1. Who this notice applies to
This notice explains how the National Cargo Bureau (NCB) group uses personal data when you use a website, product or service that links to this notice, contact us, take part in training, deal with us on behalf of a customer or supplier, take part in an inspection or survey, or apply for a role with us.
The company responsible for your personal data depends on the service or activity involved:
• National Cargo Bureau Inc.: a New York non-profit corporation, of 180 Maiden Lane, Suite 903, New York, NY 10038, United States. It is responsible for NCB physical and non Hazcheck digital services and natcargo.org/ncb.org.
• NCB Hazcheck Limited: company number 01997397, 3 Trinity Court, Faverdale North, Darlington, County Durham, DL3 0PH, United Kingdom. It is responsible for Hazcheck products and services and the Hazcheck websites.
• NCBI Asia Limited: UEN 202602485W, of 8 Marina Boulevard, #29-01, Marina Bay Financial Centre, Singapore 018981. It handles enquiries and outreach in Asia and may pass an enquiry to National Cargo Bureau Inc. or NCB Hazcheck Limited so that the requested service can be provided.
2. Personal data we collect and where it comes from
Depending on how you deal with us, we may collect:
- your name, business contact details, job title and organisation;
- account information, sign-in records and service preferences;
- purchase, invoice, billing and payment-status information;
- training records, assessment results and certificates;
- information submitted to our services, including cargo, booking, document and support information that may identify the person who submitted it;
- inspection and survey records, including photographs or video where an individual is identifiable;
- technical information such as IP address, browser/device information and website or service usage;
- emails, support tickets, enquiries and other correspondence; and
- if you apply for a role, information in your application such as your CV, work history, qualifications, licences and other information you choose to provide.
We obtain this information from you, from your employer or organisation where it manages your access, from payment providers, automatically when you use our websites or online services, and from information created during the services you ask us to perform.
Our customer-facing services are not designed to collect special category personal data. If we need to process sensitive information for employment, legal or another specific purpose, we will do so only where the law allows and will provide any additional information required.
3. Why we use personal data
We use personal data only where we have a lawful basis. The main purposes and bases are:
| Purpose |
Typical data |
Lawful basis |
| Provide and administer products, services, accounts, training, inspections and surveys |
Contact, account, training, service and inspection data |
Contract where you are the contracting person; otherwise our legitimate interests in providing the service requested by your organisation |
| Process payments and keep financial records |
Contact, transaction and payment-status data |
Contract and legal obligations |
| Answer enquiries and provide support |
Contact and correspondence data |
Contract or our legitimate interests in responding and supporting customers and prospects |
| Operate, secure and improve our websites and services |
Technical, account and support data |
Our legitimate interests in security, reliability and service improvement; consent where required for non-essential cookies or similar technologies |
| Send service and administrative communications |
Contact and account data |
Contract, legitimate interests or legal obligation, depending on the message |
| Send marketing and newsletters |
Contact and marketing-preference data |
Consent where required; otherwise our legitimate interests in business-to-business marketing, subject to applicable direct-marketing rules |
| Handle legal, regulatory, audit, complaint and dispute matters |
Relevant data from the categories above |
Legal obligation and our legitimate interests in establishing, exercising or defending legal rights |
| Recruit people |
Application, contact and recruitment data |
Steps before entering into an employment contract, legal obligations and our legitimate interests in recruitment |
Where we rely on legitimate interests, those interests are the ones described above. We consider whether the use is necessary and whether your interests or rights override ours.
4. Who we share personal data with
We may share personal data with:
- other companies in the NCB group where needed to provide or administer a service;
- service providers that support hosting, IT, email, analytics, customer support and payment processing;
- your employer or organisation where it provides or manages your account or training;
- courts, regulators, law-enforcement bodies or other authorities where required or permitted by law.
Where a supplier processes personal data for us, we require appropriate data-protection terms and security obligations.
5. International transfers
Our group operates in the United Kingdom, United States and Singapore, and some suppliers may process personal data in other countries. Hazcheck is a global business-to-business SaaS service. Customers may access the service from around the world and enter their own data. That customer access does not, by itself, mean that NCB has transferred NCB-controlled personal data to the customer’s country.
Hazcheck application data is primarily hosted in the European Economic Area. Outside the UK and EEA, access by NCB or its suppliers is limited to the personal data needed for account security and access control, such as username, name, email address and IP address. Where this involves an international transfer by NCB, we use the safeguards required by applicable data protection law.
Where UK or EEA personal data is transferred to a country that is not covered by an applicable adequacy decision, we use an approved transfer mechanism where required, such as standard contractual clauses, the UK International Data Transfer Agreement or Addendum, or an applicable data-privacy framework. For transfers from Singapore, we take steps required to ensure a comparable standard of protection. You can contact us for information about the safeguard used for a particular transfer.
6. How long we keep personal data
We keep personal data only for as long as it is needed for the purpose for which it was collected, including legal, accounting, security and dispute requirements. Our main retention periods are:
| Data |
Typical retention |
| Account and customer contact records |
For the life of the account or relationship, then only for the period needed for legal, accounting or claims purposes |
| Authentication and security logs |
Normally 3 months, unless a longer period is necessary for a security investigation or contractually agreed |
| Transaction and invoicing records |
Up to 7 years, or longer where required by law |
| Training and certification records |
For the period agreed with the customer or needed to provide and evidence the training or certification, then deleted or anonymised when no longer required |
| Service content |
For the period configured or agreed with the customer; otherwise for as long as needed to provide the service, then deleted or anonymised when no longer required |
| Inspection or survey imagery and records |
For as long as needed to complete and evidence the inspection or survey, meet contractual or legal requirements, or deal with a related claim |
| Support correspondence |
Normally up to 3 years after closure, longer where needed for a dispute |
| Recruitment applications |
For the recruitment process and for a limited period afterwards where needed for legal or recruitment purposes |
| Marketing suppression records |
As long as reasonably necessary to respect an opt-out |
At the end of the applicable period, we delete the information or anonymise it so that it can no longer identify you.
7. Cookies and similar technologies
Our websites use cookies and similar technologies. We use non-essential cookies or similar technologies only where permitted by law and, where required, after obtaining your consent. The Cookie Notice on the relevant website explains the technologies we use and how to change your choices.
8. Children
Our services are primarily business services and are not directed at children. Where a person under 18 is enrolled in training by an employer or training provider, we use only the personal data needed to deliver and record that training and do not use it for direct marketing.
9. Your privacy rights
Your rights depend on the law that applies to you. In the United Kingdom and EEA, these can include the rights to access, correct, erase or restrict personal data, to receive certain data in a portable format, to object to processing based on legitimate interests or direct marketing, and to withdraw consent where consent is the basis for processing. You may also have rights concerning solely automated significant decisions if we use such processing.
In Singapore, applicable rights include access, correction and withdrawal of consent. Other jurisdictions may provide additional rights where their laws apply.
To exercise a right, contact us using section 11. We may need to verify your identity and will respond within the period required by applicable law.
10. Complaints and regulators
If you have a concern about how we use your personal data, please contact us using section 11. You can also complain to the regulator that applies where you live or where the issue occurred.
- United Kingdom: Information Commissioner’s Office (ICO), ico.org.uk.
- European Economic Area: your local data protection authority.
- Singapore: Personal Data Protection Commission (PDPC), pdpc.gov.sg.
11. Contact us
Mike Durkin, Group Data Protection Officer, support@hazcheck.com, +44 (0)1325 466672, 8 Marina Boulevard, #29-01, Marina Bay Financial Centre, Singapore 018981.
If you contact the wrong NCB company, we will route your request to the company responsible for the relevant processing.
12. Changes to this notice
We may update this notice when our services, suppliers or legal obligations change. The current version and effective date will be published where this notice is made available.
Version: 3.0 Effective date: 2 October 2026 | Last updated: 1 October 2026
