Privacy Notice

1.Who we are

Surveyor Flow (“we”, “us” or “our”) provides a mobile-first survey workflow, evidence capture and reporting service for asbestos surveying professionals and the organisations they work for.

We are responsible for deciding how and why certain personal information is used, as described in this notice. For other information — particularly survey and project information that our customers enter about their own clients and sites — we normally act on the customer’s instructions. Section 8 explains this distinction.

If you have any question about this notice or about how we handle personal information, please contact us at support@surveyorflow.co.uk.

2.Scope of this notice

This notice applies to:

• this website, www.surveyorflow.co.uk, including its enquiry pages and the pre-launch access screen; and
• the Surveyor Flow application used by surveyors and surveying organisations.

It does not apply to any third-party website you reach from a link on our pages. Those organisations publish their own privacy information.

Surveyor Flow is currently in private testing. Some of the arrangements described here will change as the service moves towards general availability, and we will update this notice when they do.

3.Information we collect

The information we handle falls into the following groups.

Account and authentication information

Sign-in details, the email address associated with an account, and the organisation or team an account belongs to, together with the role held within that organisation.

Surveyor profile information

Information a surveyor provides about themselves for use on reports, which may include their name, professional title, qualifications and a signature image.

Organisation information

Details about the surveying organisation, including report branding, company details used on issued reports, and accreditation logos.

Survey and project information

Information entered or captured during survey work — client and contact details, site details and addresses, jobs, rooms, suspect materials, samples, laboratory information and results, photographs, attachments, report content, quality-assurance status and history, and issued report version history. This information is entered by our customers and may include personal information about people who are not our own users.

Enquiry information

Information you choose to give us when you contact us, such as your name, work email address, organisation and the content of your message.

Founder claim information

If you claim a place in our Founding 100 launch programme, we collect your name, work email address and company, and, if you choose to give them, your phone number and the number of surveyors in your team. We use this information to review your Founder application, to contact you about it, and to set up your access if the claim is approved. We keep a record of the claim and the decision taken on it.

Access and security information

While the site is in private testing, our access screen records the internet (IP) address and browser user-agent information associated with a request, and whether an access attempt succeeded. This is used to control and monitor access to the pre-launch site.

Technical and service information

Information generated automatically when the website and application are used, such as server and platform logs, error information, and synchronisation and device information needed to keep field data and the office view consistent.

We do not deliberately collect special category data (such as health information) or criminal offence data. Please do not include such information in free-text fields or photographs unless it is genuinely necessary for the survey work.

4.How we obtain personal information

We obtain personal information:

• directly from you, when you create or use an account, complete a profile, or contact us;
• from the organisation you work for, where it sets up accounts or team access for its staff;
• from our customers, where they enter or upload survey and project information relating to their own clients, contacts and sites; and
• automatically, from your device and our infrastructure, when the website or application is used.

5.Why we use personal information

We use personal information to:

• provide, operate and support the Surveyor Flow service;
• create and administer accounts, organisations and team access;
• enable survey capture, synchronisation, quality-assurance review and report production;
• produce reports that identify the responsible surveyor and organisation;
• respond to enquiries and provide customer support;
• keep the service and the pre-launch site secure, and detect, investigate and prevent misuse;
• maintain the reliability of the service, diagnose faults and improve how it works; and
• meet legal and regulatory obligations, and establish, exercise or defend legal claims.

We do not currently operate any third-party analytics, advertising or tracking on this website, and we do not sell personal information.

6.Lawful bases

UK data protection law requires us to have a lawful basis for using personal information. Depending on the situation, we rely on the following.

Contract, or steps taken before entering a contract

Where we need to use information to provide the service to you or to the organisation you work for, to administer accounts, or to respond to a request made before any agreement is entered into.

Legitimate interests

Where we have a genuine business interest that is not outweighed by your rights. This covers operating and improving the service, keeping it secure and preventing misuse, responding to business enquiries, maintaining service reliability, and keeping appropriate business records. You can object to processing based on legitimate interests — see section 15.

Legal obligation

Where we must use or retain information to comply with a legal or regulatory requirement, or to respond to a lawful request.

Consent

Where processing genuinely depends on your consent. Where we rely on consent, you can withdraw it at any time, and doing so will not affect anything done before you withdrew it. We do not currently operate marketing email functionality, so we are not relying on consent for marketing at this time.

Where we act on a customer’s instructions in relation to survey and project information, that customer is responsible for identifying its own lawful basis. See sections 7 and 8.

7.Customer survey and project information

Surveying organisations use Surveyor Flow to record their own survey work. That work often includes personal information about people who are not our users — for example a named site contact, a client representative, or an address that relates to an identifiable person.

Where this happens, the customer organisation decides what information to collect and why. We hold and process that information so the organisation can run its surveys, review them and issue reports. We do not use it for our own separate purposes.

If you are an individual whose details appear in a survey record and you want to exercise your rights over that information, the surveying organisation that carried out the work is usually the right first point of contact. If you contact us instead, we will help you reach them where we reasonably can.

8.When we act as controller and when we act on a customer’s behalf

We act as a controller — deciding how and why information is used — for the information we need to run our own business and service. That includes account and authentication information, organisation and surveyor profile information used to operate the service, enquiries and support, security and access records, and technical and service information.

Where a customer organisation enters or uploads personal information about its own clients, contacts, sites or survey work, we generally process that information on the customer’s behalf and in line with the service they have asked us to provide.

Business customers should be aware that they may have their own responsibilities as a controller for the personal information they put into the service, including telling the individuals concerned how their information is used.

9.Who we share information with

We share personal information only where there is a proper reason to do so:

• Within a customer organisation. Survey information is visible to colleagues in the same organisation according to their role — for example an administrator carrying out quality-assurance review.
• With service providers who help us run the service, as described in section 10. They act on our instructions and are not permitted to use the information for their own purposes.
• Where required by law, or to establish, exercise or defend legal claims, or to protect the rights and safety of people or the service.
• In connection with a business reorganisation, sale or transfer, subject to appropriate protections.

We do not sell personal information and we do not share it for third-party advertising.

10.Service providers

We rely on a small number of established providers to run the service:

Clerk

Authentication, accounts, and organisation and team functionality.

Supabase

Database, file storage and related backend services, including survey records, photographs, attachments and issued reports.

Vercel

Hosting and infrastructure for this website and the application, including platform logs.

Resend

Email delivery. We use Resend to send transactional email — acknowledgements when you submit a form, notifications to our own team about an enquiry or a Founder claim, and operational or security notifications such as an alert when the pre-launch access screen is unlocked. The name, email address and other details you put into a form are sent to Resend so that those messages can be delivered.

This website also loads its typefaces (IBM Plex) from Google Fonts. When your browser requests those font files, information such as your IP address is sent to Google in order to deliver them. We are reviewing whether to serve these fonts from our own infrastructure so that this request is no longer made.

We do not currently operate payment processing, and no payment provider processes customer payment information for Surveyor Flow at this time.

11.International data transfers

Some of our service providers are international organisations, and personal information may be processed or stored outside the United Kingdom.

Where UK data protection law treats a transfer as restricted, we will make sure an appropriate safeguard recognised under that law is in place — for example a UK adequacy decision, or standard contractual terms approved for use in the UK, together with any assessment that the law requires.

We are confirming the data locations and transfer arrangements of each of our providers, and we will update this section with that detail. If you would like to know the current position for a particular provider, please contact us at support@surveyorflow.co.uk.

12.How long we keep information

We keep personal information only for as long as is reasonably necessary for the purposes described in this notice, including providing the service, meeting our legal obligations, resolving disputes and maintaining appropriate business records.

How long that is depends on:

• the nature of the information and how sensitive it is;
• the purpose it is being used for;
• whether an account or customer relationship is still active;
• any legal, regulatory or professional record-keeping requirement that applies; and
• whether the information is needed for security purposes or in connection with a dispute or claim.

For survey and project information, retention and deletion also depend on the customer organisation and the service arrangement in place with it. Asbestos survey records are frequently retained by surveying organisations for long periods because of the professional and regulatory duties that apply to that work, and those decisions rest with the organisation rather than with us.

For enquiries and Founder claims, we keep the record for as long as we need it to deal with your enquiry or claim and to administer any Founder access granted as a result, and then for a reasonable period afterwards as a business record. Because a Founder place is a commitment we have made to a named person, we keep the record of an approved claim for as long as that access is in place.

We are formalising detailed retention schedules for each category of information, and this section will be updated when they are in place.

13.Security

We take appropriate technical and organisational measures to protect personal information. These include access controls that restrict records to the organisation they belong to and to the role a person holds, authentication managed by an established provider, encryption of information in transit, and use of established infrastructure providers.

No website, application or method of transmission can be completely secure, and we cannot guarantee that information will never be lost, accessed or altered without authorisation. What we can say is that we take these risks seriously and work to reduce them.

Please keep your sign-in details confidential and let us know promptly if you believe an account has been compromised.

14.Cookies and information stored on your device

We use one cookie on this website. It is strictly necessary to provide the service you have asked for, so we do not ask for consent to set it, but we explain it here so you know it is there.

We do not use analytics, advertising or tracking cookies on this website, and we do not use cookies to build a profile of you.

Information stored in your browser

Separately from cookies, this website saves a small amount of information in your browser’s local storage on your own device. This is used to remember anything you have typed into a form so it is not lost if you navigate away, to keep a local copy of anything you submit through the forms on this site, and to remember how you first arrived at the site. This local copy stays on your device and is not sent to us; the submission itself is sent to our servers, and a Founder claim is also recorded in our database, as described above. You can clear it at any time using your browser’s settings for clearing site data.

In the application

The Surveyor Flow application stores survey information on your device so that work can continue when there is no signal, and synchronises it when a connection returns. This local copy is part of how the service works.

15.Your rights

Under UK data protection law you have rights over your personal information. Depending on the circumstances and the lawful basis we rely on, these include the right to:

• be informed about how your information is used — which is what this notice is for;
• ask for a copy of the personal information we hold about you;
• ask us to correct information that is inaccurate or incomplete;
• ask us to delete information in certain circumstances;
• ask us to restrict how we use information in certain circumstances;
• object to our use of information where we rely on legitimate interests;
• ask us to transfer certain information to you or another organisation in a portable format; and
• withdraw consent, where we are relying on consent.

These rights do not apply in every situation, and we will explain our reasoning if we cannot do what you have asked.

If your request concerns survey or project information that a customer organisation put into the service, please see section 7.

16.How to exercise your rights

Please contact us at support@surveyorflow.co.uk. It helps if you tell us what you are asking for and give us enough detail to find the relevant information.

We may need to confirm your identity before we act on a request, to make sure we do not disclose information to the wrong person. We will respond without undue delay and within the time limits set by law — normally within one month, which can be extended for complex or numerous requests, in which case we will tell you. There is normally no charge.

17.Complaints

If you are unhappy with how we have handled your personal information or responded to a request, please tell us first so we have the chance to put it right. Email support@surveyorflow.co.uk with the word “Complaint” in the subject line and describe what has gone wrong.

We will acknowledge your complaint, look into it, and tell you the outcome and the reasons for it. If we need longer to investigate, we will keep you updated.

18.The Information Commissioner’s Office

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator. You can do this at any time, although we would appreciate the chance to address your concern first.

19.Children and our intended audience

Surveyor Flow is a professional tool intended for asbestos surveyors, surveying organisations and the people who work with them in a professional capacity. It is not directed at children and we do not knowingly create accounts for anyone under 18.

If you believe a child’s personal information has reached us, please contact support@surveyorflow.co.uk and we will look into it.

20.Automated decision-making and profiling

We do not make decisions about you solely by automated means that produce legal effects or similarly significant effects.

Surveyor Flow supports professional judgement; it does not make assessments or decisions in place of the qualified people using it. Section 13 of our Terms of Use explains this in more detail.

21.Changes to this notice

We will update this notice as the service develops — in particular as we connect the website enquiry forms, confirm our providers’ data locations and finalise retention schedules.

The date at the top of the page shows when it was last changed. Where a change is significant, we will take reasonable steps to bring it to your attention rather than relying on you to check.

22.Contact us

Please also see our Terms of Use.