Privacy Policy
Last updated: September 2026
1. Roles: Controller and Processor
When SOS Global is used by an employer/client organisation, that organisation is the data controller for its staff's personal data (it decides who is enrolled, what roles they hold, and how the platform is configured). RHOC Holdings Limited acts as data processor, processing personal data only on the client organisation's instructions and only to provide the service. Individual staff with questions about how their data is used should contact their own organisation's administrator in the first instance.
2. Information Processed
Account and profile data (name, email, role); organisation membership, seat and role assignment; check-in status and timestamps; live location, only while a user has actively chosen to share it, and visible only to that organisation's authorised admins; medical/emergency profile details a user chooses to enter (e.g. allergies, conditions, emergency contacts, next of kin); SOS alert data (location, what3words, timestamp, status, acknowledgement/resolution history); incident records; trip and briefing acknowledgements; and team chat messages within the organisation's workspace.
3. How the Data Is Used
Solely to provide the service to the client organisation: routing alerts and notifications, displaying dashboards to authorised admins, and producing exportable records for the client's own compliance/audit purposes (e.g. ISO 31030). Data is never used for advertising, never sold, and never used for any purpose beyond providing and improving the service.
4. Legal Basis
Processing is carried out in performance of the contract with the client organisation and RHOC Holdings Limited's legitimate interests in providing and maintaining the platform; optional features such as live location sharing operate on the individual user's own consent, which they can withdraw at any time by switching sharing off.
5. Subprocessors and Third Parties
RHOC Holdings Limited uses the following categories of subprocessor to operate SOS Global: SMS delivery (GatewayAPI); email delivery (AWS SES); mapping and geocoding (Google Maps Platform); location reference (what3words); and cloud hosting/database infrastructure (Supabase). A current list of subprocessors is available on request. Subprocessors are bound by confidentiality and data protection obligations no less protective than those in this policy, and material changes to this list will be notified to client organisations.
6. International Transfers
Because SOS Global supports staff and organisations operating across many countries, personal data may be processed in countries other than where the individual is located. Appropriate safeguards (such as standard contractual clauses, where applicable) are used for any such transfers.
7. Data Retention
SOS alert, incident, check-in and briefing-acknowledgement records are retained for the period needed to support the client organisation's audit, compliance and legal obligations, or as agreed with the client organisation. Location shares are not retained beyond what is needed for the live sharing feature to function and for the incident record it relates to. When a staff member's seat is released, their access is revoked; data tied to compliance records (e.g. past incidents) may be retained per the client organisation's instructions.
8. Rights of Individuals
Staff members can request access to, correction of, or deletion of their personal data by contacting their organisation's administrator, who can action most requests directly in the platform; RHOC Holdings Limited will assist the client organisation in fulfilling such requests where needed.
9. Location Data
Location sharing is off by default and controlled entirely by the individual user; when enabled, it is visible only to their own organisation's authorised admins, not to RHOC Holdings Limited for any other purpose, and not to other organisations.
10. Security
Industry-standard technical and organisational measures are used to protect personal data; no method of storage or transmission is completely secure, and no guarantee of absolute security can be given.
11. Children's Privacy
SOS Global is a workforce platform intended for use by employed adults and is not directed at or intended for use by children.
12. Changes to This Policy
This policy may be updated from time to time; material changes will be notified to client organisations.
13. Contact
RHOC Holdings Limited, hello@rhocholdings.com.