1. Introduction

Scopey Onsite (“Scopey”, “we”, “us”, “our”) provides a software platform that helps construction companies capture, organise, and process project information submitted by site teams. This Privacy Policy explains how we collect, use, store, and protect personal data when you use our website, platform, or services. We are committed to handling personal data responsibly and in accordance with applicable data protection laws, including the EU General Data Protection Regulation (GDPR).

Anonymised data means data processed so that individuals, organisations, and projects cannot be identified and cannot reasonably be re-identified.

2. Who we are

Scopey Limited is the data controller for personal data processed under this Privacy Policy, except where we act as a processor on behalf of our customers.

‍Contact: privacy@scopeyonsite.com
‍You have the right to make a complaint to your local data protection authority if you believe your personal data has been processed unlawfully. We would, however, appreciate the opportunity to address your concerns directly before you approach a regulator.

3. Who this policy applies to

This policy applies to:
• Users of the Scopey platform (including customer administrators and authorised users)
• Individuals whose information is submitted to Scopey through customer use of the platform
• Visitors to our website

Most personal data processed through the platform relates to individuals acting in a professional capacity.

Where Scopey processes personal data submitted through the platform on behalf of customers, the customer is responsible for ensuring they have the appropriate rights and lawful basis to provide that data to Scopey.

Where Scopey processes personal data on behalf of customers, that processing is governed by a Data Processing Agreement incorporated into the applicable customer contract. The Data Processing Agreement defines the subject matter, duration, nature, and purpose of processing, and the obligations of each party.

The platform is designed to capture operational construction project information, which may include commercially sensitive material submitted by customers as part of their normal business activities

4. Personal data we collect

4.1 Platform data

When customers use the Scopey platform, we may process:
• Names, roles, and contact details of authorised users
• Messages, photos, documents, voice notes, and other project records  submitted to the Scopey platform
• Timestamps and operational metadata associated with submissions
• Usage and interaction data within the platform (e.g. feature usage, navigation, actions taken)

Scopey processes only content that is intentionally submitted to the Scopey service. We do not access private WhatsApp conversations or accounts outside of submissions intended for Scopey.

Scopey typically processes platform content on behalf of the customer as a data processor.

4.2 Website data

When you visit our website, we may collect:
• Device and browser information
• IP address (anonymised where possible)
• Website usage data through analytics tools

Website analytics are used only where consent is provided via our cookie controls.

4.3 Account, billing, and communications data

We may also collect:
• Contact and account information for customer administration
• Billing and payment-related information
• Communications with us (support, enquiries, sales)

Project content submitted to the platform is not exported into our CRM or accounting systems.

5. How we use personal data

We use personal data to:
• Provide, operate, and support the Scopey platform
• Process and organise information submitted by customers
• Maintain platform security and integrity
• Monitor system performance and improve functionality
• Provide customer support and respond to enquiries
• Manage customer relationships, billing, and accounting
• Meet legal, regulatory, and contractual obligations

‍Automated processing and AI
‍Scopey uses automated systems, including AI-assisted processing, to help classify, organise, and analyse information submitted to the platform.

These processes support operational workflows and do not involve automated decision-making with legal or similarly significant effects on individuals.

6. Lawful basis for processing

We process personal data under the following lawful bases:
‍Performance of a contract – where processing is necessary to provide the service
‍Legitimate interests – to operate, secure, and improve the platform
‍Legal obligations – where required by law
‍Consent – where required (e.g. website analytics cookies)

7. Data retention

Platform data is retained for the duration of the customer contract and for a reasonable period after termination (typically up to 12 months), unless the customer requests earlier deletion or a longer retention period is required for contractual, legal, audit, or dispute-resolution purposes.

Data may be deleted earlier upon request, subject to these requirements.Website analytics data is retained in accordance with analytics provider settings and consent controls.

8. Data sharing and third-party processors

We may share personal data with trusted third-party service providers that support the operation of our services, including cloud hosting, analytics, customer management, and business support tools. These providers process personal data only on our instructions and are subject to appropriate confidentiality and data protection obligations.

We do not sell personal data and do not share identifiable platform or project data for third-party marketing or advertising purposes.

‍Anonymised and aggregated data
‍We may create and use anonymised or aggregated data derived from use of the platform, such as usage metrics, feature adoption, and performance insights. This data does not identify any individual, organisation, or project and is not personal data under applicable data protection laws.

We may use anonymised or aggregated data for product improvement, analytics, benchmarking, research, automated processing improvements, and marketing or promotional purposes.

‍Customer-approved marketing
‍Where customer consent or instruction is provided, we may use limited platform or project data for approved marketing activities such as case studies or testimonials.

Any such use will comply with applicable data protection laws and agreed contractual terms.

We maintain a current list of authorised sub-processors used to support the Scopey platform (such as cloud hosting, messaging integrations, analytics, and support tools). This list is available to customers on request and is updated when material changes occur.

9. Data location and international transfers

Application and platform data is hosted on secure cloud infrastructure located within the European Union.

Where personal data is transferred outside the European Economic Area, Scopey relies on approved transfer safeguards such as the European Commission Standard Contractual Clauses or equivalent mechanisms. A copy of the relevant safeguards can be requested.

10. Security

We implement appropriate technical and organisational measures to protect personal data, including:
• Encryption in transit and at rest
• Access controls and authentication
• Segregation of environments
• Regular security reviews

Our security practices align with recognised information security standards, and we maintain an internal Information Security Policy to support ongoing improvement.

These measures include logging and monitoring, controlled administrative access, secure backup and recovery procedures, and periodic review of security controls.

11. Your rights

Where GDPR applies, individuals have rights including:
• Access to their personal data
• Correction of inaccurate data
• Erasure, in certain circumstances
• Restriction or objection to processing
• Data portability

Requests can be made by contacting us using the details above.
We may need to verify your identity before responding to a request and will respond within applicable statutory timeframes.

12. Cookies and analytics

We use cookies and similar technologies on our website to:
• Understand website usage
• Improve performance and content

Analytics cookies are used only with consent, which can be managed through our cookie banner and settings.

13. Changes to this policy

We may update this Privacy Policy from time to time. The current version will always be available on our website.

Continued use of the Scopey Onsite website or services after an update indicates awareness of the updated Privacy Policy.