI-DSS Level 1 certified), email delivery, CRM and marketing automation, customer support tooling, analytics providers, and security monitoring. Full sub-processor list at dosasafety.com/sub-processors.

8.3 Regulatory & Legal Authorities

We may disclose data when required by valid legal process. We will notify the relevant Customer of such requests to the extent permitted by law. Customers remain solely responsible for their own regulatory disclosure obligations.

8.4 Business Transfers

In a merger, acquisition, or asset sale, safety and personal data may be transferred. Customers will receive at least 60 days’ notice, with the right to export and delete their data before transfer.

8.5 Aggregated & De-Identified Industry Data

We may publish aggregated, de-identified industry benchmarks derived from Platform data. No individual worker, incident, or Customer organization is identifiable in such outputs.

9. International Data Transfers

  • •EU → Third countries: European Commission SCCs (2021/914/EU) Module 2 and Module 3
  • •UK → Third countries: UK IDTAs or UK Addendum to EU SCCs
  • •Brazil (LGPD): SCCs or adequacy decision where available
  • •Canada / Australia / Japan / India / South Africa: Locally required transfer mechanisms or binding corporate rules
  • •US–EU Data Privacy Framework: Relied upon where DoSA Safety Enhancements Inc is certified

10. Data Retention — Including OSHA & Regulatory Requirements

  • •Active platform data: Retained for the duration of the subscription and as configured by the Customer
  • •OSHA-regulated incident records: Minimum 5 years per 29 CFR § 1904.33
  • •Equipment inspection records: Minimum 3 years or per applicable certification standards (whichever is longer)
  • •Account and user data: Subscription duration plus 3 years post-closure
  • •Financial / billing records: 7 years (tax compliance)
  • •Marketing and lead data: Up to 3 years from last interaction; suppression lists maintained indefinitely
  • •Security and access logs: 12 months (longer if under active investigation)
  • •Backup copies: Purged within 90 days of primary deletion
  • •Post-termination export window: 60 days

11. Your Privacy Rights

11.1 Workers & Individual Users (via Your Employer)

If your employer uses DoSA Safety to manage your safety records, your employer is the data controller for that data. To exercise your data rights regarding your incident records, training history, or safety observations, please contact your employer’s EHS or HR team directly.

11.2 EU / UK Users (GDPR / UK GDPR)

  • •Access (Art. 15), Rectification (Art. 16), Erasure (Art. 17 — subject to OSHA retention), Restriction (Art. 18)
  • •Data Portability (Art. 20): receive your data in structured machine-readable format
  • •Object to processing (Art. 21): including direct marketing (absolute right)
  • •Withdraw consent at any time without affecting prior lawful processing
  • •Complaint to your national supervisory authority (e.g., ICO in UK)

Response time: 30 days (extendable by 60 days for complex requests).

11.3 California Residents (CCPA / CPRA)

  • •Right to Know, Right to Delete, Right to Correct, Right to Opt-Out of Sale/Sharing (we do not sell PI)
  • •Right to Limit Use of Sensitive PI; Right to Non-Discrimination
  • •Authorized Agent requests accepted at privacy@dosasafety.com

Response time: 45 days (one 45-day extension with notice).

11.4 Other Jurisdictions

  • •Brazil (LGPD): Access, correction, anonymization, portability, deletion — complaint to ANPD
  • •Canada (PIPEDA / Law 25): Access, correction, withdrawal of consent — complaint to OPC
  • •Australia (Privacy Act): Access, correction — complaint to OAIC
  • •South Africa (POPIA): Access, correction, deletion, objection — complaint to the Information Regulator
  • •India (DPDPA): Access, correction, erasure — grievance redressal via Grievance Officer

11.5 Submitting Requests

Email privacy@dosasafety.com with subject “Privacy Rights Request — [Jurisdiction].” We may require identity verification.

12. Security for Safety-Critical Data

  • •Encryption in transit: TLS 1.3 for all data in motion
  • •Encryption at rest: AES-256 for all stored data including safety records and incident files
  • •Key management: dedicated KMS with Customer-managed key options for enterprise plans
  • •Access controls: RBAC, field-level permissions for sensitive injury data, MFA enforcement
  • •Audit trail: immutable, tamper-evident logs for all record creation, modification, deletion, and export
  • •Data segregation: Customer data is logically isolated; cross-Customer access is architecturally prevented
  • •Penetration testing: minimum annual third-party pentest; continuous automated vulnerability scanning
  • •Incident response: 72-hour supervisory authority notification (GDPR Art. 33); Customer breach notification within 48 hours of confirmed breach
  • •SOC 2 Type II / ISO 27001 / ISO 45001 alignment

13. Changes to This Policy

We will provide at least 30 days’ advance notice of material changes via email and in-app notice. For changes affecting safety records or occupational health data, we will also notify Customer EHS Administrators directly.

14. Contact & Complaints