Data processing terms

What these terms are

When a business uses SiteScope ("you"), it puts in personal data about other people: its clients, its staff, its subcontractors, people who enquire about work. You are the controller of that data and Alec Nicholson, trading as Kudu Digital ("we", "us") processes it for you. These terms set out how, as Article 28 of the UK GDPR requires, and form part of our terms of service.

Our own use of account and billing data, where we are the controller, is covered by our privacy policy instead.

The processing

• Subject matter: providing SiteScope to you.
• Duration: for as long as you use SiteScope, and until the data is deleted as described under "At the end".
• Nature and purpose: storing, organising, displaying and transmitting the data to the people you give access to; sending the notifications and emails your use of it creates; producing the documents you ask for; and, when an AI feature is used, sending what is needed to answer it.
• Types of personal data: names and contact details; addresses of jobs; project records — diary entries, photographs, messages, snags, documents, certificates, inspections and safety records, which may describe an injury; quotes, contracts, payments and invoices; subcontractors' tax details, such as Unique Taxpayer References, National Insurance and VAT numbers, and CIS deductions.
• People it is about: your staff and subcontractors, your clients and the people who enquire about work, and anyone else who appears in a job's records.

What we do

• Only on your instructions. We process the data only to provide SiteScope as you use and set it up — these terms, the terms of service and what you do in the product are your instructions — unless the law requires otherwise, in which case we will tell you first unless the law forbids it. If we think an instruction breaks data protection law, we will say so.
• Confidentiality. Anyone who can access the data for us is bound to keep it confidential.
• Security. We keep the measures described on our security page: access decided by the database for every table, private file storage with short-lived links and no public URLs, sessions verified on the server for every request, encryption in transit and, through our hosting suppliers, at rest, and an append-only audit trail of changes to the core record of every job. We review them as SiteScope changes.
• Breaches. If we become aware of a personal data breach affecting your data, we will tell you without undue delay, with what we know, so you can decide whether to notify the Information Commissioner's Office — which you would need to do within 72 hours — and the people affected.
• Helping you. We will help you answer people exercising their rights — most requests can be met in the product, by exporting, correcting or deleting — and with security, breach notifications, data protection impact assessments and consulting the ICO, as far as is reasonable given what we know.
• Showing we comply. We will give you the information you reasonably need to show these obligations are met, and allow an audit by you or an auditor you appoint who is bound by confidentiality, on 30 days' notice and no more than once a year unless a breach or the ICO requires it. Most questions can be answered in writing first.

Sub-processors

You authorise us to use the suppliers listed below. Each is bound by data protection terms that protect the data at least as well as these, and we remain responsible to you for them.

We will email account owners at least 30 days before adding or replacing one. If you object on reasonable data protection grounds and we can't resolve it, you can end the agreement before the change, and we will refund any period you have paid for and won't get.

International transfers

SiteScope's data is stored in Ireland, which UK law treats as giving adequate protection. Some of these suppliers are US companies, and some requests — to the AI model, or to send an email — are handled in the US. Where personal data goes outside the UK and the EU, it is protected by the UK–US data bridge, for suppliers certified under it, or by the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses in their contracts.

What you do

• Have a lawful basis for the personal data you put into SiteScope, and tell the people it is about how you use it — your clients, for instance, that their job is run in SiteScope.
• Keep special category data — health information, for instance — to what you genuinely need, such as what an accident report must say.
• Give access only to the people who need it, at the role they need.

At the end

You can export your data at any time. When your company is deleted — by its owner, or by us 30 days after the agreement ends — its data is deleted from SiteScope straight away, and from our suppliers' backups as those are replaced in the normal course, within a few weeks. We keep nothing beyond that except what the law requires us to keep.