Forge41 Ltd
Last updated 25 March 2026
This policy explains how Forge41 Limited collects, uses and protects personal data in relation to Packhorse at https://packhorse.app.
1.1 We are committed to safeguarding the privacy of our website visitors, service users and customer personnel.
1.2 This policy applies where we are acting as a data controller with respect to personal data. Where we process personal data solely on behalf of a customer as a processor, Section 13 applies.
1.3 We do not use personal data for advertising and we do not sell personal data.
1.4 In this policy, "we", "us" and "our" refer to Forge41 Limited.
2.1 We may process contact data. This may include names and email addresses. The source of this data is you, your employer or the customer organisation using Packhorse.
2.2 We may process account data. This may include account identifiers, names, email addresses where necessary, role information, organisation details, login-related records, terms acceptance records, privacy acceptance records, and account creation and modification dates.
2.3 We may process customer relationship data. This may include the name of your organisation, your role, billing contact details, subscription records, and information contained in communications between us and you or your organisation.
2.4 We may process service data provided in the course of using Packhorse. This may include names, operational records, checklist records, equipment and medicines records, and other minimal business contact data that a customer chooses to input into the service for operational use.
2.5 We may process transaction data relating to subscriptions and payments. This may include organisation name, billing email address, Stripe customer identifiers, Stripe subscription identifiers and transaction details. We do not store full payment card details ourselves.
2.6 We may process communication data. This may include the content of emails and support requests and associated metadata.
2.7 We may process technical and usage data. This may include IP address, browser type, timestamps, request logs, session state, device and authentication metadata, and information about use of the website and service.
2.8 We may process cookie data as described in Section 14.
2.9 Please do not supply any other person's personal data to us unless you are authorised to do so and it is necessary for the use of the service.
3.1 We process personal data to operate Packhorse, create and administer accounts, provide support, authenticate users, maintain service security, manage subscriptions and billing, and communicate with customers about the service. The legal basis for this processing is performance of a contract and our legitimate interests in operating and securing our business and services.
3.2 We process customer relationship and communication data to manage our relationship with customers, respond to enquiries, provide support and handle complaints. The legal basis is our legitimate interests in administering our services and customer relationships.
3.3 We process transaction and billing data to manage subscriptions, invoices, payments, failed payments and account access associated with subscriptions. The legal basis is performance of a contract and compliance with legal obligations.
3.4 We process technical, security and usage data to monitor, maintain, improve and secure the website and services, prevent misuse and investigate incidents. The legal basis is our legitimate interests in protecting the website, service, users and business.
3.5 We may process personal data where necessary for legal compliance, the establishment, exercise or defence of legal claims, obtaining professional advice, and maintaining business records. The legal basis is legal obligation and our legitimate interests.
3.6 We do not use your personal data for behavioural advertising, ad targeting or unrelated marketing campaigns.
4.1 We may disclose personal data to our professional advisers, insurers and auditors where reasonably necessary.
4.2 Personal data held in Packhorse is stored using Amazon Web Services infrastructure in UK locations.
4.3 We use Amazon SES to send transactional emails such as login links, welcome messages and service notifications.
4.4 Subscription billing and payment administration are handled through Stripe. We share only the data necessary to create and manage customer, subscription and billing records. Stripe's privacy information is available at https://stripe.com/gb/privacy.
4.5 We may disclose personal data where required by law or where necessary for the establishment, exercise or defence of legal claims.
5.1 Our primary hosting and application data storage is in UK locations.
5.2 Some service providers may process limited personal data outside the UK where appropriate safeguards are in place. Where this happens, we rely on lawful transfer mechanisms under applicable data protection law.
6.1 We keep personal data for no longer than necessary for the relevant purpose, subject to legal, regulatory and contractual requirements.
6.2 Contact and enquiry data is generally retained for up to 24 months after the last meaningful contact unless a longer period is required.
6.3 Account and service data is generally retained for the life of the account and then for a short period after closure to handle export, deletion, support and security matters.
6.4 Billing and transaction records may be retained for up to 6 years, or longer where required by law or for legal claims.
6.5 Technical logs and security records are generally retained for up to 12 months unless a longer period is needed for investigation or legal compliance.
6.6 Where we act only as a processor on behalf of a customer, retention and deletion of that data are governed primarily by our contract with that customer.
7.1 We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, disclosure, alteration and destruction.
7.2 These measures include secure hosting, access controls, logical separation of customer data, encryption in transit, encryption at rest where applicable, and restricted administrative access.
7.3 No method of transmission over the internet or electronic storage is completely secure, but we work to maintain a level of security appropriate to the risks involved.
8.1 Subject to applicable law, you may have rights to access, correct, erase, restrict or object to the processing of your personal data, and to receive a copy of certain personal data in a portable format.
8.2 You may also have the right to complain to the Information Commissioner's Office or another competent supervisory authority.
8.3 To exercise any of these rights, contact us using the details in Section 12.
Our website and service may include links to third party websites. We are not responsible for the privacy policies or practices of those third parties.
Packhorse is intended for business and operational use by adults. It is not directed to children, and users must be at least 18 years of age.
11.1 In respect of personal data that customer organisations upload or manage within Packhorse for their own operational purposes, we generally act as a data processor rather than as a data controller.
11.2 In those cases, our obligations are governed primarily by our contract with the relevant customer, and that customer is responsible for determining the purposes and means of the processing.
11.3 This policy still explains certain controller activities that we carry out ourselves, such as website operation, account administration, support, billing, security and compliance.
12.1 This website is owned and operated by Forge41 Limited.
12.2 We are registered in England and Wales under company number 15784946.
12.3 You can contact us by email at hello@forge41.co.uk.
12.4 We are registered as a data controller with the UK Information Commissioner's Office. Our data protection registration number is ZB714615.
13.1 A cookie is a small file containing an identifier that is sent by a web server to a web browser and stored by the browser.
13.2 Packhorse currently uses cookies that are strictly necessary for the operation of the website and service.
13.3 We do not currently use analytics cookies, advertising cookies or social media tracking cookies on Packhorse.
13.4 The cookies we currently use include:
(a) _bagtrack_key, used to maintain session state while you use the service;
(b) _bagtrack_web_user_remember_me, used when an admin user chooses a persistent login option; and
(c) _bagtrack_web_signer_remember_me, used when a signer user chooses a persistent login option.
13.5 These cookies are used only to provide requested functionality such as authentication, session continuity and secure access control.
13.6 If we introduce non-essential cookies in future, we will update this policy and seek consent where required by law.
14.1 Most browsers allow you to refuse cookies and delete cookies. The methods vary by browser.
14.2 Blocking strictly necessary cookies may prevent Packhorse from functioning properly, including logging in and maintaining secure sessions.
15.1 We may update this policy from time to time by publishing a new version on this page.
15.2 Where appropriate, we may also notify customers of significant changes by email.