Safe Havens Privacy Policy
This page is maintained by the Safe Havens (Safe Havens) to explain how the Safe Havens intelligence platform (this application) collects, uses, shares and protects personal data when it is used by Safe Havens Staff, Safe Havens Members and Safe Havens Partners.
Last updated: 22 July 2026.
Who we are
The Safe Havens platform is operated on behalf of the Safe Havens to help staff log member visits, help members raise concerns and submit intelligence, and help partners share Safe Haven reports, patrol activity and operational updates. Depending on the arrangement with the local scheme or partner organisation, Safe Havens may act as a data controller, or as a data processor working under an information-sharing or data processing agreement with that scheme.
Scope of this notice
This policy applies to personal data collected through:
- the Safe Havens web application (dashboards, maps, bulletins, tasking);
- the Safe Havens reporting workflows for Staff, Members and Partners;
- Safe Haven reporting submitted by partner venues;
- account, sign-in and support communications with Safe Havens.
The data we collect
Account data
- Name and email address used to sign in;
- Role in the network (staff, member, partner, admin);
- Organisation, business or venue you are associated with.
Operational report data
- Report type (staff visit, member concern, partner update, Safe Haven case);
- Business or member visited, engagement type, issues identified, actions agreed and any follow-up date;
- Safe Haven visitor details entered by partner venues (age band, reasons for attendance, actions taken, partners contacted, outcome, fear score, arrival time);
- Free-text descriptions and notes you choose to enter;
- Photos you choose to attach to a report;
- Approximate location (address, latitude, longitude) of the incident or venue when provided.
Technical data
- Timestamps of records you create or update;
- Session and authentication tokens needed to keep you signed in;
- Basic device and browser information generated by ordinary web requests.
How we use your data
We use the data described above to operate the Safe Havens service, to build the shared intelligence picture across staff, members and partners, and to help Safe Havens co-ordinate an operational response. The main purposes are:
Purpose 1
Running the Safe Havens platform and your account
- Data collected
- Name, email, role, organisation, sign-in tokens.
- Source
- From you when you are invited to the platform or sign in.
- Lawful basis
- Legitimate interests in operating the Safe Havens service, or performance of the agreement between Safe Havens and the participating scheme/organisation.
- Shared with
- Safe Havens staff and IT sub-processors that host the platform.
Purpose 2
Capturing operational reports (visits, concerns, incidents, Safe Haven cases)
- Data collected
- Report type, business/member visited, engagement type, issues, actions agreed, follow-ups, Safe Haven visitor details, free-text notes, photos, address and coordinates.
- Source
- From Safe Havens staff, Safe Havens members and Safe Havens partners submitting the report.
- Lawful basis
- Legitimate interests of Safe Havens and its members in preventing and reducing business crime, safeguarding vulnerable people and coordinating an operational response.
- Shared with
- Safe Havens staff and authorised users of the Safe Havens network with a role-based need to see the record.
Purpose 3
Intelligence, dashboards, maps and bulletins
- Data collected
- Aggregated and case-level operational data derived from the reports above.
- Source
- Generated from the records described in Purpose 2.
- Lawful basis
- Legitimate interests in providing Safe Havens staff, members and partners with an accurate operational picture.
- Shared with
- Authorised Safe Havens users; aggregated/anonymised summaries may be shared more widely in bulletins.
Purpose 4
Safe Havens Decision Engine (AI-assisted recommendations)
- Data collected
- Operational report data described in Purpose 2, processed through a third-party AI gateway to produce briefings, service reviews and bulletin drafts.
- Source
- Generated from the records described in Purpose 2.
- Lawful basis
- Legitimate interests in helping Safe Havens prioritise visits, patrols and member briefings.
- Shared with
- The AI gateway sub-processor used to generate the recommendation. Recommendations are visible to authorised Safe Havens users only. Automated outputs are advisory; a human user reviews and decides.
Purpose 5
Security, audit and abuse prevention
- Data collected
- Account activity, sign-in events, changes made to records.
- Source
- From your interactions with the platform.
- Lawful basis
- Legitimate interests in protecting the platform and the data it holds.
- Shared with
- Safe Havens staff and, where necessary, our hosting sub-processor.
Purpose 6
Legal obligations and lawful requests
- Data collected
- Any relevant information as requested.
- Source
- From your account and records of your interactions with Safe Havens.
- Lawful basis
- Compliance with a legal obligation.
- Shared with
- A court, government body or law enforcement agency.
Sensitive information
Safe Havens does not ask you to enter special category (sensitive) personal data. Free-text notes, photos and Safe Haven visitor descriptions may nevertheless contain information about health, vulnerability or alleged offences. Only enter what is necessary for the operational purpose of the report, and follow your local Safe Havens scheme's guidance on what to record.
Sharing your data
Operational reports are visible to authorised users of the Safe Havens network according to their role. We do not sell personal data. We may share data with:
- Safe Havens staff and authorised member/partner users with a need to see the record;
- Our hosting and database sub-processor and the AI gateway sub-processor used by the Safe Havens Decision Engine;
- Police, courts, regulators or other authorities where we are legally required to;
- Another organisation if the Safe Havens service is transferred to it.
How we protect your data
- Role-based access controls and row-level security on operational tables;
- Encrypted transport (HTTPS) for all traffic to the platform;
- Authenticated access only to intelligence, maps, dashboards and reports;
- Least-privilege access for staff and sub-processors.
How long we keep your data
Operational reports and Safe Haven cases are retained for as long as they remain useful to the Safe Havens operational picture, and after that in line with Safe Havens's retention schedule and any legal obligation to retain records. Account data is retained while your account is active and then removed or anonymised when it is no longer needed.
International transfers
Data is hosted in the United Kingdom and/or European Economic Area. Where a sub-processor (for example the AI gateway) processes data outside the UK/EEA, we rely on adequacy decisions or standard contractual clauses to protect it.
Your rights
- Be informed about how your data is used;
- Access the personal data we hold about you;
- Have inaccurate data corrected or completed;
- Have your data erased where the law allows;
- Restrict or object to certain processing;
- Data portability where applicable;
- Rights in relation to solely automated decision-making — the Safe Havens Decision Engine is advisory and does not make automated decisions about you on its own.
You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk.
Children
The Safe Havens platform is an operational tool for adult staff, members and partners. It is not intended for use by children.
Changes to this policy
We review this notice periodically and will update the "Last updated" date at the top of the page when we make changes.
Contact
privacy queries: your local Safe Havens scheme administrator, or the Safe Havens admin listed inside the platform.
Security concerns should be reported to the same contact and clearly marked as security.
For information about your Safe Havens membership, contact your scheme directly.