This notice explains how Construct Software Ltd handles personal data in our software: Construct Software ID, Start and the apps reached through them (together, the “Services”). It applies from 27 October 2026.
Each app has its own section, its supplement, listing the providers it uses, the cookies it sets and anything particular to it. When you open this notice from an app, its supplement follows this notice. You can read every supplement from the list on this page.
Our Website Privacy and Cookie Notice covers our public websites, and our External Party Notice covers people who use a customer’s portal or link without an account.
1. Who we are
Construct Software Ltd, registered in England and Wales, company number [COMPANY NUMBER]. Registered office: [REGISTERED ADDRESS]. ICO registration number: [ICO NUMBER].
Data protection contact: compliance@constructsoftware.co.uk.
2. Our role: controller and processor
We act in two different roles, depending on the data.
- As a processor for our customers. Organisations that use the Services decide what information they record in them, for example sites, buildings, certificates, test results, contractor documents, applications, photographs and meeting details. For this “customer content” the organisation is the controller, and we process it only on its instructions, under our Data Processing Agreement. If you use the Services on your own, without an organisation, you are the controller of your own content.
- As a controller for our own purposes. We are the controller for the information we need to run the Services and our business: user accounts, sign-in and security records, licences and subscriptions, support requests and correspondence, and billing contacts.
If your personal data appears in customer content, for example your name on a test certificate or in a contractor’s documents, the organisation that recorded it is responsible for it, and questions or requests should go to them first. If you contact us instead, we will pass your request to the organisation concerned and help them respond. People invited to a meeting through MeetingScheduler can ask us directly for a copy of their details or for them to be deleted, as the MeetingScheduler section of our External Party Notice explains.
3. Personal data we process
Account holders
- Name, email address, phone number (if you give one), organisation, job title and role
- Your password (stored only as a secure hash), two-step verification settings, and the apps and licences you have
- If you sign up yourself, the details you give at sign-up and the version of these documents you accepted
- Security and activity records: sign-ins and failed attempts, the actions you take, the date and time, your IP address and browser details
- Support requests and messages you send us, including any attachments
- Your preferences, such as notification settings, and whether your use of the Services is counted in our usage statistics
- Usage statistics: which apps, pages and features you use, and when (see section 4A)
Customer content (processed for our customers)
- Details of sites, buildings, systems, projects and contacts
- Uploaded documents, certificates, photographs and drawings, which may contain personal data, and in some apps the location where a photograph was taken
- Names, companies, qualifications and signatures of engineers, testers, inspectors and contractors
- Records of work, tests, inspections, permits, applications and meetings
The Services are not designed to hold special category data (such as health information), and customers should not record it. Photographs may occasionally show people incidentally.
4. How we use personal data and our lawful basis
Where we are the controller, we use personal data as follows:
| Purpose | Lawful basis |
|---|---|
| Creating and running your account, signing you in and giving you access to the apps you are licensed for | Performance of a contract (with you or your organisation) |
| Sending the emails, SMS messages and notifications the Services are set up to send, such as sign-in codes, reminders and alerts | Performance of a contract; legitimate interests in operating the Services |
| Keeping the Services secure, recording activity, and preventing fraud, spam sign-ups and misuse | Legitimate interests in protecting the Services and our customers’ data |
| Providing help and support | Performance of a contract; legitimate interests |
| Telling you about service changes, maintenance and changes to these documents | Performance of a contract; legitimate interests |
| Billing and account administration | Performance of a contract; legal obligation (accounting records) |
| Understanding how the Services are used, from our own records and the usage statistics described in section 4A, so we can improve them | Legitimate interests in improving our products |
| Complying with the law and responding to lawful requests | Legal obligation |
We process customer content only to provide the Services to the customer that owns it. We do not sell personal data, we do not use customer content for advertising, and we do not use it to train artificial intelligence models. We do not make decisions about people based solely on automated processing that have legal or similarly significant effects. Where an app uses automated checks or artificial intelligence to help, its supplement explains this, and a person makes the final decision.
We will not send you marketing you have not asked for.
4A. Usage statistics
4A.1 We measure how the Services are used so that we can improve them and help our customers get the most from them: for example, which apps, pages and features are used and how often, how quickly pages load, and whether errors occur. We do this ourselves, on our own servers. No other company receives this information, and we do not use it for advertising.
4A.2 When you are signed in, the record shows your organisation and a code that stands for your account, not your name or email address. It records which feature was used and when, never what you entered: no names, documents, report text, calculator inputs or other content. Our staff can link a code to an account only where they need to, for example to help your organisation with training or support, and each time they do so it is recorded.
4A.3 Where you work in another organisation’s records, for example as its service provider, the record shows the organisation you were working for and that you were acting as its service provider.
4A.4 Pages you visit are counted in the same way as on our websites: we record the page, the website that linked to it, your country (worked out from your IP address), and your type of browser, operating system and device, and a small script on our own pages adds your screen size, how long the page was in view, how quickly it loaded and any technical error. We do not keep your IP address or your browser’s full details for statistics, and we do not set cookies or store anything on your device for them.
4A.5 The detailed records are deleted after 90 days. After that we keep only totals, such as the number of active users in each organisation each day, for 25 months. An organisation’s totals are deleted with its other data when its subscription ends.
4A.6 We rely on our legitimate interests in understanding and improving the Services. You can object at any time, free of charge: switch on “Don’t count my visits” in Construct Software ID, under Preferences, or use a browser that sends a Global Privacy Control or Do Not Track signal. We then stop recording your use of the Services for statistics. This does not change how the Services work.
5. Cookies
The Services use only cookies that are strictly necessary for them to work, such as:
- a session cookie in each app that keeps you signed in while you use it, which expires when you close your browser; and
- shared sign-in cookies (cs_user, cs_token and cs_selector) that keep you signed in across Construct Software services, and remember you if you choose to stay signed in.
Each app’s supplement lists the cookies it sets. We do not use analytics or advertising cookies: our usage statistics (section 4A) work without them. If we ever want to use such cookies, we will update this notice first and only set them with your consent. If you choose “Don’t count my visits” on our website, a cookie called cs_no_count remembers your choice across Construct Software services.
6. Who we share personal data with
6.1 We use carefully chosen providers (sub-processors) to run the Services. Each is bound by a written agreement requiring it to protect personal data. Every app uses:
| Provider | Purpose | Data involved | Location |
|---|---|---|---|
| 20i Ltd | Hosting the Services’ servers and databases | All data held in the Services | United Kingdom |
| 20i Ltd (StackMail) | Sending the Services’ emails | Recipient names and email addresses, message contents | United Kingdom |
Apps that offer data exports also use Cloudflare, Inc. (Cloudflare R2), in the European Union, to hold an export you have asked for until it is downloaded (see section 9). The export is encrypted by us before upload so that Cloudflare cannot read it, and is deleted when the download link expires.
6.2 Each app’s supplement lists any other providers it uses, such as file storage, SMS, address lookup or artificial intelligence services.
6.3 Within an organisation, other users, and any service provider the organisation has authorised, can see customer content according to the permissions the organisation sets. Where an organisation connects two of our Services, for example SafetyCert and InterimReport, or connects its account to a service provider’s, customer content is shared between them as the organisation chooses; each app’s supplement explains what is shared.
6.4 We may share personal data with our professional advisers, with a buyer of our business (under the same protections), and with regulators, courts or law enforcement where the law requires it.
6.5 We will update the relevant supplement, and tell organisation administrators, at least 30 days before we add or replace a provider that handles customer content.
7. International transfers
The Services’ data is stored in the United Kingdom, and in the European Union where an app’s supplement says so or where an export has been made at your request. Some of our providers are part of groups based outside the UK, for example in the United States, and may access data from there, such as to provide support, or process it there where a supplement says so. Where that happens, we rely on appropriate safeguards under UK data protection law, such as UK adequacy regulations (including the UK–US Data Bridge where the provider is certified) or the UK International Data Transfer Agreement or Addendum.
8. How we protect personal data
- All connections to the Services are encrypted (HTTPS).
- Passwords are stored only as secure hashes, accounts are locked after repeated failed sign-ins, and two-step verification is available.
- Uploaded files are encrypted with AES-256 before they are stored, and selected sensitive details are encrypted in our databases. Each app’s supplement says what it encrypts.
- Data exports are encrypted before they are stored, and can be opened only through our download page by someone who signs in as an administrator of the organisation (or as the account holder).
- Each organisation’s data is kept separate, and access within an organisation is controlled by role.
- Significant actions are recorded in audit logs, in the apps that keep them.
- Our staff access personal data only where needed, using individual accounts with role-based permissions, and are bound by confidentiality obligations.
No system is completely secure, but we take appropriate steps to protect the data we hold, and we will tell you and the Information Commissioner if a breach puts you at risk, as the law requires.
9. How long we keep personal data
- Customer content is kept for as long as the organisation chooses, while it uses the Services. Many compliance records must be kept for set periods; that is the organisation’s decision. When a customer deletes a file or record, it is removed from view straight away and permanently deleted within 90 days; a record that it was deleted remains in the audit trail, where the Service keeps one. Some records are kept even when they are deleted, for example as evidence or because other records depend on them; the app’s supplement says which.
- Exports: you can export your content using the export features in each Service while you have access. You can also ask us for a full export of your organisation’s content in a Service, at any time while you use that Service and during the 90 days after your subscription to it ends. We email a download link to the organisation’s administrators (or to you, if you use the Services on your own), normally within 10 working days of your request. The link works for 7 days, and only for someone who signs in as one of those administrators (or as you); we can extend it once on request. We delete our copy of the export when the link expires. A record of each download, with the IP address and browser details it came from, is kept for 2 years.
- Backups: we keep backups so that data can be recovered after an incident. Deleted data remains in our backups for a limited period, normally no more than 90 days, and is then permanently removed: database backups are kept for 60 days, backups of server files and mailboxes for 30 days, and backup copies of files we store with Cloudflare for about 90 days. Backups are used only to restore data. Our hosting provider keeps its backups on separate, isolated backup systems certified to ISO 27001 (information security) and ISO 22301 (business continuity), with an independent SOC 2 Type 2 report.
- When a subscription ends, we keep the organisation’s content in that Service for 90 days from the day we tell its administrators that the subscription has ended, so that it can be exported or the subscription restarted, and then delete it. We remind the administrators 60 days after that first notice and 7 days before the deletion date. We keep the content longer if the law requires it, if the customer asks us to, while a dispute or legal claim about the account is being resolved, or for a short time while we finish an export the customer asked for or make sure its administrators have been told. When an organisation’s last paid subscription has been deleted in this way, the organisation and all its user accounts are closed and deleted as described in the next point; the same applies to an individual account. MeetingScheduler has no subscription; see its supplement.
- User accounts are kept while the account is open. A closed account is switched off and signed out straight away, and deleted 30 days later; until then the closing can be undone, using the link in our email or, for an organisation account, by its administrator. An administrator can also switch an account off without deleting it; a switched-off account is not deleted until an administrator deletes it or the organisation’s account is closed. Names and signatures on records that belong to an organisation, such as certificates and reports, stay with those records after your account is deleted.
- Self-registration requests that are never completed are deleted automatically.
- Security and activity logs are kept for 2 years, unless an app’s supplement says otherwise. Records of requests to our servers are kept for up to 12 weeks, unless needed to investigate a security incident, and logs of our scheduled tasks for no more than about four months.
- Usage statistics: detailed records for 90 days, then totals for 25 months (section 4A).
- Support requests and correspondence are kept for up to 2 years after they close. Feedback you send us is kept for 2 years.
- Billing records are kept for six years, as required for accounting purposes.
10. Your rights
Under UK data protection law, you have the right to:
- access the personal data held about you;
- have inaccurate data corrected;
- have data erased in certain circumstances;
- restrict how your data is used;
- receive your data in a portable format;
- object to processing based on legitimate interests; and
- withdraw consent, where we rely on it.
You can update most of your account details yourself in Construct Software ID. If you use the Services on your own, you can delete your account from your account settings; if your account belongs to an organisation, ask its administrator to delete it. To exercise any right for data we control, email compliance@constructsoftware.co.uk. We will respond within one month, and there is normally no fee. For customer content, please contact the organisation that recorded it; if you contact us, we will pass your request on and help them respond. People invited to a meeting through MeetingScheduler can ask us directly, as section 2 explains.
11. Complaints
If you have a concern about how your personal data is handled, please contact us first so we can try to resolve it. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority: ico.org.uk, telephone 0303 123 1113.
12. Children
The Services are business services and are not intended for anyone under 18.
13. Changes to this notice
We may update this notice and its supplements. Each change is published as a new version with the date it took effect, and earlier versions remain available. If a change is significant, we will tell you in advance and may ask you to acknowledge it the next time you sign in.