Privacy Policy

1. Who We Are

ScopeKit is a UK-based software company providing intelligent construction quote generation and project management services. We are the data controller for the personal data described in this policy.

2. Data We Collect

We collect different types of personal data depending on how you interact with our services. The table below summarises the categories of data we process:

Special Category Data

We may process limited special category data including:

• National Insurance Numbers

  Processed for employee payroll and tax compliance under legal obligation

• Location Data (GPS)

  Point-in-time collection at check-in/check-out only (not continuous tracking). Requires explicit consent from each individual employee via the app, not just employer opt-in. Precise coordinates are retained for 30 days, then aggregated to area level. Can be disabled at any time in individual user settings.

3. How We Use Your Data

We use your personal data for the following purposes:

• Service Delivery

  Processing quotes, managing projects, workforce scheduling

• Account Management

  Creating accounts, authentication, password resets

• Communication

  Sending quotes, project updates, support responses

• Billing & Payments

  Processing subscriptions, invoicing, payment collection

• Legal Compliance

  Tax records, employment law, CDM 2015 regulations

• Security

  Fraud prevention, audit logging, access monitoring

• Service Improvement

  Analytics, feature development, performance monitoring

• AI Model Improvement

  Using anonymised and aggregated data to improve our AI systems. Identifiable data is never used for AI training without explicit consent. You may opt out by contacting us.

4. Lawful Basis for Processing

Under the UK GDPR (as amended by the Data Use and Access Act 2025), we process your data based on the following lawful bases:

5. Data Retention

We retain personal data only as long as necessary for the purposes outlined above, or as required by law. Our standard retention periods are:

6. Data Sharing & Third Parties

We share your data with trusted third-party service providers who assist in delivering our services. All processors are bound by Data Processing Agreements and appropriate safeguards.

We may also share data with:

• Legal authorities

  When required by law or to protect our legal rights

• Professional advisers

  Accountants, lawyers, and auditors under confidentiality agreements

• Business transfers

  In the event of a merger, acquisition, or sale of assets (with notice)

6A. Data Breach Notification

In the event of a personal data breach, we will:

• Notify the ICO

  Where required, we will notify the Information Commissioner's Office within 72 hours of becoming aware of a breach that is likely to result in a risk to individuals' rights and freedoms.

• Notify Affected Individuals

  Where a breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay via email and in-app notification.

• Breach Notification Content

  Notifications will include: the nature of the breach, categories of data affected, likely consequences, measures taken to address the breach, and contact details for further information.

• Organisation Notification

  If you are an Organisation using our Service as a data controller, we will notify your designated contact within 48 hours of confirming a breach affecting your data, as detailed in our Data Processing Agreement.

7. International Transfers

Your data is primarily stored and processed within the UK and European Economic Area (EEA). When we transfer data outside the UK/EEA, we ensure appropriate safeguards are in place:

• UK Adequacy Decisions

  Transfers to countries deemed adequate by the UK Secretary of State

• Standard Contractual Clauses (SCCs)

  UK-approved contractual safeguards for international transfers

• EU-US Data Privacy Framework

  For transfers to certified US organisations

8. Your Rights

Under the UK GDPR (as amended by the Data Use and Access Act 2025), you have the following rights regarding your personal data:

9. Cookies

We use cookies and similar technologies to enhance your experience. For detailed information about the cookies we use, please see our Cookie Policy.

You can manage your cookie preferences at any time through our cookie banner or in your browser settings.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data:

• Encryption of data in transit (TLS 1.3) and at rest (AES-256)
• Multi-factor authentication available for all accounts
• Regular security audits and penetration testing
• Role-based access controls with audit logging
• Automatic virus scanning of all uploaded files
• Secure cloud infrastructure with ISO 27001 certified providers
• Staff training on data protection and security
• Incident response procedures and breach notification processes

11. Children's Privacy

Our services are designed for business use and are not intended for individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

12. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. We will notify you of significant changes by email or through a prominent notice on our website. We encourage you to review this policy periodically.

13. Contact Us

If you have questions about this privacy policy or wish to exercise your data protection rights, please contact us: