Privacy notice

This notice explains how personal information is handled in Task Mngr, the fault reporting service at task-mngr.com. It covers people who report a fault on an organisation’s reporting form, people who use Task Mngr to deal with those reports, and visitors to this website. Our company website, oe-services.com, has its own privacy policy.

Task Mngr is provided by O E Services Limited (“OE Services”, “we”), a company registered in England and Wales under number 05113216, whose registered office is at Studio 21, Sum Studios, 1 Hartley Street, Sheffield S2 3AQ. We are registered with the Information Commissioner’s Office under number ZA119678. For anything about privacy, email privacy@oe-services.com or call +44 20 8720 7015.

Task Mngr is used by organisations, our clients, to collect and deal with reports of faults, such as a broken door, a leak or a light that is out. The organisation whose name is at the top of a reporting form decides what that form asks for, who deals with the reports and how long they are kept. In data protection terms it is the controller of that information, and we are its processor: we hold and use the information only on its instructions, under a written contract that meets Article 28 of the UK GDPR.

That includes you if you reported a fault without ever creating an account, and it includes the staff and contractors the organisation has invited to deal with reports.

So for questions about a report, or to use your rights over it, please contact that organisation first. If you cannot reach it, or you contact us instead, we will pass your request on and help it answer. We are the controller only for the information described in section 6.

• Reports. The name, email address and, if given, phone number of the person reporting; what they wrote about the problem; a description of where it is and, only if they chose to share it, their device’s map position; any photographs they added; the language they used; and the IP address the report came from, which is kept to investigate abuse of a form and is deleted with the report. The reporter is sent a private link to follow their report and answer questions about it.
• Accounts. For the organisation’s staff and the people it asks to deal with reports: name, email address, role and preferred language. Accounts are created only by the organisation or by invitation from it. Passwords are held only in scrambled (hashed) form by our sign-in provider, so nobody can read them.
• Who did what. Each report keeps a timeline of what happened to it: who it was assigned to, the messages and notes added, and who closed it. Separately, an activity log records significant actions on the account, such as someone being invited or a plan being changed, and is kept for 30 days.
• Emails. Confirmations and updates to the person reporting, notifications to the people dealing with reports, invitations and password resets. A record of each email sent is kept with the report or account it belongs to.

Reports are passed to the right person automatically according to their category, but no decisions with legal or similarly significant effects are made about anyone by automated means, and the information is not used for profiling.

The reporting form is for faults, not for information about anyone’s health. If a report includes it, for example where someone was hurt, the organisation is responsible for having a lawful basis and an appropriate condition for keeping it.

• Photographs: 30 days after a report is finished, whether it was closed, cancelled or marked as a duplicate. The written record stays.
• Reports: for the period the organisation chose when it set up its account, between 3 and 24 months after the report is finished. There is no option to keep reports indefinitely. At the end of that period the report is deleted with its timeline, the reporter’s details and the record of emails sent about it.
• Activity log: 30 days.
• Invitations nobody accepted: deleted 30 days after they expire.
• When an organisation stops using Task Mngr: its account and everything in it, including every report, photograph, activity log and staff login, are deleted on the day it closes. That happens when the organisation closes the account, when a term it chose not to renew comes to an end, or five days after an unpaid invoice falls due.
• Backups: the database is backed up daily and each backup is kept for 7 days, so information deleted from the service leaves the backups within about a week. Photographs are not held in these backups.

Each provider works under a contract that requires it to protect the information and to use it only to provide its service to us. Organisations using Task Mngr are told before we add or replace one.

Reports, accounts and photographs are stored in Ireland, which is in the European Economic Area and is recognised by the UK as protecting personal information adequately. Emails are sent through Resend in the United States, and Cloudflare checks visitors to the reporting form from wherever on its network is nearest to them. Both transfers are covered by the UK Extension to the EU-US Data Privacy Framework, under which Resend and Cloudflare are certified, and by the UK Addendum to the EU Standard Contractual Clauses. All four providers are headquartered in the United States; where their staff may need access to support their service, safeguards of the same kind in their data processing terms apply.

We do not sell personal information or share it for anyone else’s marketing. We share it otherwise only with our professional advisers where needed, or with regulators, law enforcement or courts where the law requires it. Our own staff who run the service see how many reports an organisation has, not what they say.

For the following, OE Services is the controller.

Contact details of the people we deal with at client organisations, and billing information

• Why: To run our contract with your organisation: setting up, support, invoices and service notices.
• Lawful basis: Contract, and our legitimate interests in running our business.
• How long: While we work with your organisation, then up to six years for legal, tax and accounting purposes.

Emails and messages you send us, such as a support request

• Why: To answer you and to improve the service.
• Lawful basis: Legitimate interests.
• How long: 24 months from our last contact.

The IP address and email address a report is sent from

• Why: To stop one person or script flooding a reporting form.
• Lawful basis: Legitimate interests in keeping the service working and free of abuse.
• How long: 2 days.

Emails you send us are kept by our mailbox provider, Zoho Mail, in European data centres.

Task Mngr sets only the cookies needed for it to work, so they do not need your consent. There are no analytics, advertising or tracking cookies, and nothing on this site follows you to other sites.

• Signing in. Cookies whose names begin with “sb-” keep you signed in securely. They are removed when you sign out, and otherwise expire after at most 400 days. Someone who only reports a fault is never signed in and never given one.
• Language. If you pick a language, a cookie remembers that choice for one year: across this site, or on an organisation’s reporting form for that form only. It holds the language and nothing else.
• The reporting form. Cloudflare Turnstile may store what it needs in your browser to tell a person from automated software. It is used on the public reporting form only.

• Encrypted connections, and encryption of the database and stored files.
• Access checked by the database itself on every request, so each organisation’s information is kept apart from every other’s.
• Accounts created only by an organisation or by its invitation.
• Photographs reachable only through private links that expire after ten minutes, and a reporter’s view of their report reachable only through the private link sent to them.
• Checks on the public reporting form to stop automated and repeated submissions.
• Daily backups of the database.

If a security breach affects information in Task Mngr, we tell the organisation responsible without undue delay, so that it can meet its own duties, including reporting to the Information Commissioner’s Office within 72 hours where required. Where we are the controller, we report to the ICO ourselves.

You can ask for a copy of your information, have it corrected or deleted, restrict or object to how it is used, receive it in a portable format, and withdraw consent where consent is relied on. Some rights depend on the circumstances: for example, an organisation may need to keep a record of a repair for as long as its own obligations require.

• For a report you made, or an account you were given (sections 3 and 4), contact the organisation named on the reporting form or the one that invited you. We will help it respond.
• If you cannot reach that organisation, or it does not reply, email privacy@oe-services.com with the report reference from your confirmation email. We will make sure it reaches the organisation and that it is dealt with.
• For information we hold for ourselves (section 6), email privacy@oe-services.com. We respond within one month, free of charge.

If you are unhappy with how your information has been handled, please tell us first at privacy@oe-services.com. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113. If you live in the European Economic Area, you can contact your local data protection authority, listed by the European Data Protection Board.

We review this notice at least once a year. When we change it, the version and date at the top change too.

Data Protection, O E Services Limited, Studio 21, Sum Studios, 1 Hartley Street, Sheffield S2 3AQ, United Kingdom. privacy@oe-services.com · +44 20 8720 7015