Privacy Policy

1. Purpose and legal basis

Your data is collected solely for the purposes of site access, safety compliance, induction, RAMS acceptance, and legal health & safety obligations. It is not used for marketing or profiling. We process your data under the legal basis of contractual necessity and legal obligation (health and safety compliance in the construction sector).

2. What data we collect

• Personal details: name, email, phone, address (optional if required by contractor)
• National Insurance Number (optional)
• Emergency contact details
• Right to work documents (passport/visa expiry and file; passport number not stored)
• Medical information (optional; allergies, medication, medical certificates)
• Certifications and training records
• RAMS acceptance records
• Induction and site access records

3. Why we collect it

Data is used solely for site access management, safety compliance, pre-induction and site induction, RAMS acceptance tracking, and legal health & safety obligations. We do not use your data for marketing or profiling.

4. Who can see your data

Access is limited to: your employer (subcontractor or main contractor), site supervisors and main contractor admins for compliance purposes, and authorised administrators. Sensitive fields (NI number, medical notes, passport-related data) are restricted to yourself and admins only.

5. How long we keep your data

• Induction records: 3 years
• RAMS acceptance: 6 years
• Training records: 3 years
• Accident/incident records: 6 years
• Pre-Induction Profile: 3 years after last activity
• Deleted user accounts: purged after 90 days

6. Your rights

• Right to Access: Download a copy of your data from Profile → Privacy & Data.
• Right to Rectification: Edit name, phone, address, emergency contact in your profile.
• Right to Erasure: Request account deletion. Legally required H&S records will be retained.
• Right to Restrict Processing: Toggle "Restrict non-essential processing" so only admins can view sensitive fields.

7. How to request deletion

Log in → Dashboard → Profile → Privacy & Data tab → "Delete My Account". You can also contact your Data Protection Officer (see below). Deletion will anonymise your account; induction, RAMS and training records are retained for legal compliance.

8. How we secure your data

We use HTTPS for all traffic, Supabase RLS and server-side validation for access control, and audit logging for verification and sensitive data access. Session timeout is 12 hours of inactivity.

9. Contact — Data Protection

For privacy queries or to exercise your rights, contact your company's data protection officer or the Construction Runner administrator. Include your email and a description of your request.