Last updated: [DATE]
Controller: New Era Site Solutions Ltd, [REGISTERED ADDRESS] (company no. [COMPANY NUMBER]). Contact for privacy matters: support@newerasitesolutions.co.uk. ICO registration number: [NUMBER].
Customer/admin data: name, email, company name, site names, hashed password, and subscription details. Card payments are handled by Stripe – we never see or store card numbers.
Operator data: operator names or labels and access keys.
Check data: inspection answers, defect and delivery reports, notes, photos, signatures/names entered, equipment IDs, timestamps, and the generated PDFs.
Branding: company logo you upload.
To provide the service you have bought (contract), to send weekly reports and service emails (contract), to take payment and keep financial records (legal obligation), and to keep the service secure and improve it (legitimate interests).
Service providers that run the service on our behalf: Cloudflare (hosting, database and file storage), Stripe (payments), and Resend (email delivery). We do not sell personal data.
Data is stored with Cloudflare, which may process data outside the UK under appropriate safeguards.
Check, defect and delivery reports and PDFs are automatically deleted after 28 days [UPDATE IF CHANGED]. Account and billing records are kept while your account is active and as required for tax and legal purposes. Data may be deleted after cancellation.
The apps store small items in your browser’s local storage only to make the service work: login token, operator key, and the last site name you entered. No advertising or tracking cookies are used.
Under UK GDPR you can ask to access, correct, delete, restrict or export your personal data, or object to its use. Email us at the address above. You can also complain to the Information Commissioner’s Office (ico.org.uk).
Where you enter personal data about your operators or staff, you are the controller of that data and we act as your processor. [CONSIDER A SEPARATE DATA PROCESSING AGREEMENT FOR LARGER CUSTOMERS]
Passwords are hashed, traffic is encrypted, and access is restricted by login or operator key. No system is perfectly secure; we will notify you and the ICO of serious breaches as required.
Draft: this policy should be checked by a solicitor or data-protection adviser before reliance.