Privacy Policy

Last updated: 1 July 2026

The Construction Bible ("we," "us," or "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, and protect your personal data when you use our platform, which serves as a database connecting construction workers ("Subbies"), service providers/suppliers, and contractors.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the data controller is The Construction Bible.

This policy is written in plain English. If anything is unclear, please contact us (see Section 11).

1. The Data We Collect

We collect and process different types of personal information depending on your role on the platform and which features you use:

• Identity Data: Full name and date of birth.
• Contact Data: Email address and phone number.
• Account & Profile Data: Company name (if applicable) and your trade/profession.
• Professional Data (Workers): Skillsets, work history, qualifications/tickets (including CSCS cards) and (where provided) profile verification documents.
• Identification Data (Workers): National Insurance (NI) number. Your NI number is used to check qualifications and is not stored.
• Visual Data: Profile images and portfolio pictures you upload.
• Location Data: Your location and/or working radius so contractors can find you.
• Financial Data: Subscription and payment status information. Card and payment details are processed by our payment provider (Stripe). We do not store full card numbers on our servers.
• Communications Data: Your communication preferences and records of messages we send to you (for example expiry reminders).
• Technical & Usage Data: IP address, browser type, device information, pages viewed, approximate location from IP, and how you use the platform (for analytics and security).

Some information may be classed as special category or high-risk data in practice (for example, identity/verification documents). We treat this information as sensitive and apply extra security controls.

2. How We Collect Your Data

We collect personal data in a few main ways:

• Directly from you: When you register, fill out or update your "Digital Work Passport", upload qualifications/tickets, upload portfolio images, add verification documents, contact us, or manage your membership.
• Automatically when you use the platform: Through essential cookies, server logs, and similar technologies (for example, to keep you logged in and to keep the platform secure).
• From service providers we use to run the platform: For example, payment confirmation and subscription status from Stripe, delivery status from email/SMS providers, and hosting/security logs.

3. How We Use Your Data

We use your information for the following purposes:

• To create and maintain your profile (Digital Work Passport): So you can store your details, qualifications/tickets and work history in one place.
• To let contractors find and contact workers: So contractors can search by location, skillset and qualifications, then contact you directly.
• To run and improve the platform: Including troubleshooting, testing, improving features, and personalising your experience (for example showing more relevant results).
• To administer memberships and payments (Premium): To set up and manage your subscription, billing cycle, invoices/receipts and payment status. Payments are processed via Stripe.
• Service-related communications: Such as account notices, security messages, and document/ticket expiry notifications (by email and/or SMS using providers like Resend and Twilio).
• To keep the platform safe and prevent misuse: Including monitoring for fraud, spam, unauthorised access and abusive behaviour.
• Marketing (optional): If you opt in, we may send marketing messages about our services and updates. You can opt out at any time.

We do not use your data for automated decision-making that has legal or similarly significant effects on you.

4. Lawful Basis for Processing

Under UK GDPR, we must have a lawful basis to use your personal data. Depending on what we are doing with your data, we rely on one or more of the following:

• Contract (performance of a contract): Where processing is needed to provide the platform to you, manage your account, and (if you choose Premium) take payments and administer your membership.
• Legitimate interests: Where we have a genuine business reason to use your data (and your rights are not overridden), such as running the platform, improving search results, preventing fraud/misuse, and connecting workers with contractors.
• Legal obligation: Where we must comply with the law (for example tax, accounting, fraud prevention, and where applicable right-to-work checks and HMRC-related requirements).
• Consent: Where you choose to provide optional profile data, upload certain optional content, accept non-essential cookies, or opt in to marketing. You can withdraw consent at any time.

If you want more detail on the lawful basis we use for a specific type of processing, contact us using the details in Section 11.

5. Data Sharing and Disclosure

We only share personal data when it is needed to run the platform, provide the service, or comply with the law. We do not sell your personal data.

Who can see your profile on the platform

• Contractors/Hirers: Contractors searching the platform can see worker profile information such as your name, trade/profession, qualifications/tickets (including CSCS), skills, work history, and portfolio/profile images (where you have added them).
• Important: NI numbers and sensitive verification documents are not shared publicly. Your NI number is used to check qualifications only and is not stored.

Service providers (processors)

We use trusted third parties to help us operate the platform, such as:

• Cloudflare R2 (file and image storage)
• Railway.app (hosting)
• Stripe (payment processing for Premium memberships — Stripe's own privacy policy also applies)
• Twilio (SMS communications)
• Resend (email communications)

These providers may process personal data on our behalf, under contracts that require appropriate security and confidentiality.

Legal and safety reasons

We may share data with regulators, law enforcement, courts or other third parties where we reasonably believe disclosure is required by law, necessary to protect our users, or to enforce our rights.

6. International Transfers

We store data within the UK/EEA where possible. However, some third-party services we use may process personal data outside the UK/EEA.

Where personal data is transferred internationally, we take steps to make sure it is protected in line with UK GDPR. This may include using the UK International Data Transfer Agreement (IDTA), UK Addendum to EU Standard Contractual Clauses, and/or relying on adequacy regulations where they apply.

If you want more detail about where your data is processed, contact us using the details in Section 11.

7. Data Security

We use technical and organisational measures to protect your personal data from being lost, misused, accessed without permission, altered or disclosed.

Our measures include (but are not limited to):

• HTTPS encryption in transit (so data is encrypted when sent between your device and our platform).
• Access controls and permissions on our admin systems (including the Django Admin panel), so only authorised staff can access personal data.
• Secure storage for uploaded documents and images.
• Regular security reviews and platform maintenance.

No system is 100% secure, but we work hard to keep your information safe. If we ever have a personal data breach that creates a risk to you, we will notify you and/or the ICO where legally required.

8. Data Retention

We keep personal data only as long as we need it for the purposes in this policy, and to meet legal, accounting and reporting requirements.

Our typical retention periods are:

• User accounts: Retained for the duration of your membership plus 6 years after account closure (for tax, legal and accounting compliance).
• Communication preferences: Kept until you opt out or update your preferences (and we keep a record of your opt-out so we can respect it).
• Analytics data: Retained for 26 months.

If you ask us to delete your data, we will do so unless we have a legal reason to keep it (for example, to comply with tax laws or to deal with disputes).

9. Your Legal Rights

Under UK GDPR, you have rights over your personal data. These include:

• Right of access (ask for a copy of your personal data).
• Right to rectification (ask us to correct inaccurate or incomplete data).
• Right to erasure (ask us to delete your data), subject to legal retention requirements.
• Right to restrict processing (ask us to limit how we use your data in certain situations).
• Right to data portability (ask for your data in a usable format and/or to transfer it to another provider where it applies).
• Right to object (object to processing based on legitimate interests, and object to direct marketing).
• Right to withdraw consent at any time (where we rely on consent).

To exercise any of these rights, please contact us using the details in Section 11. We may need to confirm your identity before we act on your request.

10. Cookies and Third-Party Links

Cookies

We use cookies and similar technologies:

• Essential cookies for session management, authentication and platform security (these are required for the site to work).
• Analytics cookies (optional) to help us understand how people use the platform and to improve it.

Where required, we will prompt you to consent to non-essential cookies on your first visit, and you can change your choices later. See our Cookie Policy for more detail.

Third-party links

Our platform may include links to third-party websites (for example site services and suppliers such as tool hire or insurance providers). If you click a third-party link, that third party may collect data about you. We do not control third-party websites and are not responsible for their privacy policies.

11. Contact Us (and Complaints)

If you have questions about this Privacy Policy or want to exercise your rights, contact The Construction Bible using the details below:

• Email: contact@construction.bible
• Post: Construction Bible, 177a Chorley Road, Adlington, Chorley, PR6 9LP

If you are not happy with how we handle your personal data, you have the right to complain to the Information Commissioner's Office (ICO):

• Website: https://ico.org.uk/
• Phone: 0303 123 1113
• Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would appreciate the chance to deal with your concerns first, so please contact us before you approach the ICO.