Privacy Policy

Effective date: 6 November 2026

Data controller: CloudServe Solutions Ltd, company number 17554555, registered in England and Wales at 10 Gardner Grange, Stockport, United Kingdom, SK5 8DG.

Privacy contact: privacy@cloudserveuk.com

1. Overview and scope

This policy explains how CloudServe uses personal information when you visit sitetools.uk or SiteTools Main Management, register an enquiry or account, buy or manage a subscription, use licensing or support services, or engage us for separately agreed design, development or hosting work.

CloudServe is the controller of its own enquiries, account administration, billing, service security and business relationship records. When a customer uses a dedicated Engineers Hub or another hosted product to store information about its employees or end-users, that customer normally decides why and how that product information is used and is its controller. CloudServe processes that information on the customer's instructions under the Data Processing Addendum. The customer's own privacy notice should explain its use of product information.

2. Personal information we collect

We may receive your name, role, company name and registration details, postal and billing addresses, email address, telephone number, enquiry content, staff conversation notes and support correspondence. Account records include your username or email, password hash, verification status, roles, session and login events. We do not ask you to send a password by email.

For SiteTools subscriptions, we record the selected product, plan, add-ons, licence and installation status, Direct Debit mandate or provider references, amounts, dates, payment status and accounting history. GoCardless collects bank details during its hosted Direct Debit authorisation. SiteTools Management uses provider references and payment results; it does not require you to enter a full bank account number into Management. Where a separate card payment option is expressly offered for another service, that provider handles the card entry and we may receive transaction references and limited billing details.

Technical records can include IP address, browser or device information, access and security logs, API events, product domain and server address, software version, signed licence or integrity check results, and the user or company associated with a request. The precise telemetry depends on the product and service used. We do not assume that every product sends the same device identifiers.

You provide most information directly. We may also receive information from a company administrator, GoCardless, an email delivery provider, or systems used to operate and protect the service. Contact, account and payment details needed for an order are necessary to provide it; without them we may be unable to create or continue the service.

3. How and why we use it

We do not use SiteTools account data for solely automated decisions that have legal or similarly significant effects on an individual. Staff review customer enquiries before activation. We do not send marketing email solely because you have registered an account; any optional marketing programme would require a separate lawful basis and updated notice.

4. Recipients and service providers

Authorised CloudServe staff receive information only as needed for their roles. Service providers may include hosting and infrastructure suppliers, Brevo for verification or service email, and GoCardless for Direct Debit authorisation and collections. GoCardless may also act as its own controller under its notice. A card provider such as Stripe applies only where a separate card payment option is actually offered. We may share information with professional advisers, regulators or law enforcement where required or justified by law. We do not sell customer information.

5. International transfers

Some providers may process information outside the UK. Where a transfer requires a safeguard under UK law, we use an applicable adequacy regulation or approved UK transfer agreement and carry out any required transfer assessment. Contact us for information about the safeguard relevant to your data. The location of a customer's hosted product and its onward processors is governed by its order and the Data Processing Addendum.

6. Security

We use measures appropriate to the service and risks, including access controls, password hashing, encrypted web connections, security logging and restricted administrative access. The controls used by a particular hosted product or supplier may differ. We review security arrangements as the service changes. No internet service can guarantee absolute security.

7. Retention

We keep enquiry records while handling the request and for a reasonable follow-up or dispute period. Account and service records are kept while a customer uses the service and afterwards for the period needed to complete termination, answer support questions, comply with law or establish or defend claims. Payment and invoice records are kept for the period required by tax and company law. Access, security and licence records are kept for the period needed to detect misuse, investigate incidents and meet legal duties, then removed under the applicable operational schedule. We review records when their purpose ends and delete or anonymise them unless another lawful reason to retain them applies.

For a managed SiteTools product, the standard recovery window is 92 days from cancellation taking effect or suspension. The service may be reactivated during that period after outstanding invoices and account eligibility are resolved. Before planned removal, we prepare an encrypted database export and email a protected download link to the verified company administrator; the archive password is sent separately. The customer may request uploaded files or another available export format before removal. A failed export, failed handoff, identity mismatch or legal hold pauses removal for review. Management keeps its encrypted database export for no more than 12 months after creation, unless a documented legal obligation requires a longer hold. The customer may request earlier deletion once the product has been removed or restored. Financial and other records retained for legal or dispute purposes follow their separate retention rules.

We do not apply a universal 14-day deletion period to CloudServe's controller records. Information in a customer's hosted product is returned or deleted under the Data Processing Addendum and its order; backup copies follow the documented recovery rotation.

8. Your rights

Depending on the circumstances, you may request access, correction, deletion, restriction or a portable copy of your information. You may object to processing based on legitimate interests, including the licence and security purposes listed above. Where we rely on consent, you may withdraw it without affecting earlier lawful processing. These rights have statutory conditions and exceptions.

Send a request to the privacy contact above. We may need to confirm your identity or clarify the information requested. We respond within the time required by law, normally one calendar month, with extensions where the law allows. Requests are normally free; a fee is charged only where the law permits. If your request concerns information held in a customer's dedicated product, contact that customer as controller; we will assist it where required.

9. Cookies

The public marketing pages currently do not set analytics or advertising cookies. Main Management uses an essential session cookie and an installable PWA that caches public static files only. Engineers Hub uses session and optional remembered-device cookies, and its offline workspace can store permitted snapshots, drafts and queued changes on the device. GoCardless may set its own cookies when you visit its hosted payment pages. See the Cookie and Browser Storage Policy for details and controls. We will review consent requirements before adding any non-essential tracking.

10. Complaints and changes

Email the privacy contact above with a data protection concern or complaint. We will acknowledge and investigate it, keep you informed where it takes time, and tell you the outcome. You may also complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

We will update this policy when our processing changes and bring material changes to affected people’s attention where required.