Privacy Policy

1. Introduction

Site Safe Hub ("we", "us", "our") is a construction site safety and compliance management platform operated by WorkDoc360. We are committed to protecting and respecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights in relation to your data. It applies to all users of the Site Safe Hub platform, including site managers, field workers, contractors, operatives, and visitors.

By using Site Safe Hub, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use our services.

2. Data Controller

The data controller responsible for your personal data is:

Site Safe Hub (powered by WorkDoc360)
Email: [email protected]

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us using the details above.

3. Data We Collect

We collect and process the following categories of personal data depending on your role and how you interact with the platform:

3.1 Account and Identity Data

• Full name, email address, and phone number
• Job title and role (e.g. Site Manager, Operative, Contractor)
• Company or organisation name
• Password (stored securely using bcrypt hashing — we never store passwords in plain text)

3.2 Workforce and Compliance Data

• CSCS card details (card number, type, expiry date)
• Qualifications and training records (SMSTS, SSSTS, first aid, asbestos awareness, etc.)
• Right-to-work documentation
• Insurance certificates and accreditation details (for contractors)
• Induction completion records

3.3 Site Activity Data

• Site entry and exit logs (sign-in/sign-out times)
• Daily briefing attendance records
• Permit-to-work records and associated details
• Inspection results and corrective actions
• Incident reports (including descriptions, severity, photos, and investigation notes)
• Site diary entries (weather, progress, workforce numbers, activities)
• Snag and defect records

3.4 Location Data

• Geolocation data when using QR code site sign-in (to verify the operative is physically at the site)
• Site addresses and postcodes associated with projects

3.5 Documents and Media

• Photographs (e.g. pin evidence on drawings, incident photos, inspection photos)
• Uploaded documents (RAMS, method statements, fire plans, certificates, permits, construction phase plans)
• Document revision history

3.6 Technical Data

• IP address and browser type
• Device information and operating system
• Usage data (pages visited, features used, session duration)
• Cookies and similar tracking technologies (see our Cookie Policy)

4. How We Use Your Data

We use your personal data for the following purposes:

5. Legal Basis for Processing (UK GDPR)

Under the UK GDPR, we rely on the following legal bases to process your personal data:

• Performance of a contract (Article 6(1)(b)): Processing is necessary to provide you with the Site Safe Hub platform and services you have signed up for.
• Legal obligation (Article 6(1)(c)): Processing is necessary to comply with UK health and safety legislation, including the Construction (Design and Management) Regulations 2015 and the Health and Safety at Work Act 1974.
• Legitimate interests (Article 6(1)(f)): Processing is necessary for our legitimate interests in providing a safe and compliant construction management service, preventing fraud, and improving our platform. We always balance our interests against your rights.
• Consent (Article 6(1)(a)): Where we collect geolocation data for QR sign-in, we rely on your explicit consent. You may withdraw consent at any time by disabling location services on your device, though this may affect the QR sign-in functionality.

6. Data Sharing and Third Parties

We do not sell your personal data. We share data only with trusted third-party service providers who help us operate the platform, and only to the extent necessary:

All third-party providers are bound by data processing agreements and are required to process your data in accordance with UK GDPR. We ensure appropriate safeguards are in place for any international data transfers.

We may also share your data if required to do so by law, regulation, legal process, or enforceable governmental request (e.g. a court order or HSE investigation).

6.1 Intra-Organisation Sharing

Within the platform, your data may be visible to other users within the same organisation or project. For example, a site manager can view operatives' sign-in records, CSCS details, and briefing attendance for sites they manage. Contractors can see their own operatives' data. This sharing is necessary for the safe operation of construction sites.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Our retention periods are as follows:

• Account data: Retained for the duration of your account and for 12 months after account deletion, to allow for reactivation and to comply with our legal obligations.
• Site entry/exit logs: Retained for 6 years in line with the Limitation Act 1980 and construction industry best practice for health and safety records.
• Incident reports and investigations: Retained for a minimum of 6 years (40 years for incidents involving asbestos or other long-latency diseases), as required by health and safety legislation.
• Permits, inspections, and RAMS: Retained for 6 years after project completion.
• Documents and certificates: Retained for the duration of their validity plus 6 years.
• Briefing and induction records: Retained for 6 years after the relevant project is completed.
• Technical and usage data: Retained for up to 24 months.

When data is no longer required, it is securely deleted or anonymised.

8. Data Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it, including:

• Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS (HTTPS).
• Encryption at rest: Database and file storage are encrypted at rest using AES-256 encryption.
• Password security: Passwords are hashed using bcrypt and are never stored in plain text. We support optional two-factor authentication (TOTP).
• Access controls: Role-based access control (RBAC) ensures users can only access data appropriate to their role. Organisation-level data isolation prevents cross-tenant data access.
• Rate limiting: Login endpoints are rate-limited to prevent brute-force attacks.
• JWT authentication: Secure token-based authentication with short-lived access tokens and refresh token rotation.
• Regular backups: Automated database backups are performed regularly and stored securely.
• Secure file storage: Uploaded files are stored in AWS S3 with server-side encryption and access-controlled URLs.

While we take all reasonable precautions, no method of transmission or storage is 100% secure. If you become aware of any security breach, please contact us immediately at [email protected].

9. Your Rights

Under the UK GDPR, you have the following rights in relation to your personal data:

• Right of access (Article 15): You have the right to request a copy of the personal data we hold about you.
• Right to rectification (Article 16): You have the right to request that we correct any inaccurate or incomplete personal data.
• Right to erasure (Article 17): You have the right to request deletion of your personal data, subject to our legal retention obligations (see Section 7).
• Right to restrict processing (Article 18): You have the right to request that we limit how we use your data in certain circumstances.
• Right to data portability (Article 20): You have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to object (Article 21): You have the right to object to processing based on legitimate interests. We will stop processing unless we have compelling legitimate grounds.
• Right to withdraw consent: Where processing is based on consent (e.g. geolocation), you may withdraw your consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month, as required by law.

10. Cookies

Site Safe Hub uses cookies and similar technologies to provide core platform functionality, maintain your session, and improve your experience. We use:

• Essential cookies: Required for authentication, session management, and security. These cannot be disabled as the platform will not function without them.
• Functional cookies: Remember your preferences such as selected site filters and display settings.
• Analytics cookies: Help us understand how users interact with the platform so we can improve it. These are anonymised and aggregated.

For full details on the cookies we use and how to manage them, please see our Cookie Policy.

11. International Data Transfers

Our primary hosting infrastructure is located within secure data centres. Where your data is transferred outside the United Kingdom, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office (ICO)
• Adequacy decisions where the UK government has determined that a country provides an adequate level of data protection
• Data processing agreements with all third-party providers

12. Children's Data

Site Safe Hub is a professional construction management platform and is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately and we will take steps to delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Notify registered users by email where the changes are significant
• Display a notice within the platform for active users

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.

14. Complaints

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk

We would, however, appreciate the opportunity to address your concerns before you contact the ICO. Please reach out to us first at [email protected].

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Site Safe Hub (powered by WorkDoc360)
Email: [email protected]