Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

If you have questions about how we handle your data or wish to exercise your rights, contact us at privacy@construct365.com.

2. Information We Collect

2.1 Information You Provide Directly

• Account Information: Username, email address, password (stored as a one-way hash — we cannot read it)
• Profile Information: Company details, contact information, business registration numbers
• Profile Claim Data: Your name, role, phone number, and email when claiming a company profile
• Bulletin Board Posts: Details submitted in work wanted / work offered notices including qualifications and availability
• Newsletter Subscriptions: Email address and subscription preferences
• RFQ Submissions: Project details, trade type, location, contact information when requesting quotes
• Price a Job (Schedule & BOQ Builder): Job descriptions, uploaded scope documents or photos, job postcode, schedule and bill-of-quantities line items, and the supplier email addresses you choose to send packages to. Drafts can be built without an account; an account (and therefore an email address) is required only when you send a package. Suppliers who respond provide their rates, totals and exclusion notes, which are shared only with the requester of that package — never with other suppliers
• Event Submissions: Event details and your name and email when submitting events for review
• Payment Information: Billing name and address; card details are processed directly by Stripe — we never see or store your card number
• Communications: Messages, enquiries, and support requests sent to us

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, time spent on the platform, click patterns
• Device and Technical Information: Browser type, operating system, screen resolution, device identifiers
• Log Data: IP address, access times, pages requested, error logs, referring URLs
• Cookies and Tracking Technologies: As described in our Cookie Policy

2.3 Information From Third Parties

• Companies House: Public company registration data (company name, address, SIC codes, directors, filing history) — this is Crown copyright public domain data. Where this includes personal data about individuals (such as named directors and officers), we process it on the basis of our legitimate interests in operating a UK construction industry directory (see Section 3). You can object to this processing or ask for the data to be corrected or removed — see Section 9 (Your Rights) and the "correct or remove this listing" link on each company profile page. Where Companies House suppresses an individual's residential address or other details from the public register, we honour that suppression: we only display what Companies House itself makes publicly available, and we will remove any suppressed details on request
• Stripe: Payment confirmation and transaction status (not card details)
• Google Analytics: Aggregated and anonymised website usage statistics (where you have consented to analytics cookies)

3. Legal Basis for Processing

Under UK GDPR and DPA 2018, we must have a lawful basis for processing your personal data. The bases we rely on are:

4. How We Use Your Information

• Service Delivery: Account management, processing payments, delivering subscriptions and services you have purchased
• Directory Services: Displaying company listings, managing profile claims, and maintaining league tables
• Bulletin Board: Reviewing, approving, and publishing work notices; notifying you about responses
• RFQ Matching: Sharing your project enquiry with up to 3 contractors from our directory that hold a paid Featured listing and match your chosen trade type and area
• Communication: Sending service notifications, security alerts, and transactional emails. Marketing emails and newsletters only where you have consented under PECR
• Platform Improvement: Analysing usage patterns to develop new features and improve user experience
• Security: Fraud prevention, detecting malicious activity, and protecting the integrity of our platform
• Legal Compliance: Meeting statutory record-keeping requirements, responding to court orders or regulatory requests

5. Data Sharing and Disclosure

5.1 Service Providers (Data Processors)

We share data with carefully selected third-party processors who act only on our instructions and are bound by data processing agreements:

5.2 Legal Requirements

We may disclose your information where required by law, court order, or regulatory authority (such as HMRC or the ICO), or where we believe disclosure is necessary to protect our legal rights or prevent fraud.

5.3 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of our assets, your data may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.

5.4 Publicly Visible Information

Company listings, league table entries, approved bulletin board posts, and submitted events may be publicly visible on our platform as part of our directory services. Financial data displayed is sourced from publicly filed accounts. If a directory listing about you or your company is inaccurate, or you want it removed, use the "correct or remove this listing" link on the company's profile page or email privacy@construct365.com — we review every request.

5.5 RFQ Leads

When you submit a Request for Quote, your project details and contact information will be shared with up to 3 contractors from our directory that hold a paid Featured listing and match your chosen trade type and area, so they can respond to your enquiry directly. Where a recipient company has claimed its profile on our platform, the enquiry also appears in that company's leads inbox.

6. International Data Transfers

Our platform and database are hosted in the European Union (application hosting via Replit and PostgreSQL database hosting via Neon in Frankfurt, Germany). Transfers of personal data from the UK to the EU are covered by the UK's adequacy regulations for the EEA, so no additional transfer safeguards are required for our core hosting.

However, some of our service providers — Stripe (payment processing), SendGrid (email delivery), and Google (analytics) — still process personal data in the USA. When we transfer personal data outside the UK to a country without adequacy regulations, we ensure adequate protections are in place through one or more of:

• UK Adequacy Regulations: Where the destination country has been deemed adequate by the UK Secretary of State
• International Data Transfer Agreements (IDTA): The UK-specific standard contractual clauses issued by the ICO under Article 46 UK GDPR
• UK Addendum to EU Standard Contractual Clauses: For processors using the EU SCCs with the UK Addendum approved by the ICO

You can request a copy of the transfer safeguards we use by contacting privacy@construct365.com.

7. Data Retention

We retain personal data only for as long as necessary for the purposes described in this policy, or as required by law:

8. Your Rights Under UK GDPR and DPA 2018

You have the following rights regarding your personal data. These rights are not absolute and may be subject to exemptions under DPA 2018:

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration, including:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS (HTTPS)
• Encryption at rest: Database data is encrypted at rest by our hosting provider
• Password hashing: Passwords are stored using bcrypt one-way hashing — we cannot retrieve your password
• HTTP-only cookies: Authentication tokens are stored in HTTP-only cookies inaccessible to JavaScript
• Access controls: Role-based access controls restrict data access to authorised personnel only
• Data breach procedures: We have procedures in place to detect, investigate, and notify the ICO of qualifying breaches within 72 hours, and to notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms

10. Cookies and Tracking

We use cookies and similar technologies on our platform. These are governed by PECR and, where personal data is involved, by UK GDPR. For full details, please see our Cookie Policy.

11. Children's Privacy

Our platform is intended exclusively for business users and professionals in the UK construction industry. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected data from a child, please contact privacy@construct365.com immediately and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by email or by prominent notice on our platform. Your continued use of our platform after the effective date constitutes acceptance of the updated policy. The date at the top of this page shows when it was last revised.

13. Complaints

If you are unhappy with how we have handled your personal data, please contact us first at privacy@construct365.com — we would like the opportunity to address your concern directly.

If you remain dissatisfied, you have the right to lodge a complaint with the UK supervisory authority:

You also have the right to bring civil proceedings in the courts of England and Wales.

14. Contact Us

For any privacy-related questions, to exercise your rights, or to obtain a copy of our data processing agreements: