Privacy Policy

1. Who controls your data

For data about the account holder and the people you invite, Uniti Scaffolding Ltd (company number [COMPANY NUMBER]), trading as ScaffBase, is the controller for running the ScaffBase service. Where you upload data about your own workers and customers to operate your business, you are the controller and we act as your processor — see our Data Processing Agreement. Our ICO registration number is [ICO REGISTRATION NUMBER].

2. What we collect

• Account data — your name, business name, email, password (stored encrypted), and role.
• People you add — names, contact details, phone numbers, competencies/certifications and pay-related information for your staff and workers.
• Operational data — quotes, jobs, schedules, inspections, handovers, photos, messages and similar records you create.
• Usage and technical data — log-in times, device/browser information, and actions taken in the app, used to keep the service secure and working.
• Communications — messages you send through the WhatsApp/SMS and email features.

3. Why we use it, and our lawful basis

• To provide the service — performance of our contract with you.
• To secure and improve the service, and prevent misuse — our legitimate interests.
• To take payment and keep financial records — contract and legal obligation.
• To send service messages (e.g. important notices) — contract or legitimate interests. Marketing, if any, only with your consent and always with an opt-out.

4. AI features

Some features send relevant content to our AI provider (Anthropic) to draft text, suggest prices, summarise messages or review documents. This is used only to generate the result you asked for. We do not permit your data to be used to train third-party AI models. Always have a competent person review AI output before relying on it.

5. Who we share it with

We share data only with the service providers needed to run ScaffBase, under contracts that require them to protect it:

• Supabase — Database, authentication and encrypted file storage (EU / USA).
• Vercel — Application hosting and content delivery (EU / USA).
• Twilio — WhatsApp and SMS messaging (EU / USA).
• Resend — Transactional and notification email (EU / USA).
• Anthropic — AI features (drafting, pricing assistance, document review) (USA).
• Xero — Accounting export — only if you connect your Xero account (UK / EU).

We may also disclose data where required by law, or to a buyer if the business is sold. We do not sell your data or share it with advertisers.

6. International transfers

Some providers process data outside the UK. Where that happens, we rely on appropriate safeguards such as UK adequacy regulations or the International Data Transfer Agreement / Addendum to keep your data protected to UK standards.

7. How long we keep it

We keep account and operational data for as long as your account is active and for a reasonable period afterwards so you can export it and to meet legal, tax and accounting requirements. You can ask us to delete data sooner where we are not legally required to keep it.

8. Security

We use encryption in transit and at rest, role-based access controls, isolated per-business data, and private file storage. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data and will notify you and the ICO of any qualifying breach as required by law.

9. Your rights

Under UK data protection law you can ask to access, correct, delete, restrict or port your personal data, and object to certain processing. To exercise these rights, contact andy@unitiscaffolding.co.uk. If your data is held by a ScaffBase customer (for example, your employer added you), please contact them as the controller; we will help them respond.

10. Complaints

If you have a concern we have not resolved, you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

11. Changes and contact

We may update this policy and will post the new version here with a revised date. Questions about privacy: andy@unitiscaffolding.co.uk.