Loading
Loading
ScaffYard
ScaffYard is a trading name of Bond Labs Limited. These are the data processing terms required by Article 28 of the UK GDPR. They form part of the Terms and you accept them when you open a yard.
You type your customers’ names, addresses and phone numbers into this desk. You photograph their houses. That is their personal data, and you are the one who decided to collect it, so in law you are the controller of it and we are your processor.
Your own team are the same relationship and it is worth saying plainly, because it is easy to assume a staff list is somehow ours. It is not. You employ them, you decided what to write down about them, and their records are yours. We hold them for you on the terms below and we act on your instructions and nobody else’s.
The law does not let a controller hand personal data to a processor unless there is a written contract binding the processor on eight specific points. Without one you would be in breach, not just us. This page is that contract. It costs you nothing and you do not have to sign anything: opening a yard accepts it.
This is separate from the privacy notice, which covers the data we hold about you as our own customer. For that we are the controller and these terms do not apply.
Subject matter and purpose. Running the yard desk you subscribed to: your jobs, sending your team their cards and letting them sign in, tracking hire, raising invoices, keeping your records and working out kit.
How long. For as long as your subscription runs, and then as set out under Closing the account below. A lorry walkaround has a clock of its own: one with nothing wrong is deleted 3 months after the day of the check, and one with a defect 15 months after the day it was repaired. A defect with no repair on it is kept.
What we do with it. Store it, show it back to you, and put it on the sheets you print, email or send on WhatsApp. And when you confirm a handover, record an inspection or off hire a job, send that job’s customer the document it makes from your own connected mailbox, or put it ready for your own email app, for each of the three you leave switched on in Settings. And add up your own team’s sign-ins, the days you mark them off, the job cards you send them and their hours over a stretch of weeks, to show to you alone as attendance figures, one line a person, never a score, in whichever order you pick. And show a job’s customer their own page for it, with only what you leave on it, keep what they send you from it, and show anyone who scans a scaffold’s tag whether it is safe to use, with the day of the last inspection and who did it. Nothing else. We do not analyse it beyond those counts, we do not aggregate it across yards, we do not sell it, we do not train anything on it and we do not send any of it to any AI model, except a photo or spreadsheet you choose to have read when you bring your records in, which goes to Anthropic to be read and nothing more (clause (d) names it). Nothing else in this product uses AI. A person’s next of kin is narrower still: it is stored and shown back to you and to them, and it is on no sheet at all.
Kinds of personal data. Contact name, site address, billing address, phone number, email address, purchase order number and any free notes you type, and what a customer sends you from their own page for a job: the name they give, what they chose or wrote and when, and for a handover signed through its link, the signer’s name, position and signature. For a gang, a chargehand’s name, mobile number and, if you add one, a photograph of them. For someone on your books, their name, their scaffolding card number, their CISRS grade, their CPCS number and categories, the heaviest lorry you say they can drive, photographs of their qualification cards, which are identity documents, their SSSTS, SMSTS, CISRS Supervisor and Driver CPC tickets with their numbers and run-out dates, whether they need Driver CPC and the periodic training hours you read off their DVSA record, the driving licence categories you read on their DVLA record and the day you checked them, the date they left if they have, the days you mark them off, the job cards you send them, the sign-in the desk mints for them, the hours they put in and the name of whoever agreed them, each day they sign in for work with the time, where they said they were and, only if they allow it, where their phone was at that moment (cleared after ninety days), a scrambled copy of a random number their phone keeps for this app, the times they tapped Left the yard and Finished for the day, each time they tapped where they are now after signing in with the place they said and, only if they allow it, where their phone was at that moment (cleared after ninety days), which of your team you appoint to sign them off and the name of the one who saw them in, and the name, phone number and note for whoever you ring if something happens to them. If you press This is the yard, one position from your phone for where the yard is. The compliance sheets and company certificates you upload, which can carry a name or a signature. The lorry walkarounds your drivers send, with the driver’s name, the defects and the photographs. The lorry runs you plan, with which of your team you put down to drive each one. The sites you set up for your developments, with a note for your team that can carry a name. The harness register and each person’s harness checks, with the name of whoever checked. Job forms, council licences and the RAMS you upload, which can carry a name or a signature. And site photographs, which can catch a face, a window or a number plate whether or not you meant them to. If an accident is reported, what happened in the words of the person who was there, when and where it happened, who they say was hurt, what they say the injury was, whether that person has gone to hospital and which one, whether they asked for next of kin to be rung, any contact a person who is not on your books gave at the time, and the photographs taken with it.
Whose data. Your customers and their site contacts, your own chargehands and gang members, your own employees, the people they name as next of kin, who have never used this app and may not know they are on your record, anyone hurt on one of your sites whose accident somebody writes down, including people who do not work for you, and anyone who happens to be in frame when a photograph is taken.
Special category data. One kind, in one place, and nowhere else. An accident report may carry data concerning health, because what somebody writes down about an injury is health data whatever words they use. Everywhere else the answer is still no: the desk is not built for health, biometric or criminal offence data and you must not put any in it. There is no box for anyone’s health, their religion, their union membership, their politics, their sex life or their criminal record outside the accident book, and a free notes field is not one. That includes the note beside each person’s next of kin, which is for reaching somebody and not for what is wrong with them, and which says so above the box.
Not biometric data. A photograph of a chargehand is not biometric data: it becomes that only when it is processed to identify somebody automatically, and nothing here does that. It is a picture on a list.
Next of kin. What we do with it is narrower than what we do with everything else on this page, and it is set out in full in the privacy notice under Next of kin. In short: only you and the person whose record it is can read it, it is not in the payload of the screen your team are listed on, and nothing in this app reads the note, scores it or forms any view about it whatsoever. It is never printed, never on a sheet, never exported, never sent to your accounting software and never on the link you text a chargehand. We never contact the person you named, by any means, ever.
UK GDPR Article 28(3)(a)
We process this data only on your documented instructions. Your instructions are: these terms, the Terms, and whatever you do in the app. We will not use it for our own purposes.
That includes transfers out of the UK: we only send it where these terms say we do, and the list is under Data leaving the UK below.
If the law ever forces us to process it some other way, for instance a court order, we will tell you before we do unless that same law forbids us from telling you. If we think an instruction of yours would breach data protection law, we will say so.
UK GDPR Article 28(3)(b)
Only people who need access to run the service get it. Every one of them is under a written duty of confidence that survives them leaving. That covers our staff and anyone we contract with.
UK GDPR Article 28(3)(c)
We take the measures Article 32 requires. In plain terms: your book is behind row level security in the database, so another yard cannot read it and neither can a signed-out visitor. It is encrypted in transit and at rest. Passwords are never seen by us. Administrative access is limited to what is needed to run the service and is not used to browse a yard’s book. Feedback sent from inside the app, by you or one of your team, is what the sender chose to write to us, and reading it is not browsing the book.
The gang link is a capability link: access by possession, not by identity. It shows one gang one day of addresses and a camera. No prices, no invoices, no customer book, no other chargehand’s work, and nothing that can delete anything. Treat the link itself as a credential and do not post it anywhere public.
Someone signed in with a code is the other way round: it is identity and not possession, and their sign-in owns no part of your book. They read their own record and nothing else, and that is the database refusing them rather than the screen not offering it, so it holds even if they go round the app entirely. Since 15 September 2026 everyone on Your team also holds a gang link, so you can send them a job, and their page opens it for them: what they see there is exactly the gang link above, for the jobs you sent them. Their next of kin is not on their card and is not on the gang link, because a link that works for whoever holds the phone is the wrong place for somebody else’s phone number.
Site photographs are deleted automatically twelve months after the job is struck, the gang’s photographs with them, so a street photograph does not sit in a bucket for ever. Delete the job sooner and they go with it. The one exception is a photograph you put on a scaff tag record: that is your instruction to keep it as part of the scaffold’s record, so it stays with the record until you take it off, delete the record or delete the job, and then goes on the same clock.
UK GDPR Article 28(3)(d)
You give us general written authorisation to use the sub-processors below. Each is under a written contract that puts it under the same obligations these terms put on us, and we stay liable to you for what they do.
That is the whole list. If we want to add one or swap one, we update this page and email the address on your account at least 30 days before the new company starts work. You can object in that window, in writing, on reasonable data protection grounds. If we cannot resolve it you may cancel, and we refund the unused part of the month you have paid for.
Xero, QuickBooks and Sage are not on this list because they are not ours. If you connect your own Xero organisation, QuickBooks Online company or Sage business and send an invoice to it, we pass that invoice, its lines, your customer’s name and the reference to it on your instruction, and read back whether it is paid. Each acts under your own agreement with it, as your provider.
OpenStreetMap is not on this list either, because no record from your book is sent to it. On the job map, and on the map of the day’s jobs your team see above their list, the browser or phone fetches the pictures of the streets from OpenStreetMap’s tile servers, and the pins for your jobs are placed by the app from a table of postcodes held inside it. The map opens framed round the postcodes of your jobs, so the first pictures asked for are of those areas, but no job, customer, address or postcode is sent, and no one’s position. The privacy notice says what the browser’s own request carries.
Apple is not on this list either, because nothing that identifies anyone is sent to it. For the forecast on the desk, our server sends Apple’s WeatherKit a point near your yard and, once you set your own wind figure, a point near each standing scaffold, each worked out from a postcode and rounded to about a kilometre. No name, address, postcode, job or customer goes with it, and no one’s position.
UK GDPR Article 28(3)(e)
If one of your customers asks you for a copy of what you hold, or asks you to correct or delete it, that request is yours to answer. You can do all of it yourself in the app: the record is on the job, Backup gives you a portable copy immediately, and deleting the job deletes the photographs with it.
The same goes for one of your own team, and most of it they can do without asking: their own page already shows them what the desk holds about them, which is a subject access request half answered by a screen. Correcting their record is yours, because they cannot change it themselves. Taking their next of kin off is three empty boxes on your side, so a request from the person they named, who is entitled to ask you the same questions they are, never needs a support call to us.
Where the app cannot do it, write to support@scaffyard.com and we will help you answer inside the month the law gives you. We do not charge for that.
If a request comes to us instead of you, we will not answer it. We will pass it to you, because you are the controller and the answer is yours to give.
UK GDPR Article 28(3)(f)
If personal data of yours is breached, we tell you without undue delay and in any event within 48 hours of us becoming aware. We tell you what happened, what data, roughly how many people, what it is likely to mean and what we are doing about it. Reporting it to the Information Commissioner inside 72 hours is your call as the controller, and we give you what you need to make it.
We help you with data protection impact assessments and with any consultation of the Commissioner that follows, so far as it concerns what we do and what only we can tell you.
UK GDPR Article 28(3)(g)
Take your copy first. Backup downloads everything on the desk as JSON whenever you want one, for as long as the account is open: the jobs, the company card, your staff records without their next of kin, the day cards, the fleet with its walkarounds and lorry runs, the harness register, the near miss log and the records on each job, with the names of the photographs and files but not the files themselves. That is the return part, and it is in your hands rather than ours so it cannot fail on our side. The copy holds personal data about your people and your customers, so keep it where only you can open it.
When you close the account, deletion happens straight away and it is not reversible. It takes the jobs, quotes, kit lists, hire periods and invoices, the company card, rates and bank details, every site photograph including the gang’s, your staff records and everything on them, the accident book with every report and every photograph on it, the near miss log with every record and the trail of every change your company made to one, the fleet with its walkarounds and lorry runs, the harness register, every file you uploaded, and the sign-in record itself. A card subscription is cancelled first, and if we cannot prove it cancelled we stop and leave the account open rather than delete the only record of who was paying. We cannot get any of it back for you afterwards, so do not ask us to hold it as a favour: there is nothing to hold.
The JSON backup does not include accident reports. Print the ones you want to keep from the accident book before you close the account, because closing it deletes them and there is no other copy.
Your scaff tag records are in it without their photographs, but restoring a backup replaces the jobs they sit on, so it clears them from the desk and does not put them back. Print the tag and photo pack from any job whose records and photographs you want to keep, before you restore and before you close the account.
Your staff records go on the way out even though the desk will not let you delete one while the account is open. Those are two different things and both are deliberate: an employment record must survive someone being taken off the books, and nothing at all survives you closing the yard.
If you would rather we deleted it than you took a copy, close the account without taking a backup. That is the same action.
One exception, which the law requires: the billing record, meaning that a subscription existed, what was paid and when. UK tax and company law make us keep those for six years after the accounting period. That is storage required by law, which Article 28(3)(g) allows. It holds no job, no customer and no photograph.
UK GDPR Article 28(3)(h)
Ask at support@scaffyard.com and we will give you what you need to satisfy yourself we are keeping to these terms: what we hold, where it sits, who our sub-processors are and what protects the transfers. Most of it is already on this page and in the privacy notice.
You can audit us, or have an independent auditor you appoint do it, once in any twelve months on 30 days’ written notice, or at any time after a breach affecting your data. Audits happen in working hours, must not disturb the service or another yard’s data, and the auditor signs a confidentiality undertaking first. You pay your own costs, and ours if the audit takes more than a working day.
DPA 2018 Schedule 1, Part 1, paragraph 1(b) and Part 4, paragraph 39
An accident report can say what somebody’s injury was, and that is data concerning health. UK GDPR Article 9(1) prohibits processing it at all unless a condition in Article 9(2) applies. The condition is Article 9(2)(b), processing necessary for carrying out obligations in the field of employment law, and never consent: consent from an employee to their employer is not freely given, and a safety record someone could withdraw on a Tuesday afternoon would not be a record. The domestic condition Article 9(2)(b) requires is DPA 2018 Schedule 1, Part 1, paragraph 1, and its limb (b) requires an appropriate policy document. This clause is that document, and the two paragraphs that follow are what paragraph 39 of Part 4 of that Schedule asks a policy document to contain.
Where the person hurt is not one of your team. Article 9(2)(b) is about employment, and a member of the public who gets hurt on your site is not your employee, so it does not reach them on its own. Two things cover that case and both are named here rather than one of them being stretched. The first is that the duty to write down and report what happened does not stop at your own payroll: RIDDOR 2013 makes the responsible person report an injury to somebody who is not at work, and section 3 of the Health and Safety at Work etc Act 1974 is the duty it hangs off. The condition for that is DPA 2018 Schedule 1, Part 2, paragraph 6, the substantial public interest condition for the exercise of a function conferred on a person by an enactment, and paragraph 6(1)(c) requires an appropriate policy document as well, which is this one. The second is that YOU are the controller of that record. Which condition you rely on is yours to hold and not ours to choose for you, and the paragraph below says what you need of your own.
This document is ours, and you need one of your own. Bond Labs is the processor and this clause is Bond Labs’s appropriate policy document, published here so you can see that one exists rather than take our word for it. You are the controller of your own team’s data and of anybody hurt on your sites, so the same Schedule puts the same requirement on you: you must have an appropriate policy document of your own, in place at the time the processing is carried out. Using the accident book without one is not something this contract can do for you, and it is not something we can tell whether you have done.
How we keep to the principles. An accident report is held for the single purpose of recording that somebody was hurt and getting that fact to the yard, which is the employer. It is asked for in plain boxes with no health question in them, so what is written is what the person writing it chose to say. It is readable only by the yard that owns it, proved by the database and not by a screen, and by the person who filed it, who is shown back only what they typed themselves. It is on no invoice, no sheet, no export and no backup file. It is never analysed, scored, searched or summarised, and nothing in this product forms or offers any view about an injury or about anybody’s fitness to work. No accident report is sent to any AI model, to any sub-processor beyond the ones named in clause (d) that host the service, or to any authority. Reporting anything under RIDDOR 2013 is the yard’s duty as the responsible person and this app neither does it nor decides whether it applies.
How long we keep it and when we erase it. An accident report and its photographs are kept for three years from the day the accident happened, or three years from the day it was written down if that is later, and are then deleted automatically, every night, by a job that reads nothing but that date. The later of the two days is what a report written up after the event is kept from, so it is never held for less than three years from the day the yard got it. The date is worked out by the database when the report is written and cannot be moved by anybody using the app. Closing the account deletes the whole accident book at once, which is sooner and never later. There is no other copy: accident reports are not in the JSON backup, so a yard that wants to keep one prints it. If an erasure request reaches us instead of the yard we pass it to the yard, as clause (e) says, because the yard is the controller.
We review this clause whenever the accident book changes and at least once a year, and we keep it published here for as long as we hold any accident report and for six months after the last one is deleted. We will make it available to the Information Commissioner on request, free of charge, which is the third thing paragraph 39(3) asks for and the one a document published on a public page answers by existing.
Your book and your photographs are stored in London and the app runs in London. But four of the five companies above sit outside the UK and their staff can reach the service to support it, so some of this data crosses a border. Here is who, where, and what makes it lawful.
The UK Addendum is the transfer contract the Information Commissioner approved for sending personal data out of the UK, and it is an Article 46 safeguard. Ask us at support@scaffyard.com and we will send you a copy of the terms we rely on for any one of them.
These terms last as long as we process personal data for you. Where they and the Terms disagree about data protection, these win. Everything else in the Terms still applies, including the liability limit.
If we change these terms we will post the new version here and email the address on your account before it takes effect. English law. Courts of England and Wales.
Bond Labs Limited, registered in England and Wales, company number 17285766, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. Write to support@scaffyard.com.
Last updated 9 October 2026.