Loading
Loading
ScaffYard
ScaffYard is a trading name of Bond Labs Limited. scaffyard.com. This notice is for the desk you run, not for the quote you send a customer.
If you are someone signed in with a code from your yard rather than the yard itself, the part written for you is under If you signed in with a code.
Bond Labs Limited is the controller. Company number 17285766. Registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. Write to support@scaffyard.com.
Every section below says what we do and, under it, why the law lets us do it. Those are the six lawful bases in Article 6 of the UK GDPR. We rely on three of them and we name which one each time.
You open a yard with an email address and a password. We hold the email so you can sign in and so we can reach you about the account. We never see the password itself.
That is the yard’s account. The owner can also give people in the office a sign-in of their own, each on their own email address: see Office logins below. Your own team sign in a different way and are never asked for one. See Your team below.
Why we may do it. You asked us for a desk and we cannot give you one without an account. That is the contract basis, Article 6(1)(b).
Jobs, kit lists, hire periods, invoices and your company card. That includes the name, address, phone, email, VAT number, company number and bank details you type. It also holds the lorry walkarounds your drivers send, with their defects and photographs, the lorry runs you plan, with who drives each one and what it carries, the sites you set up for your developments, with their address and your note for the team, the harness register and each person’s harness checks, job forms, council licences and the RAMS you upload. It holds the handover certificates you fill in on the job, with the name, position and finger signature of whoever signs each one for you and for your customer: a signature is kept as the line it was drawn with, against that job, and goes when the job is deleted. And your yard picture, if you put one up: it is shown on your own desk and nowhere else, and taking it off deletes it. We do not make up stock counts. A phone’s position is only taken when someone taps to sign in for work, as set out below.
Notifications, only if you switch on Tell me when a gang cannot work. We keep the address that device’s push service gives it: for a browser, the one its maker’s push service hands out, with the two keys that go with it; for the iPhone app, the device token Apple gives this app on this phone. Nothing else about the device. A browser’s notification carries nothing at all and the device asks us what to say; the iPhone app’s says only what kind of thing came in, such as an accident report or a job that came back not done, with no name or address in it. Switch it off, or close the account, and the address is deleted.
It is stored in a database in London and it is yours alone. Row level security means no other yard can read your book, and neither can a signed-out visitor.
Some of what you type is about other people, such as a customer contact name and phone number. For that data you are the controller and we are your processor. Only put in what you need for the job. Our processor terms set out what we may and may not do with it.
Backup downloads a JSON copy of what is on your desk onto your machine. It leaves out the accident book, anybody’s next of kin and the photographs and papers themselves, which keep only their names in it. Restore puts back the jobs and the company card and replaces the book. It does not merge.
Why we may do it. Holding your own book is the contract basis, Article 6(1)(b). For the parts that are about your customers we are not choosing anything: you decide, and we act on your instructions under the processor terms. Your own lawful basis for holding a customer’s details is yours to pick, and for most yards it is the contract with that customer or your legitimate interest in running the job.
You photograph the elevation when you quote and the scaffold once it is up. Both are kept against that job so the quote and the record still print correctly weeks later. A variation carries its own photographs too, of work a customer agreed to pay extra for, and they are kept against the same job on the same clock. Nothing in this app generates or alters an image, there is no filter on it, and no site photograph is sent to any model or any other company.
A photograph of a street can catch a neighbour’s window, a face or a number plate. So we do not keep them forever. Twelve months after you strike a job, its photographs are deleted automatically, the gang’s tag and damage photographs and the ones behind a variation with them. Delete the job sooner and they go with it.
The one exception is a scaff tag or finished photograph you have put on a scaff tag record for a scaffold on the job. That one is kept with the record for as long as the record and the job are on your book, because it is part of that scaffold’s record, the same as the inspection register beside it. Take it off the record, or delete the record, and it goes back on the twelve month clock from the day the job was struck: the next nightly sweep deletes it if that clock has already run, or if the job was struck with no strike day recorded against it.
Why we may do it. Storing them for you is the contract basis, Article 6(1)(b). Deleting them on a clock is not something we need a basis for, it is storage limitation, Article 5(1)(e), doing what it is there for. For anyone caught in the frame, you are the controller.
Your team holds each person: their name, a mobile number and, if you add one, a photograph. The photograph is optional and the desk works without it.
It never leaves your desk. It is not on any sheet a customer receives. It is visible to you, signed in, and to nobody else.
Switch someone off and their photograph goes with them, the file as well as the record. Close the account and everything goes. We do not use a face to identify anybody automatically: it is a picture on a list, which is why it is not biometric data in the sense the law means.
You can put your own team on the desk and give each one a sign-in. You type their name and nothing else. You are not asked for their email address, because they are not asked for one and this app will never email them: the desk files their account under an internal address at a domain the internet standards reserve to be undeliverable, so no mail can reach it, from us or from anybody who ever gets hold of it. They never see it and never need it.
They get in with a one time code you hand them, best while they are stood in front of you. We hold the hash of that code and not the code. It dies when it is used, dies a month after you give it, and dies on the fifth wrong guess. If they lose their phone they do not recover anything through an inbox, they ask you for another code, which is the point of doing it this way.
Their record is your record of them: their name, their scaffolding card number, their CISRS grade, their CPCS number and the categories on the back of it, and the heaviest lorry you say they can drive. It also holds photographs of their qualification cards, which you take and file against them, and their hours, which they put in and you agree. It can also hold the days you mark them off on the week: the day and nothing else, never a reason, and it stops nothing being sent to them. Nothing in this app judges any of it. There is no competence score, no traffic light, and the desk never compares what you typed against a job or against a lorry to allow or refuse anything. It is your record, not our opinion, and who may take a lorry out stays your tick on your own list. On Your team, Attendance adds up their sign-ins, the days you marked them off, the job cards you sent them and their hours over a stretch of weeks you pick, one line a person, and shows it to you and to nobody on your team: counts, never a score, listed in whichever order you pick, and nothing new is kept to make them.
A card photograph is an identity document and it is treated as one. It is held in private storage that nothing can read by guessing an address: every time it is shown, to you or to them, a fresh link is made that stops working half an hour later. Until then anybody holding that link can open it, so do not forward one. It never travels down a chargehand link, and a chargehand link cannot reach it at all. Delete the photograph, take them off the books, or close the account, and the file itself goes, not only the row that pointed at it.
Their hours are their word until you agree them. They put an entry in, it sits waiting with their name on it, and nothing counts as agreed until somebody at the desk says so. They can correct an entry while it is waiting and cannot touch one you have agreed. That is held by the database and not by the screen: there is no request they can make that agrees their own hours. If you set their pay (employed or CIS, the rate, a payroll number, a CIS person’s UTR), only you can read it: never them, their own rate included, and never their page or a link.
They see their own page and nothing else. Their name, their yard and their card number, big enough to hold up at arm’s length when a site manager asks them for it, their own qualification card photographs with the day each one runs out, and their own hours. It is the one place in this app where they write rather than read: they put their hours in there, and they sign in for work there. They cannot see your prices, your invoices, the rest of your book or anyone else’s record. That is held by the database rather than by the screen they are looking at: their sign-in owns no part of your book, so a request that went round the app entirely would still answer them nothing.
The jobs you send them. Your team and your gang are one list, so anyone on it can be sent a job. Their own page draws what you have sent them for today and tomorrow as the same job card a chargehand works from, so they tick it off there. That card shows what a chargehand’s does for the jobs sent to them: the customer’s name and number, the address, the kit, the RAMS, the site forms and the camera. Nothing you have not sent them, never a week ahead, and never a price. Take them off the books, or give them a leaving date, and that card stops opening.
Signing in for work. When they get to work they can tap Sign in for work on their own page. The time comes from our server, not their phone, and it is kept once a day: a second tap changes nothing. Their phone asks them once whether to share where it is. If they say yes, the position is taken at that moment, with the phone’s own estimate of how far out it may be, and again only if they tap to say where they are now later that day. There is no tracking and nothing runs in the background. If they say no they are still signed in, and you see that they said no. You see who signed in, when, how good the position was, a map of it, and roughly how far it was from the postcode of the jobs on their day. That distance is worked out on our server from a table of postcode districts; the position is not sent to a mapping company unless you press the map link yourself. It is their phone’s word and not proof: a position can be wrong and can be faked, so the desk never marks anybody late, absent or lying, and it moves no hours and no pay. The position is cleared ninety days after the sign-in; the time and the day stay on their record.
Where they said they were, and who saw them. They tap At the yard, On site or Somewhere else, which is their own word. If you stand in your yard and press This is the yard, one position from your phone is kept so the desk can say whether a sign-in at the yard was near it. Their phone keeps a random number of its own, made by the app and not taken from the phone, and our server keeps only a scrambled copy of it, so you are told when two people signed in off one phone and can say that is fine. They can tap Left the yard and Finished for the day, each timed by our server. Once they are signed in they can also tap where they are now, At the yard, On site or Somewhere else, until they tap Finished for the day. Each of those taps is timed by our server and takes one position the same way as the sign-in, and it is cleared ninety days after that tap. Their sign-in time never changes. Someone you appoint to sign others off sees only the people you tick for them: their sign-in time and place, never the position, and their waiting hours, which the person you appoint can agree with their own name on them. That person can never agree their own, and only you can take an agreement back off. None of it moves pay on its own.
Tickets, Driver CPC and training centres. You can record someone’s SSSTS, SMSTS, CISRS Supervisor and Driver CPC tickets with the number and run-out date, with or without a photograph, whether they need Driver CPC, and the periodic training hours you read off their DVSA record. You can also record the driving licence categories you read on their DVLA record and the day you checked them, for your insurer. The desk counts days to those dates and names the renewal course the scheme names, with a link to the scheme’s own page. It never says whether someone may do a job. Your list of training centres is yours, typed by you, and is not shared.
Take someone off the books and they cannot sign in from that second, and every code they were holding dies with them. Their record stays. It is your evidence of what they held and when they worked for you, and you cannot delete it from the desk even by tapping the wrong thing. Close the account and it goes with everything else.
One thing that is yours rather than ours: your team are your workers, so you are the controller of what you write about them and we are your processor. Tell each of them what you are keeping, their photograph included. They can read this page from their own sign-in, which is why part of it is written to them.
Why we may do it. Holding your staff so the desk can give them a sign-in is the contract basis, Article 6(1)(b), between you and us. Between you and each of them, the basis is yours to pick and it is usually the employment contract itself, Article 6(1)(b), or your legitimate interests in running a yard, Article 6(1)(f). Who you ring if something happens to them is not only their data, because it names somebody else: see the next section.
There is a box on each person’s record for who to ring if something happens to them. Three things: a name, a phone number, and anything else about reaching them, such as ring their sister first or their mum is hard of hearing.
A card number exists to be shown to strangers. This does not. Someone holds their card screen up to a site manager they have never met, and what is on it is what somebody is entitled to ask them for. Their sister’s mobile number is not on that screen: not smaller, not lower down, not behind a scroll. Not on it. On their own page it sits below the card, behind its own tap, shut every time. It is never printed, never on a sheet, never exported, never sent to your accounting software and never on the link you text a chargehand.
Two people can read it. You, signed in as the yard. And the person whose record it is, on their own page, so they can check you have got the right number without having to ask. Nobody else. That includes a chargehand looking at their own gang, and the reason is not squeamishness: a gang link works for whoever is holding the phone it was texted to, with no sign-in at all, and money was already judged too much to put behind one.
It is not a place for their health, and that was a decision rather than an oversight. There is nowhere in this desk for anyone’s health except the accident book, and there is not going to be one by accident. The note is for reaching somebody and the line above the box on your screen says so. Health data is what the law calls special category data, the rules that come with it are a different world from these ones, and the terms you accepted say you must not put any in the desk anywhere else.
The app does not read the note. It does not parse it, score it, search it or count it, and it will never tell you what any of it means. That is the same rule this app follows everywhere: you write it, you sign it, we supply the shape of it.
There is now one place in the desk where health data is allowed, and it is the accident book. If somebody gets hurt, what the person who was there writes down may say what the injury was. It is held for that one purpose, it is kept for three years and then deleted, and it is set out in full under The accident book below. The next of kin note is still not the place for it and the line above the box still says so.
The person you named has not heard from us. We never email them, we never text them, and there is nothing anywhere in this app that contacts them or that they can sign in to. They are on your record because the person on your team told you to put them there. What you tell them about that is between you and them: you are their controller and we are only your processor, so it is not a call we can make for you, and it is the kind of thing your HR adviser answers.
Taking it off is three empty boxes. Clear them and save, and there is nothing left on the record. It needs no support call to us and it works even though the desk will not let you delete someone’s record itself, because clearing a box is a change rather than a deletion.
How long. It lives as long as the rest of their record does. There is no separate clock on it and no date stamped on it, which is deliberate: it is three fields on the same row as their card, and inventing a second lifetime for them would be us deciding something that is yours. How long you keep an employment record is your call as their employer and your accountant’s. Close the account and it goes with everything else, at once.
Why we may do it. Holding it for you, so the desk can show it back to you, is the contract basis, Article 6(1)(b), between you and us. Between you and your worker, and between you and the person they named, the basis is yours to pick and it is usually your legitimate interests in running a yard, Article 6(1)(f). We do not pick it for you and we do not check what you picked.
The rest of this page is written to the yard that runs the desk. This bit is for you.
Your employer holds your record and decides what goes on it. We run the software it sits in and we act on your employer’s instructions rather than on our own: in the law’s words your yard is the controller and we are its processor. So if something on your record is wrong, or you want to know what is held about you, or you want the person you named as next of kin taken off it, ask your yard first. It can do all three itself and it does not need us to do any of them.
What exists because of your sign-in, and nothing else: the record your yard typed, the internal address your account is filed under, which is not a real address and can never receive mail, and the hash of the code you used to get in. There is no password you know. We never email you. There is no advertising anywhere in this app and nothing about you is sold to anybody.
If you send feedback from the foot of your page or your job card, the words you type come to us, with your yard’s name, what you are down as (Gang, Supervisor, Driver, Yard hand, or Employee if you have no link), and the screen you were on. That is not your yard’s record: we are the controller for it, and the Feedback section below says what we do with it.
If you write down an accident, it goes to your yard and to nobody else. What you type can say what the injury was, which is health information, and this is the only place in the app that holds any. You can see the reports you filed, with what you typed, and your own page also shows what was sent from your own link. You cannot see anybody else’s or anything your yard writes on yours. Ticking “ring next of kin” tells the yard to ring: the app rings nobody. A report is kept for three years from the day it happened, or from the day it was written down if that is later, and then deleted. If you want it corrected or taken off, ask your yard, as with the rest of your record.
If you tap Sign in for work, your yard sees the time, where you said you were, and where your phone was if you let it share that. It is taken once, when you tap, and never tracked. After that you can tap where you are now, At the yard, On site or Somewhere else, until you tap Finished for the day, and each of those taps is the same: the time, the place you said, and one position only if you let it. You can say no to location and still sign in. The position is cleared after ninety days. The app keeps a random number on your phone so the yard can see if two people signed in off the same phone; it is not taken from your phone and our server keeps only a scrambled copy. If the yard asks someone to sign you off, they see your sign-in time and place but not the position, and they can agree your hours with their name on them. Your yard can also see your sign-ins, the days it marked you off, the job cards it sent you and your hours added up over a stretch of weeks, as attendance figures beside the rest of its team. Nobody else on the team can, and they are counts, never a score.
You can still write to us at support@scaffyard.com, and you can complain to the Information Commissioner at ico.org.uk. If a request reaches us that is really for your yard, we pass it on rather than answer it, because the answer is your employer’s to give.
On the web, Stripe processes the card and we never see the card number. In the phone app, the store you bought it from processes the in-app purchase and RevenueCat tells us the entitlement. All we store about it is when the plan runs to, which plan it is, and where it was bought, so the desk can say where to change or cancel it. Only our server can write any of it. The app on your phone cannot grant itself a plan.
We do not take a payment until you complete a purchase. Cancel a plan bought on the web in the Stripe portal. Cancel a plan bought on a phone in Apple or Google subscriptions.
Why we may do it. Taking the money and keeping the plan straight is the contract basis, Article 6(1)(b). Keeping the billing record afterwards is a legal obligation, Article 6(1)(c): UK tax and company law make us hold those records for six years after the accounting period they fall in, and we cannot delete them sooner even if you ask.
These are our processors. Nobody else gets your book unless you send it somewhere yourself (Xero, QuickBooks or Sage, below), and we do not sell it.
Xero, if you connect it. When you connect your own Xero organisation and press Send to Xero on an invoice, that invoice, its lines, your customer’s name and the reference go to your Xero organisation, at your instruction, and we read back whether it has been paid. Xero is your provider, under your own agreement with Xero, not a processor of ours. Nothing goes to Xero until you connect it and send.
Sage, if you connect it. When you connect your own Sage business and send an invoice to it, that invoice, its lines, your customer’s name and the reference go to your Sage business, at your instruction. We read your accounts, VAT rates and customers so the invoice lands on the right ones, add a customer when an invoice needs one, and read back whether it has been paid. Sage is your provider, under your own agreement with Sage, not a processor of ours. Nothing goes to Sage until you connect it and send.
QuickBooks, if you connect it. When you connect your own QuickBooks Online company and send an invoice to it, that invoice, its lines, your customer’s name and the reference go to your QuickBooks company, at your instruction. We read your items, VAT codes and customers so the invoice lands on the right ones, add a customer when an invoice needs one, and read back whether it has been paid. QuickBooks is your provider, under your own agreement with Intuit, not a processor of ours. Nothing goes to QuickBooks until you connect it and send.
OpenStreetMap, on the job map and on your team’s jobs. The streets under the pins on the job map, and on the map of the day’s jobs a person on your team sees above their list, are pictures the browser or phone fetches straight from the OpenStreetMap Foundation’s tile servers, which may be outside the UK. Each of those requests carries the connection’s IP address and the part of the map on the screen, as it would if you opened openstreetmap.org yourself, and the web address of this site, which OpenStreetMap asks for, but not the page you are on. A map opens on the areas the jobs are in, so those are the first parts of the map asked for. We send nothing from your book: no job, customer, address or postcode. The app places the pins from a table of Great Britain’s postcodes held inside it and draws them on top. A map only fetches pictures while it is open and something is on it. Your team show on the job map only at the jobs on their cards, each at the one they last ticked that day, and no map ever shows a phone’s position. If we change the map provider, we name the new one here before it is used.
Apple Weather, for the forecast on the desk. The forecast on the Yard page and on the week comes from Apple’s WeatherKit, in the United States. To get it, our server sends Apple a point near your yard, worked out from the postcode on your company address, and, once you set your own wind figure, a point near each standing scaffold, from the postcode on its site address. Each point is rounded to about a kilometre before it goes. Nothing else goes with it: no name, address, postcode, job or customer, and no one’s position, and the request comes from our server, not from your phone or browser. Apple says it uses a location only to give the forecast, does not tie it to anyone and does not track it between requests. Because nothing that identifies anyone goes, Apple is not one of our processors, but this notice names it all the same.
That is the whole list of our processors. If we add one or swap one, we update this page and email account holders at least 30 days before the new company starts work, so there is time to object. The processor terms say what happens if you do.
Why we may do it. Using suppliers to run the service is part of giving you the desk, so it rides on the contract basis, Article 6(1)(b). Each of them is bound by a written processor contract and may only act on our instructions.
Your book and your photographs are stored in London. The app runs in London. But four of the five companies above are outside the UK, and their staff can reach the service to support it, so some of your data does cross a border. Here is exactly who, where, and what protects it.
The UK Addendum is the transfer contract the Information Commissioner approved for sending personal data out of the UK. It binds the company on the other end to UK standards and gives the people whose data it is a right to enforce it. That is an Article 46 safeguard. Ask us at support@scaffyard.com and we will send you a copy of the terms we rely on for any one of them.
Why we may do it. A transfer needs a safeguard, not a separate lawful basis. The safeguard is the Article 46 one named above. The processing itself is on the contract basis, Article 6(1)(b), as set out in each section.
If somebody gets hurt on one of your sites, the person who was there can write it down on their phone and send it to you. What they write can say what the injury was, and that is health data. This is the only place in the desk where it is allowed. Everywhere else the answer is still no: the desk is not built for health, biometric or criminal offence data and you must not put any in it, and that has not changed anywhere but here.
A report holds what happened in their words, when and where, who they say was hurt, what they say the injury was, whether that person has gone to hospital and which one, whether they are asking you to ring next of kin, one typed contact if the person hurt is not one of your team, and the photographs they took. Who to ring is not copied onto it: that stays on their own card and you read the live one when you open the report, so a three year old row can never send you to a number that has changed.
The app contacts nobody, ever. Ticking “ring next of kin” puts that on the report for you to see. It sends no message, makes no call and tells no authority. Reporting anything under RIDDOR 2013 is your duty as the responsible person, and this app does not do it and does not decide whether it applies. Nothing in the product offers any view about an injury or about anybody’s fitness to work.
Only the yard that owns the report can read it, and that is the database refusing anybody else rather than a screen not offering it. Whoever files one sees their own back, with what they typed, and never what you wrote on it and never anybody else’s. On a gang link that means the reports filed FROM THAT LINK, so it works the way the rest of a link works: whoever is holding the phone it was texted to. On someone’s own signed-in page it is what they sent signed in and what was sent from their own link while it was theirs, even if you have since switched that link off or deleted it. Once you say they have left, their sign-in reaches none of it. Your team cannot reach the accident book at all; your office logins can, because they work the desk with you. It is on no invoice, no job sheet, no export and no backup file, and the only sheet it is ever on is the print of the report itself. Nothing about it is sent to any AI model: the one thing ever read by one is a file you choose to bring your records in with.
A report is kept for three years from the day the accident happened, or from the day it was written down if that is later, and is then deleted automatically, the photographs with it. Closing the account deletes the whole book at once. Printing a report is the only way to keep a copy, and the printed sheet carries your company’s name, never ours, and no next of kin.
A notification about an accident says an accident report came in and nothing else. Never a name, never the injury, never where. A notification travels through Apple’s or Google’s servers and is read off a lock screen by whoever is stood there, so what is in the report stays behind your own sign-in.
Why we may do it. Holding what is in an accident report is special category data, so it needs a condition under Article 9 as well as a basis under Article 6. Where the person hurt is one of your team the Article 9 condition is Article 9(2)(b), employment, with DPA 2018 Schedule 1, Part 1, paragraph 1. Where they are not one of your team that condition does not reach them, and the one that does is Part 2, paragraph 6 of the same Schedule: the substantial public interest condition for a function conferred by an enactment, which is what your duty under RIDDOR 2013 and section 3 of the Health and Safety at Work etc Act 1974 is. Both need an appropriate policy document and ours is published in the processor terms, which also says why you need one of your own. The Article 6 basis is the contract, 6(1)(b), the same as the rest of the desk. Deleting it at three years is storage limitation, Article 5(1)(e).
Jobs and invoices stay until you delete them or close the account. Site photographs go twelve months after the job is struck, except one you have put on a scaff tag record, which stays with that record. A compliance sheet you upload against a job carries a keep-until date of twelve months from the day it goes up, printed on the job so you can always say what you hold and for how long. Close the account and everything goes at once, except the billing record, which we must hold for six years, and a scrambled fingerprint of the account’s email (never the email itself), kept only so the same email does not get a second free month.
A walkaround with nothing wrong is deleted 3 months after the day of the check, and one with a defect 15 months after the day it was repaired. A defect with no repair on it is kept.
Everything means the files as well as the rows, and that is worth saying plainly because it is the part that is easy to get wrong. Closing the account sweeps the photographs, the qualification card images, the compliance sheets and your company’s own certificates out of storage, not just the records that point at them. Deleting a job takes its compliance sheets with it. Taking someone off the books takes their card photographs with them.
Someone’s record stays on your books after they leave, which is why the desk will not let you delete it. How long you keep an employment record is your call as their employer and your accountant’s, not ours, and we do not put a clock on it. That covers who you ring about them as well: it is three fields on the same row and there is no separate clock on them, which is said again under Next of kin.
The one thing on someone’s record that does have a clock is where their phone was when they signed in for work. That position is cleared ninety days after the sign-in, because it has done its job once you have seen they turned up. The time and the day stay.
An accident report and the photographs taken with it are kept for three years from the day the accident happened, or three years from the day it was written down if that is later, and are then deleted automatically. A report of something that happened a while ago is what the second half is for: it keeps its full three years from the day it reached the yard rather than arriving already out of time. That clock is set by our database from those two days, and after that nobody using the app can move it: the date it happened cannot be put in the future and cannot be put more than three years back, the day it reached us is our server’s own, and neither is ever worked out on the phone. Accident reports are not in the JSON backup, so printing one is the only way to keep it, and closing the account deletes the whole accident book at once.
A near miss is kept on the same three year clock, from the day it happened or the day it was written down, whichever is later, and is then deleted automatically. A near miss is something that nearly went wrong where NOBODY WAS HURT, so the log holds no health data at all and has no box that asks for any: if somebody was hurt it is an accident report and it goes in the accident book, under the stricter rules set out above. What a near miss holds is what happened, where, when, who saw it and what was done about it. What they wrote cannot be changed by anybody afterwards. What your company writes on it, and whether you have closed it off, can be changed, and every one of those changes is kept beside the record with the day and the time. Whoever filed it is shown back what they typed and never what your company wrote on it. Near misses are in the JSON backup, so a copy taken before you close keeps them, and closing the account deletes the whole log at once.
Why we may do it. Keeping only as long as we need to is storage limitation, Article 5(1)(e). The six year billing record is the legal obligation basis, Article 6(1)(c). Your own team’s records are yours: you are their controller, so how long is necessary is a decision you make and we hold what you keep.
On Bring your yard in you can bring in your customers, your team and their tickets, your vehicles, your kit, the jobs you have up and what your customers owe you, from the records you keep now. A spreadsheet laid out with headings we know is read on our own server and goes nowhere else. A photo, a scanned PDF, or a spreadsheet we cannot read by its headings is sent, only when you choose to bring it in, to Anthropic, PBC, to be read by its Claude model, and what it found comes back to your screen. Nothing else is sent to Anthropic: not your name, not your account and nothing else off your desk.
Nothing you upload is kept by us. The file is read and let go, what was found stays on your screen until you import it or leave the page, and only the rows you import go on your desk, where they are kept like anything else you put there. A list of your team carries names, phone numbers and tickets, so bring one in only if you would type the same into Your team.
Why we may do it. You are bringing your own records onto your own desk, at your instruction. For the people and customers on those records you are the controller, on whatever basis you already hold them, and we process them for you as your processor, as for everything else on the desk.
If you email support@scaffyard.com, we keep the thread long enough to answer it. We do not sell that mailbox.
Why we may do it. Legitimate interests, Article 6(1)(f). The interest is answering a customer who wrote in and being able to show what we told them if it comes up again. That is a low expectation to overturn: you wrote to us. Tell us to delete the thread and we will, unless it is evidence in a dispute between us.
The desk, someone’s own page and a job card each have a feedback box addressed to us. What is sent is kept on a list only we can read, and a copy is usually mailed to support@scaffyard.com: past a set number in one day, the rest are kept on the list and not mailed. We keep the words, the company name on the yard’s card, whether it came from the yard or from one of its team as Gang, Supervisor, Driver, Yard hand or Employee, the screen it was sent from and the time. We do not keep a job link, and feedback from one of its team carries no address to answer them on. Resend carries the mail, as it does the rest of our email.
It goes when the yard’s account is closed. Someone deleting only their own login does not take back what they sent, because it is kept against their yard and not their login. Anybody can ask us to delete something they sent and we will.
Why we may do it. Legitimate interests, Article 6(1)(f), and for this Bond Labs is the controller. The interest is hearing from the people using the app so it can be put right. You chose to write to us, which is a low expectation to overturn.
We log enough to see that the service is up, to spot someone trying doors, and to work out what went wrong when a page fails. We do not build a profile of you out of it.
Why we may do it. Legitimate interests, Article 6(1)(f). The interest is keeping other people’s yards out of your book and keeping the service running. Nobody expects a service to leave itself open, so this does not override your rights.
You can ask for a copy of personal data we hold, ask us to correct it, erase it, restrict it, or object. You can ask for a portable copy, and Backup gives you one immediately. Write to support@scaffyard.com. You can complain to the Information Commissioner at ico.org.uk.
Where we rely on legitimate interests you can object, and we stop unless we can show a reason that outweighs yours. Where we rely on a legal obligation, erasure does not apply to that record until the six years are up. There is no automated decision making here. The one place records about a person are added up is Attendance on Your team, shown to the company alone, deciding nothing: any decision is yours. Nothing reads anyone’s grade, their card, the tonnage you wrote against them or anything in their next of kin note to decide anything at all, and it never will.
Bond Labs Limited is registered with the UK Information Commissioner's Office under registration number ZC188014.
Close the account with Close account, in Settings or on About. That deletes the jobs, the photographs, the company card, your staff records and everything on them, and the sign-in itself. A card subscription is cancelled first. A store subscription must be cancelled in Apple or Google, because only the store can do it.
A quote, invoice or kit list you send is from your company. We are not a party to that job. Do not put our name on it.
When you confirm a handover, record an inspection or off hire a job, the desk makes the document for that job’s customer as a PDF, and it goes from your own email, never from ours: from the mailbox you connect under Your email in Settings (your own mail server, or Microsoft), or, when none is connected, from your own email app when you press Send to customer. To send from a connected mailbox we keep its app password, or the lasting sign in Microsoft gives, encrypted, used only to send these emails, never shown back to anybody, and deleted when you disconnect. Your own email provider carries the email, under your account with them. Each of the three can be switched off in Settings, and every one, sent or not, is listed under Emails sent to customers. For the customer’s details you are the controller and we act on your instruction.
Each job can have its own page for your customer, at an address on this site that cannot be guessed, showing your company and never ours: where the scaffold is up to, the handover certificate once it can be issued, each inspection with its day and who did it, and, unless you switch them off, the photographs from site and the invoices with your Pay now link. It never shows your costs, your wages or your notes. The address goes in the handover, inspection and off hire emails, and you can send it yourself. You can turn it off or give a new one at any time, and it stops if your desk closes.
On that page your customer can tell you they have finished with all or part of the scaffold, or ask you for a change. We keep the name they give, what they chose or wrote, and when, on the job for you, and nothing on the job moves until you act on it. A customer who was not there at the handover can sign for it on their own phone through a link you send, which works once and runs out after 14 days, and the name, position and signature they give go on the certificate.
The scaffold tag is a code printed on the handover certificate, each inspection record and the tag label. Anyone who scans it sees your company, its logo and phone number, a short reference for the scaffold, whether it is safe to use, and the last inspection with its day and the name of whoever did it, as a paper tag would show them. It never shows the customer, their address or any money. A new code stops every one printed before it. If you inspect scaffolds for a yard, your name shows there.
Why we may do it. Showing the page and the tag is part of the desk you subscribed to, the contract basis, Article 6(1)(b). For what is about your customers and your team you are the controller: you decide, and we act on your instructions under the processor terms. Tell your customers about their page, and your team that the tag shows who inspected.
The owner can give up to five people in the office a sign-in of their own, depending on the plan. Each is a separate login on that person’s own email address, made when the owner adds them, and the link to sign in goes to that address from us.
An office login works the desk with you: jobs, invoices, wages, Your team, and the accident book, which can hold health information (see The accident book). It cannot start, change or end the plan, add or remove office logins, restore a backup, see attendance, take anyone off Your team, or close the account. Those stay with the owner.
For each one we hold the name and email you typed, when they were added and by whom, when they last signed in and when their last sign-in link went. Where the desk notes who did something, it notes which of them it was.
Removing one deletes their sign-in at once. Their name and email stay on your list of office logins, so the desk can still say who did what, until the account closes. Closing the account deletes every office login with it.
Why we may do it. Holding your office logins so the desk can give them a sign-in is the contract basis, Article 6(1)(b), between you and us. Between you and each of them, the basis is yours to pick and it is usually their employment contract, Article 6(1)(b), or your legitimate interests in running a yard, Article 6(1)(f).
Last updated 9 October 2026.