Privacy Policy

1. Who we are and our role

Siteviro ("we", "us") provides an online platform for construction site inspections and registers. Contact: privacy@siteviro.co.uk.

Controller: we are the controller for account holders' sign-up details, billing information and website usage.

Processor: when a company uses Siteviro to record inspections, signatures, photos and information about its workers, that company is the controller and we process that data on its behalf under our Data Processing Agreement. Requests about that data should go to the company first; we will help them respond.

2. Data we collect

• Account data: name, email address, password (stored hashed), company name, profile picture, company memberships and roles.
• Register content: inspection results, equipment and plant details, site names, dates, notes, fault descriptions, signatures, photos, toolbox talk attendance, HAVS tool-use exposure records and daily site reports.
• Operative link submissions: name, signature and check answers entered through share links without an account.
• Billing data: subscription status and usage. Card details are handled by our payment provider and are not stored by us.
• Technical data: sign-in session information, IP address and browser details in security and server logs.

HAVS exposure records relate to workers' health and safety. Companies are responsible for having a lawful basis for recording them (normally their legal duties under the Control of Vibration at Work Regulations 2005).

3. Why we use it and our lawful basis

We do not sell personal data, use it for advertising, or make decisions about you based solely on automated processing.

4. Who we share it with

We use trusted service providers (sub-processors) for hosting, database and file storage, email delivery and payments. They act only on our instructions under written contracts. We may also disclose data where required by law.

Where a provider processes data outside the UK, we rely on safeguards recognised under UK law, such as UK adequacy regulations or the International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses.

5. How long we keep it

• Register records are kept for as long as the company keeps its account, so it can meet its own record-keeping duties. Records older than three months move to the Archive but are not deleted.
• When a company closes its account, its data is deleted within 90 days unless the law requires us to keep it longer.
• Billing records are kept for six years for tax purposes.
• Security logs are kept for a short period, normally no more than 90 days.

6. Your rights

You have the right to access your data, correct it, ask for it to be erased, restrict or object to its use, and receive it in a portable format. Where we rely on consent you can withdraw it at any time. To use any of these rights, email privacy@siteviro.co.uk. We will respond within one month.

You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to resolve your concern first.

7. Security

Access to company data is limited by company membership, site assignment and role permissions. Passwords are never stored in plain text. If a personal data breach occurs that is likely to put people at risk, we will notify affected companies without undue delay and the ICO where required.

8. Cookies

See our Cookie Policy.

9. Children

Siteviro is a business service and is not intended for anyone under 16.

10. Changes

We will post updates on this page and tell account owners by email about significant changes.