Privacy & cookies

• Session token. Proves you're signed in, so you don't have to log in on every page. It expires after about eight hours.
• Security token. Protects forms against being submitted by another site on your behalf.
• Return address. Remembers which page to send you back to after Zoho signs you in.

Because these three are strictly necessary to provide a service you asked for by clicking “Sign in with Zoho”, we don't need to ask your consent for them. We're telling you anyway.

Kiosk tablets, such as visitor sign-in at reception, also hold a device cookie. It identifies the tablet, not a person, and lets it open its one kiosk screen without anyone signing in.

It records the page you opened, the page you came from, the country, and the general type of device, browser and operating system.

Instead of an identifier that follows you around, it makes a one-way hash from your IP address and browser details, and that hash changes every day, so visits can be counted without anybody being recognised from one day to the next. Your IP address is used to work out the country and is not stored. We cannot see which pages a named person visited, and we are not trying to.

It measures how long pages take to load and become usable on the device you are using, which is the only way to know whether the hub is slow on the tablet at the bench or on an older phone.

It records timings against the page address, along with the general type of device, browser and connection. It creates no identifier that follows you between visits and records no content: not what you typed, not what you searched for, and nothing you were looking at.

• Your account. Your name and work email from Zoho, which apps you can use, and who granted them and when.
• Your HR record. Your start date, contracted hours, job title, team, who you report to, employment type, employee number and probation, and the dates your right to work and driving licence were last checked (dates only, never a copy or an ID number). Also what you give us yourself in My profile: your title, middle names, preferred name, previous surname, gender, date of birth, home address, personal email and phone, two emergency contacts and, if you want, a photo. The personal details are kept encrypted. Only you and HR Hub admins can see them, and every time an HR admin opens or changes someone else's record it is logged (who and when, never the details). Colleagues with the HR Hub see your birthday (day and month only, never the year or your age) and your work anniversary on the HR Hub home in the 30 days before it, unless you hide them with the button in My profile. We use it to employ and pay you and to look after you at work (a contract and a legal duty). It is never sent to the AI or to Cliq. When you leave, the personal details and photo are deleted and the work facts are kept for 6 years.
• Your expenses. The receipts and mileage you claim: the date, supplier, amount and tax, category, a tag, your notes, a photo or PDF of each receipt and, for mileage, the places you drove between and the miles, with who approved the claim and when it was paid. The notes and the places (which can be your home address) are encrypted and seen only by you and Expenses approvers. When you type a place for a mileage claim it is sent to Google Maps to find it and work out the distance and map, without your name or email. We use it to repay you and keep the company's tax records (a contract and a legal duty). It is never sent to the AI or to Cliq. Claims and receipts are kept 6 years for tax; the notes and places are deleted when you leave.
• Sign-ins and devices. The date and time of your last 40 sign-ins, a short description of the device taken from your browser, such as “Computer · Windows 10/11 · Chrome 140”, and when you agreed to the Hub terms of use (and whether you use a personal device for work). No IP addresses or locations.
• Timesheets. Your clockings, hours, overtime, holiday, bank holidays, travel claims, nights away, corrections you ask for, and approvers' decisions and notes. Each time you tap the office clock, the Hub also gets a live copy of the tap (your clock number and the time) so you and the approvers can see who is on site. Until a clock report is uploaded for a day, your taps are used to work out that day's hours. The live copy is kept for 90 days. The Hub can also message approvers, and the people picked for building safety, in Cliq, for example with the names of anyone still tapped in at 7pm so a wellness check can be made.
• Sickness. The dates you were off sick, paid or unpaid, and any reason you or an approver gave.
• Your work in the tools. Things you create or sign, such as inspection and test sheets, delivery notes, SOPs, Site Works jobs, RAMS sign-offs and site packs, bills and wire lists, and in Business Compliance, the checks you do and anything you report.
• Tool history. Your Workshop Assistant chats, how much you use the AI powered tools, and your recently used apps.

Links to Zoho, BrightHR and BHSF take you there; those systems keep their own records.

Sick days and injuries in accident reports are health data. We hold only what is needed, only the people who handle them can see other people's, sick reasons are removed when you leave, and accident reports are deleted 6 years after the accident.

The law and our ISO system expect us to show the checks were done and the risks assessed (PUWER, fire safety, MHSWR, COSHH, RIDDOR), so these are company records: kept, with a leaver's name shown as Name (Left MM/YY). The PDF records in WorkDrive keep the name as it was when signed, like other signed records. Accident, near miss and hazard reports are the exception: 6 years from the date it happened, then deleted.

The hub is hosted by Vercel. Vercel is a US company, so support and logs may be handled in the US, under the UK-approved transfer safeguards in Vercel's data processing agreement. You sign in through Zoho, on its EU data centre, and Compliance records are filed in our Zoho WorkDrive. An encrypted backup of the hub is saved to our Zoho WorkDrive every night, in a folder only the hub admins can open.

• Non-Conformance photos: pictures of a missing, broken or wrong part added to a report (private files, shown only to the person who reported it, the project lead and the Non-Conformance people). 6 years from the report, with the report.
• Expenses: the receipt photos and PDFs added to claims (private files, shown only to the person who made the claim and Expenses approvers). 6 years from the claim, for tax records; deleted with the claim if it is withdrawn.
• HR photos: the optional photo each person adds to their HR record (private files, shown only to them and HR Hub admins). Deleted when you leave, or when you remove or replace it.
• Hub accounts, app access, Past users, kiosk devices, change requests, the API usage log, the personal data log, and where reports and project photos are filed in WorkDrive (with the last 100 reports filed). While you work here; then Past users with your name only.
• When you agreed to the Hub terms of use (device declarations), whether you use a personal device, and the last 40 sign-ins The old data files in this folder were retired on 29/10/2026 (the records are in the database); one encrypted backup copy is kept until 29/12/2026, then deleted. Photos, documents and drafts here stay.. 1 year after you leave.
• How much each person uses the AI powered tools each day The old data files in this folder were retired on 29/10/2026 (the records are in the database); one encrypted backup copy is kept until 29/12/2026, then deleted. Photos, documents and drafts here stay.. Deleted when you leave.
• Workshop Assistant chats The old data files in this folder were retired on 29/10/2026 (the records are in the database); one encrypted backup copy is kept until 29/12/2026, then deleted. Photos, documents and drafts here stay.. Deleted when you leave.
• The Hub bell: your alerts (a task or subtask given to you, tasks due or overdue, drawings to approve, approved or sent back, projects not set up), which devices you turned push alerts on for, and your choice for each kind of alert (bell, push, Cliq message). Push and Cliq messages are only sent while you are at work (clocked in, or 09:00 to 17:00 Monday to Friday if you have no fob), so one that comes up while you are out is held in your record for up to 3 days and sent when you clock in. Whether you are clocked in is read from the clock taps already held for Timesheets at that moment and is not stored here. The old data files in this folder were retired on 29/10/2026 (the records are in the database); one encrypted backup copy is kept until 29/12/2026, then deleted. Photos, documents and drafts here stay.. Alerts kept 90 days; deleted when you leave.
• Recently used apps The old data files in this folder were retired on 29/10/2026 (the records are in the database); one encrypted backup copy is kept until 29/12/2026, then deleted. Photos, documents and drafts here stay.. Deleted when you leave.
• Timesheets: clockings (and clocks made on the Hub, with roughly where, kept 90 days), hours, time off, sick days, travel claims, approvals and their audit log. Also a live copy of each tap on the office clock (your clock number and the time), so you and the approvers can see who is on site and, until a clock report is uploaded for a day, work out that day's hours; kept 90 days The old data files in this folder were retired on 29/10/2026 (the records are in the database); one encrypted backup copy is kept until 29/12/2026, then deleted. Photos, documents and drafts here stay.. 6 years; sick reasons removed when you leave. Live clock taps: 90 days.
• Inspection & Test schedules, drafts and signatures The old data files in this folder were retired on 29/10/2026 (the records are in the database); one encrypted backup copy is kept until 29/12/2026, then deleted. Photos, documents and drafts here stay.. Kept as company records; name kept as Name (Left MM/YY); drafts deleted when you leave.
• Workshop SOPs, drafts and photos The old data files in this folder were retired on 29/10/2026 (the records are in the database); one encrypted backup copy is kept until 29/12/2026, then deleted. Photos, documents and drafts here stay.. Kept as company records; name kept as Name (Left MM/YY); drafts deleted when you leave.
• Inventory: every item (part number, description, UOM, manufacturer, supplier, buy link, a picture, and its warehouses and locations), the stock held at each location with every change and who made it, when and why, and requests for quote and purchase orders with their prices The old data files in this folder were retired on 29/10/2026 (the records are in the database); one encrypted backup copy is kept until 29/12/2026, then deleted. Photos, documents and drafts here stay.. Kept as company records; a leaver's name is shown as Name (Left MM/YY).
• Delivery notes and signatures The old data files in this folder were retired on 29/10/2026 (the records are in the database); one encrypted backup copy is kept until 29/12/2026, then deleted. Photos, documents and drafts here stay.. Kept as company records; name kept as Name (Left MM/YY).
• Site Works jobs, RAMS sign-offs, site packs, photos and reports The old data files in this folder were retired on 29/10/2026 (the records are in the database); one encrypted backup copy is kept until 29/12/2026, then deleted. Photos, documents and drafts here stay.. Kept as company records; name kept as Name (Left MM/YY) (period to be set).
• Build Readiness parts status, supplier chases and Part Breakdown pairings added by hand The old data files in this folder were retired on 29/10/2026 (the records are in the database); one encrypted backup copy is kept until 29/12/2026, then deleted. Photos, documents and drafts here stay.. Kept as company records; name kept as Name (Left MM/YY).
• Projects: each project (number, name, client, due date, status), its tasks with the team and people each is assigned to, status, dates, subtasks (each with a status and a named person), project notes and comments (with who wrote them), the company, contact name, email and phone and the site address and scope read from the CRM deal, the sales owner, the PO number, order value and the files from the deal (seen only by site admins and people chosen for that project), the names and WorkDrive ids of photos and files added to a task (the files themselves are in WorkDrive), a short log of who changed what, which people are on which team, the project templates, each project's lists (stages) and their dates, the project lead, the PO document details, the issues logged on a project (the text, the task it is about, whether it blocks progress, who raised and who resolved it, and the names and WorkDrive ids of any photos) The old data files in this folder were retired on 29/10/2026 (the records are in the database); one encrypted backup copy is kept until 29/12/2026, then deleted. Photos, documents and drafts here stay.. Kept as company records of the job; a leaver's name is shown as Name (Left MM/YY). Retention period to be confirmed.
• Drawing approvals in Projects: for each project, the approved drawings (name, type, revision, who uploaded and who approved each and when, with the names and WorkDrive ids of the PDFs, which are in WorkDrive), who each set was sent to for approval, what changed, the notes if it was sent back, and the AI summary written for the approver. Drawing PDFs waiting for approval are held until a decision is made The old data files in this folder were retired on 29/10/2026 (the records are in the database); one encrypted backup copy is kept until 29/12/2026, then deleted. Photos, documents and drafts here stay.. Kept as company records of the job; a leaver's name is shown as Name (Left MM/YY). Waiting PDFs are deleted when approved, sent back or withdrawn, and unsent uploads after 2 days. Retention period to be confirmed.
• Files and pictures a person attaches in the Projects assistant chat, held privately for that person only so the assistant can look at them and, if asked, put them on a task, in drawing approval or as the PO document. They are named by a random id with no file name, are shown to the AI only when attached, and are deleted after 1 day. Nothing is kept here once they have been filed on a project.. Deleted automatically after 1 day.
• Business Compliance: the Asset Register (machines, equipment, fire points, vehicles, calibrated equipment, hand tools, IT equipment) with asset numbers and who an asset is assigned to, checklists, every check done and who did it, defects, roles in Compliance, where check records are filed in WorkDrive, the H&S Index of controlled H&S documents (owners, approvers, revision history), new revisions waiting for approval, services and certificates on assets (MOT, insurance, fire alarm and extinguisher services, with the certificate files), fire drills (date, times, roll call, fire marshal), visitor sign-in records (visitor name, company, who they visited, times in and out and signature, kept in the Hub for 13 months then deleted), risk and COSHH assessments (the form, who wrote, changed and approved it, the names of the files it was drafted from, and the safety data sheet of a COSHH assessment; other uploaded files are not kept), policies and procedures generated from an assessment (who made, changed and approved them), and spare parts kept for an asset with who used one and why. Accident, near miss and hazard reports: who reported it (unless sent without a name), where and what happened, photos of the scene, the investigation, RIDDOR, actions and who they are for; for an accident, who was hurt and their injury, first aid, hospital and time off. RAMS from the RAMS Creator, with every version and who made and saved it. Training: who is trained on what, when it runs out, certificates and licences (with a photo or scan if added), job titles, people without a Hub login added by name The old data files in this folder were retired on 29/10/2026 (the records are in the database); one encrypted backup copy is kept until 29/12/2026, then deleted. Photos, documents and drafts here stay.. Kept as company records (proof the checks were done); name kept as Name (Left MM/YY). The PDF records in WorkDrive keep the name as it was when signed, like other signed records. Accident, near miss and hazard reports: 6 years from the date it happened, then deleted. Visitor sign-in records: 13 months, then deleted from the Hub (the PDF in WorkDrive stays).
• People: everyone's profile (job, department, team, start date, line manager, and the groups they are in), people without a Hub login added by name, and an emergency contact (their name, relationship and phone) The old data files in this folder were retired on 29/10/2026 (the records are in the database); one encrypted backup copy is kept until 29/12/2026, then deleted. Photos, documents and drafts here stay.. While you work here; then kept with your name as Name (Left MM/YY). The emergency contact is deleted when you leave.
• Tender Finder: public tender notices that match our work (title, buyer, value, deadline, CPV codes, link, and the AI's fit score and reason), our Go or No Go decision on each with who set it and when and any outcome written, and a note of each morning search The old data files in this folder were retired on 29/10/2026 (the records are in the database); one encrypted backup copy is kept until 29/12/2026, then deleted. Photos, documents and drafts here stay.. Notices are cleared 90 days after their deadline unless decided Go or an outcome is written; a leaver's name is shown as Name (Left MM/YY).

“When you leave” means the 20th after the pay period you leave in. Backups are encrypted and replaced as new ones are made, so anything removed is gone from them within 12 months.