DRAFT – not legal advice

Privacy notice

Home

# SubCallout privacy notice (first pilot)

**DRAFT – not legal advice, needs solicitor review before use.**

This notice is for the private first pilot of SubCallout. It is written in plain English for UK commissioning clients and subcontractors. It is not a finished GDPR document, not a DPIA, and not ICO registration.

## Who we are

The prototype is operated for Tony Pochwalowski as a private unpublished tool. Contact for this pilot is in-app to the platform operator login only. This build does not send live email or SMS.

## What we store

We store what you type or upload to run the marketplace:

- company name, site name and address, local usernames
- job details, offered rates, bids, messages, purchase orders
- engineer names, competence notes, insurance and trade scans
- worksheet findings, readings, PPM results, photos, generated PDFs
- in-app notices and (if you opt in) a web-push device subscription
- audit rows of who did what on this machine

We do **not** take card details. We do **not** hold money. We do **not** use the data to advertise to other companies.

## Why we store it

To match a job with an engineer, record attendance paperwork, and let the client download their own worksheet. Legal bases we expect a solicitor to confirm: **contract** (running the job) and **legitimate interests** (security, audit, dispute history). Special-category data is not requested. Do not upload health records.

## Who can see what

- A client sees its own jobs, awards, POs and worksheets.
- A subcontractor sees jobs it may bid on, plus its own bids, award and capture.
- Competing companies cannot see each other’s rates, evidence or packs.
- Occupiers see a redacted site record only.
- The platform operator can see records needed to run the private pilot.

Nothing is sold. There is no live email list.

## How long we keep it

Signed worksheet PDFs are kept as the legal record and are not auto-deleted. Photo originals follow the client’s download window (default 90 days) then are removed; the PDF stays. Audit and award history are kept so a dispute can still be read. You can ask the operator for a company export from **Privacy**.

## Your rights (UK GDPR, draft)

You can ask to access, correct, or export your company’s data, or to anonymise a login. Some records (signed PDFs, audit) may be retained where the law requires a record of what happened. Complain to the ICO if you need to — this draft does not replace that right.

## Security (honest)

Local accounts, sessions and CSRF exist on this prototype. **This is not production-audited security.** Do not put live personal data into a demo database. Optional authenticator-app codes are available; they are not required for demo logins.

## Changes

This notice will be rewritten after solicitor review before any live personal data is processed.

**DRAFT – not legal advice, needs solicitor review before use.**
SubCallout