Trust & compliance

• No email addresses required. Workers sign in with a worker ID and a 4-digit PIN, or play as a guest. We never ask for personal email, home address, date of birth or health data.
• Minimal personal data. A training record holds: display name or worker ID, department, game and question pack, answers given, score, attempt count and timestamps.
• Lawful basis. For employer-run training we act as processor on your instructions; your lawful basis is normally legitimate interests (meeting your duties under the Health and Safety at Work etc. Act 1974) or a legal obligation.
• Guest play is anonymous. Guest sessions are recorded without a user account, so they cannot be traced back to an individual.
• Data subject rights. Access, rectification, erasure, restriction, portability and objection are all supported — a manager can export or delete an individual's records from the manager reports screen.

Full detail lives in our Privacy Notice, Cookie Notice and Data Processing Agreement.

• Controller (you) / processor (CHOOSE MOI) roles and documented instructions.
• Subject matter: delivery of interactive safety training and reporting.
• Categories of data subject: your employees, agency staff and contractors.
• Security measures, breach notification and assistance with DPIAs.
• Sub-processor list, hosting locations, and deletion or return of data on exit.

To complete: Confirm your legal entity name, registered address, ICO registration number and named data protection contact so the DPA can be counter-signed by customers.

• In transit and at rest. All traffic runs over HTTPS/TLS; the database is encrypted at rest by the managed hosting platform.
• Access control. Row-level security means a worker can only read their own records; manager and admin reporting is gated behind a role stored server-side, not in the browser.
• On-device only. Language choice, sound and effects settings, kid-voice intensity and unfinished game progress stay in the browser's local storage — they are never sent to us.
• Third-party media. Training clips are embedded from youtube-nocookie.com, so no advertising cookies are set before playback.
• Retention. Training records and certificates are kept for the retention period you set (three years is the common HSE-audit default), then deleted.

To complete: Agree the default retention period and your sub-processor list (hosting, AI translation and text-to-speech providers) before publishing this page to customers.

• Target standard: WCAG 2.2 level AA. Known gaps are listed on the accessibility statement.
• Every board tile, dice roll and card is keyboard reachable and screen-reader labelled.
• TV mode has an accessibility mode: extra-large text, high contrast and reduced motion.
• Reduced-motion setting softens or disables confetti and character animations.
• Questions can be read aloud in English, Polski and Română, which supports workers with low literacy or English as a second language.
• Subtitles are forced to the chosen language on translated training clips.
• Sound is optional throughout — nothing depends on hearing audio.
• Colour is never the only cue: risk tiers also carry icons, labels and point values.

Every answer attempt is logged, so you can show an inspector not just that training happened but that it was understood.

• Certificates. Issued only when a player lands on all 32 board tiles, and carry a unique reference, course name, score and completion date.
• Per-question attempt log. Question, pack, whether it was answered correctly and how many attempts it took — this is what identifies the topics a team is genuinely struggling with.
• Exports. CSV and Excel exports from manager reports, filtered by department, date range, game and question pack.
• Toolbox-talk mapping. Packs align to the subjects safety inspectors ask about: electrical, work at height, fire, COSHH chemicals, manual handling, DSE, lone working, driver walk-round checks, drivers' hours and tachograph, load security and blind-spot awareness.
• Scan analytics. QR scans per board game show which teams are actually using their toolbox talks.

To complete: Have a competent person (NEBOSH/IOSH qualified) review the question packs and sign the mapping so it can be quoted as verified in tenders.

Security questionnaires, DPIA support and pilot agreements are welcome — request a demo and tell us what your procurement team needs.