Privacy Policy

1. Who We Are

ScopeKit is a UK-based software company providing intelligent construction quote generation and project management services. We are the data controller for the personal data described in this policy.

2. Data We Collect

We collect different types of personal data depending on how you interact with our services. The table below summarises the categories of data we process:

Special Category Data

We may process limited special category data including:

• National Insurance Numbers

  Processed for employee payroll and tax compliance under legal obligation

• Location Data (GPS)

  Point-in-time collection at check-in/check-out only (not continuous tracking). Requires explicit consent from each individual employee via the app, not just employer opt-in. Precise coordinates are retained for 30 days, then aggregated to area level. Can be disabled at any time in individual user settings.

3. How We Use Your Data

We use your personal data for the following purposes:

• Service Delivery

  Processing quotes, managing projects, workforce scheduling

• Account Management

  Creating accounts, authentication, password resets

• Communication

  Sending quotes, project updates, support responses

• Billing & Payments

  Processing subscriptions, invoicing, payment collection

• Legal Compliance

  Tax records, employment law, CDM 2015 regulations

• Security

  Fraud prevention, audit logging, access monitoring

• Service Improvement

  Analytics, feature development, performance monitoring

• AI Model Improvement

  Using anonymised and aggregated data to improve our AI systems. Identifiable data is never used for AI training without explicit consent. You may opt out by contacting us.

• Preparing for your enquiry

  When you ask for a demo or a callback, we look up your business from public sources such as Companies House, your website and published reviews, so our first call is useful. We keep only business information, never personal social media or home addresses.

4. Lawful Basis for Processing

Under the UK GDPR (as amended by the Data Use and Access Act 2025), we process your data based on the following lawful bases:

5. Data Retention

We retain personal data only as long as necessary for the purposes outlined above, or as required by law. Our standard retention periods are:

6. Data Sharing & Third Parties

We share your data with trusted third-party service providers who assist in delivering our services. All processors are bound by Data Processing Agreements and appropriate safeguards.

We may also share data with:

• Legal authorities

  When required by law or to protect our legal rights

• Professional advisers

  Accountants, lawyers, and auditors under confidentiality agreements

• Business transfers

  In the event of a merger, acquisition, or sale of assets (with notice)

6A. Data Breach Notification

In the event of a personal data breach, we will:

• Notify the ICO

  Where required, we will notify the Information Commissioner's Office within 72 hours of becoming aware of a breach that is likely to result in a risk to individuals' rights and freedoms.

• Notify Affected Individuals

  Where a breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay via email and in-app notification.

• Breach Notification Content

  Notifications will include: the nature of the breach, categories of data affected, likely consequences, measures taken to address the breach, and contact details for further information.

• Organisation Notification

  If you are an Organisation using our Service as a data controller, we will notify your designated contact within 48 hours of confirming a breach affecting your data, as detailed in our Data Processing Agreement.

7. International Transfers

Your data is stored in the United Kingdom (London, eu-west-2). Both our application infrastructure and the search index that holds your records run in that one region; nothing is stored in the EU or the United States at rest. The one exception is recordings and transcripts of calls on our company phone line, which our telephony provider may hold in the European Union (see section 12). When we transfer data outside the UK/EEA, we ensure appropriate safeguards are in place:

• UK Adequacy Decisions

  Transfers to countries deemed adequate by the UK Secretary of State

• Standard Contractual Clauses (SCCs)

  UK-approved contractual safeguards for international transfers

• EU-US Data Privacy Framework

  For transfers to certified US organisations

8. Your Rights

Under the UK GDPR (as amended by the Data Use and Access Act 2025), you have the following rights regarding your personal data:

9. Cookies

We use cookies and similar technologies to enhance your experience. For detailed information about the cookies we use, please see our Cookie Policy.

You can manage your cookie preferences at any time through our cookie banner or in your browser settings.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data:

• Encryption of data in transit (TLS 1.3) and at rest (AES-256)
• Multi-factor authentication available for all accounts
• Regular security audits and penetration testing
• Role-based access controls with audit logging
• Automatic virus scanning of all uploaded files
• Secure cloud infrastructure with ISO 27001 certified providers
• Staff training on data protection and security
• Incident response procedures and breach notification processes

11. Children's Privacy

Our services are designed for business use and are not intended for individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

12. Calls and Call Recording

Calls to and from our company phone line may be recorded, transcribed and analysed. Every call on that line starts with a short announcement saying so, before the conversation begins. This section explains what we record, why, and the choices you have.

• What we record

  The audio of the call, call details such as the numbers, date, time and length of the call, and an automatic transcript of what was said.

• Why we record

  To train our team, to check and improve the quality of our calls, and to have an accurate record if there is ever a disagreement about what was said or agreed.

• Automatic analysis

  We analyse transcripts automatically, using AI, to draw out notes such as what you need, any concerns you raised and the next steps we agreed, so our follow-up reflects the conversation. These notes may help us decide who to contact next, but a person always makes that decision. We do not analyse your voice, tone or emotions, and we do not use recordings to identify you by your voice.

• Lawful basis

  Our legitimate interests in training, quality, keeping accurate records and following up on enquiries (Article 6(1)(f)). We have assessed these interests against your rights and expectations, and the announcement at the start of each call is part of how we meet them.

• How long we keep it

  Call recordings and transcripts are deleted after 6 months. The notes drawn from a call are kept with your enquiry or customer record, for as long as we keep that record.

Who processes call data for us

• A cloud telephony provider, which carries, records and stores our calls and produces transcripts, with call data held in the UK or the European Union
• Our cloud hosting providers, which store transcripts and call notes in the United Kingdom
• An AI provider, which analyses transcript text to produce call notes and does not use it to train its models. This may involve a transfer outside the UK, protected as described in section 7

13. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. We will notify you of significant changes by email or through a prominent notice on our website. We encourage you to review this policy periodically.

14. Contact Us

If you have questions about this privacy policy or wish to exercise your data protection rights, please contact us: