Privacy Policy

1. Who we are

This website, 2n2offshore.com, and the 2N2 brand are operated by Graftr Systems Ltd ("we", "us", "our").

2N2 is a trading name of Graftr Systems Ltd. Graftr Systems Ltd is the data controller responsible for the processing of personal information described in this policy.

Graftr Systems Ltd
Registered in England and Wales, company no. 16960119
46 Priorwood Gardens,
Ingleby Barwick,
Stockton-on-Tees,
TS17 0XH,
United Kingdom

Email: martin@2n2offshore.com

2. What this policy covers

This policy covers the 2N2 informational website and the 2N2 mobile application for offshore contractors. It also covers 2N2 Recruit, the separate web application recruitment agencies use.

Sections 3 to 15 describe the website. Section 16 describes the mobile application and 2N2 Recruit in full — what they collect, why, the lawful basis, who it is shared with, how long it is kept, and how to delete it.

3. Information we may receive

The website has no accounts, no sign-up, no forms and no mailing list. There are only two ways we may receive information about you.

If you contact us

If you email martin@2n2offshore.com, we may process:

• your name;
• your email address;
• the contents of your message;
• any other information you choose to provide.

We use this to respond to your enquiry and to manage ordinary business correspondence.

Technical information generated when you visit

Like effectively all websites, this site is delivered by hosting infrastructure that automatically records limited technical information with each request. This typically includes:

• IP address;
• browser and device information;
• details of the page or file requested, and the date and time;
• security and error logs.

This is generated by the infrastructure itself as a necessary part of delivering and securing the website. We do not use it to profile, track or identify individual visitors, and we do not combine it with anything else.

4. What we do not do

This website does not:

• use analytics or website measurement tools;
• use advertising, marketing or behavioural tracking;
• set advertising, marketing or analytics cookies;
• offer accounts, logins or authentication;
• collect email addresses or operate a mailing list;
• process payments;
• sell or rent personal information.

We have deliberately not added third-party analytics or tracking tools to this site.

5. Cookies

This website sets no cookies — none for advertising, none for analytics, and none that are technically necessary. Because no cookies requiring consent are used, no cookie banner is shown.

If this ever changes, this policy will be updated and — where the law requires it — your consent will be sought before any such technology is enabled.

6. How we use information

Where we do hold personal information, we may use it to:

• respond to enquiries and communicate with people who contact us;
• operate, maintain and secure the website;
• keep proper business records;
• comply with our legal obligations;
• establish, exercise or defend legal rights, where necessary.

7. Lawful bases under UK GDPR

We rely on the following lawful bases, depending on the circumstances:

• Legitimate interests (Article 6(1)(f)) — responding to enquiries about our business and products, operating and securing the website, and keeping business records. Our interest is in running and protecting a legitimate business; we consider this does not override your rights, given how little information is involved.
• Steps taken at your request before entering into a contract (Article 6(1)(b)) — where your enquiry concerns a possible working relationship or agreement.
• Compliance with a legal obligation (Article 6(1)(c)) — where the law requires us to retain or disclose information.

We do not currently rely on consent, because we do not operate any consent-based processing such as marketing emails or analytics cookies. If that changes, we will ask for consent properly and you will be able to withdraw it.

8. Sharing information

We do not sell personal information.

Information may be handled by trusted providers and advisers where necessary to operate our website and business, namely:

• website hosting and infrastructure providers;
• domain registration and DNS providers;
• business email providers;
• professional advisers, such as legal or accounting advisers, where genuinely required;
• public authorities, where disclosure is required by law.

Providers acting on our behalf do so under contract and are not permitted to use the information for their own purposes. If you would like to know which specific providers we use, email us and we will tell you.

9. International processing

Some of our service providers operate infrastructure outside the United Kingdom. Where personal information is transferred outside the UK, we rely on a safeguard recognised under UK data protection law — such as UK adequacy regulations, or the International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses.

In practice the volume of personal information involved in this website is very small: correspondence you send us, and routine server logs.

10. Data retention

We keep personal information only for as long as reasonably necessary for the purpose it was provided, including any legal, accounting or record-keeping requirements that apply.

Email correspondence is kept for as long as needed to deal with the matter it concerns and to maintain proper business records, then deleted. Technical server logs are retained only for the limited period applied by our hosting provider for security and diagnostic purposes.

11. Security

We use reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse or alteration. The website is served only over HTTPS, and access to our business email is protected by appropriate account security.

No website, system or method of transmission is completely secure, and we cannot guarantee absolute security. We do not claim otherwise.

12. Your rights

Under UK data protection law you have rights in relation to your personal information, including the right to:

• request access to the information we hold about you;
• have inaccurate information corrected;
• request erasure of your information;
• request that we restrict how we use it;
• object to processing carried out on the basis of legitimate interests;
• request portability of information you provided to us;
• rights in relation to automated decision-making and profiling.

These rights do not all apply in every situation — they depend on the circumstances and on the lawful basis we are relying on. We do not carry out automated decision-making or profiling.

To exercise any of these rights, email martin@2n2offshore.com. We will respond within the time limits set by law.

13. Complaints

If you are unhappy with how we have handled your personal information, please contact us first so we can try to put it right.

You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk.

14. Children

This website, and the offshore contractor service we are building, are aimed at working professionals and businesses in the offshore sector. They are not directed at children, and we do not knowingly seek or collect personal information relating to children through this website.

15. Links to other websites

This website may contain links to third-party websites. We do not control those websites and are not responsible for their content or their privacy practices. Their own privacy policies govern any information you provide to them, and we would encourage you to read them.

16. The 2N2 mobile application and 2N2 Recruit

2N2 is a mobile application for offshore contractors. 2N2 Recruit is a separate web application used by recruitment agencies. They share one database, so this section covers both.

Creating an account is free, and we take no payments of any kind through either application.

What we collect — Contractors

Your name, date of birth, phone number, postcode, and an optional profile photo. Your job roles, certificates (name and expiry date only), work history derived from your calendar, and your stated availability. Any CV you upload and the data our AI extraction produces from it. Calendar and work records, invoices and expenses you create, daily and shift log entries and any photos you attach, travel booking references, messages you send through the Platform, and any report you file or that is filed against you.

If you use the optional fitness features, workout data is exchanged with a third-party fitness API rather than stored by us. Progress entries you log — weight, waist measurement, an optional photo — are stored by us.

What we collect — Recruiters

Your name, company name and work email, the searches you run, contractors you favourite or add to a network, job opportunities you create, your messages, and any report you file or that is filed against you.

Device permissions the app uses

Each of these is optional. The app asks the first time it needs one, and declining leaves that single feature unavailable rather than breaking the app.

• Location — read only while you have the weather map open, to centre it on where you are. Not tracked in the background, not stored on our servers, not shared with anyone.
• Motion and step data — read from your phone’s motion sensor for the activity-tracking feature. Step counts you record are stored with your account. This is fitness data, not health-record data, and it is never shared with recruiters.
• Camera and photo library — used when you attach a photo to a job, log a receipt against an invoice, set a profile picture, or scan a QR code to join a recruiter’s network. QR scanning reads the code only and keeps no image.
• Notifications — if you turn them on, we store a device token so we can send them. Turning them off in your phone’s settings stops this.

Bank details on your invoices

If you enter bank details for your invoice footer — sort code and account number, or IBAN and SWIFT for work paid in another currency — we store them so they appear on the invoices you generate. They are your own details, used only to produce your own invoice documents. We never share them with recruiters or anyone else, and no money moves through the Platform.

Special category data

Some offshore certificates are medical certificates, and recording that you hold one may itself indicate something about your health, which UK data protection law treats as special category data. We record only the certificate’s name and expiry date, never the medical detail behind it. We do not knowingly collect biometric data, criminal conviction data, or equality and diversity data anywhere in the Platform.

Recruitment processing, and what recruiters can see

A recruiter can only see a contractor through one of three routes, each of which the contractor controls: the public “visible to recruiters” setting is turned on; the contractor has joined that specific agency’s private network using its invite code; or there is already an open message thread between them.

Recruiters see role, certificates and availability — never private calendar detail, invoices, expenses or financial records. Turning visibility off removes a contractor from search. We do not sell profiles. We are not ourselves an employment agency: we do not place anyone, and any engagement is agreed directly between contractor and recruiter.

Lawful bases under UK GDPR

• Contract — operating your account and providing the features you ask for.
• Legitimate interests — keeping the Platform secure, investigating reports of abuse, and preventing misuse.
• Consent — device permissions, notifications, the optional fitness features, and recruiter visibility. Each can be withdrawn at any time in the app.
• Legal obligation — where we are required to keep a record.

Who we share it with

Supabase, for the database, authentication and file storage. An AI provider for CV extraction, which receives only the text content of a CV you upload. A weather data provider, which receives coordinates only and no personal data. Your Move, a third-party fitness API, for the optional fitness features. Recruiters see only what is described under “Recruitment processing” above. We do not sell personal data, and we do not use it for advertising or for tracking you across other companies’ apps or websites.

How long we keep it, and deleting your account

We keep your data while your account is active. You can delete your account from inside the app at any time — Settings, then Privacy. Deleting it permanently removes your profile, certificates, calendar, messages, uploaded CV and photos. We keep a limited record where we are required to for legal, safety or dispute-resolution reasons — for example that a report was made and how it was resolved — with your profile no longer attached once the account is gone.

Your rights

You can access the data we hold about you, have inaccurate data corrected, have your data erased (you can do this yourself at any time by deleting your account), object to or restrict certain processing, and receive your data in a portable format. Contact martin@2n2offshore.com to exercise any of these. You can also complain to the Information Commissioner’s Office at ico.org.uk.

Automated decision-making, and children

We do not make automated decisions that produce legal or similarly significant effects. CV extraction produces a draft that you review and confirm before anything is saved. The Platform is for adults working offshore: you must be 18 or over to create an account, and we do not knowingly collect data from children.

17. Changes to this policy

We may update this policy as 2N2 develops, or as legal or technical requirements change — in particular when the mobile application launches. The "last updated" date at the top of this page shows when it was last revised.

18. Contact

For any question about this policy, or about how we handle personal information:

Graftr Systems Ltd
46 Priorwood Gardens,
Ingleby Barwick,
Stockton-on-Tees,
TS17 0XH,
United Kingdom

martin@2n2offshore.com