Privacy Policy

1. Who we are and what this policy covers

Temporary Worx Ltd is a UK-based provider of temporary works engineering, inspection and software services. Our registered office is Unit 3 Plas Gwilym Industrial Park, 78 Llysfaen Road, Old Colwyn, Conwy, LL29 9HE. You can contact us about any data-protection matter at hello@temptag.co.uk.

This policy covers all three places we handle personal data:

• This website — the demo-request form and the shop order-enquiry form (section 3).
• The TempTag platform — the web application our customers use to manage temporary works, inspections, permits and records (section 4).
• TempTag Pro — the field app for Android and iOS (section 5).

It is written to meet the UK GDPR and the Data Protection Act 2018. Where we say "you", we mean whichever of these applies to you: a visitor to this website, a person whose employer uses TempTag, or a customer contact.

2. The two different roles we act in — please read this first

Data protection law distinguishes between the organisation that decides why and how personal data is used (the controller) and the organisation that handles it on the controller's instructions (the processor). Which one we are changes who you should approach about your data, so it matters more than anything else on this page.

• We are the controller for personal data submitted through this website, and for the contact and administrative details of the people who buy and manage a TempTag subscription. Section 3 and section 7 cover this.
• We are the processor for the personal data held inside a customer's TempTag account — the records of that organisation's workers, inspectors, supervisors and coordinators. The customer organisation is the controller of that data. It decides what goes in, who may see it and how long it is kept; we hold and protect it on their behalf under a written agreement, and we do not use it for our own purposes.

What this means for you in practice: if your employer gave you a TempTag login, and you want to see, correct or delete the data held about you in that account, ask your employer first — they control it. You can still contact us at any time and we will help, but where we act as processor we must refer the request to the customer rather than act on it ourselves. See section 10.

3. This website — enquiry and order forms

Demo / contact form — when you submit a demo request we collect the following information you provide:

• Full name
• Company name
• Work email address
• Phone number (optional)
• Job role (optional)
• Team size (optional)
• Interest / enquiry type (optional)
• Free-text message (optional)

Shop order-enquiry form — when you submit an order enquiry we collect the following information you provide:

• Full name
• Company name
• Email address
• Phone number (optional)
• Delivery address (optional)
• Order notes (optional)
• Product selected and quantity requested

For both forms we also collect technical metadata automatically: your IP address and browser user-agent string. This is collected for security (spam prevention and abuse detection) and is not used for profiling or tracking.

We process this data to respond to your enquiry — to arrange a product demonstration, to process or follow up on your order enquiry, and to follow up with you about TempTag. Our lawful basis is legitimate interests (Article 6(1)(f) UK GDPR) for demo requests, and steps prior to entering a contract (Article 6(1)(b) UK GDPR) for order enquiries. As a business submitting an enquiry for a B2B software product or placing an order, we have a legitimate interest and/or a contractual basis for contacting you to respond to that request. We have balanced this interest against your rights and freedoms and concluded that contacting you is reasonable and expected.

We do not sell or rent your personal data, and we do not share it with third parties for their own marketing purposes.

4. The TempTag platform — data held for our customers

TempTag is a workplace record system. Accounts are created by a customer organisation for its own staff and contractors; there is no public sign-up. For everything in this section we act as processor and your employer is the controller (see section 2).

Account and identity data — name, work email address, optional phone number, password, job title, role and permissions, the organisations and projects you are assigned to, and your sign-in history.

Competence and appointment records — qualifications, training, certificates and their expiry dates, the professional profile you maintain, and formal appointment records under BS 5975 including the electronic signature applied when an appointment is accepted. This is data about your professional competence and it forms part of a safety record, so it is retained deliberately and is not routinely deleted while it remains relevant to works that were carried out.

Activity and audit data — the inspections, permits, defects, hand-overs and register entries you create or approve, each recorded against your name with a timestamp. This is the core purpose of the product. Temporary works records evidence who checked what, and when, and they may be relied on in an investigation, an insurance claim or legal proceedings. An audit trail that could be quietly altered or erased would be worthless, so these entries are retained and are not editable after the fact.

Photographs — images captured as inspection evidence, attached to the record they belong to. These are photographs of temporary works, but people on site may appear in them incidentally.

Location data — the position of temporary works items and projects, including a what3words reference. Section 5 explains when the app reads the device's position.

Technical data — IP address, browser or device user-agent, and application and security logs.

Our lawful basis for holding this data is the customer's instruction under our contract with them. The customer, as controller, relies on its own basis — in practice usually its legal obligation under health and safety legislation to plan, supervise and record temporary works, and its legitimate interests in managing its workforce and evidencing compliance. We do not use customer data to train models, to build profiles, or for our own marketing.

5. TempTag Pro — the field app on your phone

The field app holds the same account and record data as section 4. This section explains the parts that are specific to running on a phone, because those are the parts people most reasonably want to check.

Permissions the app asks for, and exactly why:

• Location (precise) — read only at the moment you place a temporary works item on the map, create a design brief, or ask the map to show where you are. It is used to position a record and to derive its what3words reference. The app has no background location permission and cannot read your position while it is closed or in the background. We do not track your movements and we do not build a location history of you.
• Camera — used to photograph inspection evidence and to scan barcodes and QR codes on tags. The camera is opened only when you choose to take a photo or scan.
• NFC — used to read the TempTag tag fixed to a temporary works item. An NFC tag holds an item reference, not personal data.
• Biometric unlock (where you enable it) — handled entirely by your phone's own fingerprint or face system, which tells the app only whether the check passed. Your biometric data never leaves your device and is never sent to or stored by us.

What the app keeps on the device. So that inspections can be completed on sites with no signal, the app stores your session token, the project data you have downloaded, and a queue of submissions waiting to be sent, in the app's own private storage area on the phone. Queued items are uploaded when a connection returns and are then cleared. Signing out removes the session. Anyone with unlocked physical access to the phone may be able to reach this data, so the phone's own screen lock is an important part of protecting it — and if a device is lost or stolen it should be reported to your employer straight away.

The app sends data only to TempTag's own servers and to the map and location services listed in section 6. It contains no advertising, no analytics and no third-party tracking software of any kind.

6. Who we share data with

We do not sell personal data, and we never share it for third-party marketing. We use a small number of service providers who process data on our behalf, under contract and on our instructions:

We may also disclose personal data where we are legally required to — for example to a regulator, or in response to a valid court order — and to our professional advisers where necessary. If our business is sold or reorganised, data may transfer to the acquiring entity, and we would tell affected customers.

7. Transfers outside the UK

Platform and customer data is hosted in the UK or EU. Two providers in section 6 are based in the United States, so a limited amount of data reaches them: SendGrid receives the name and email address of people we send service email to, and Esri receives the map area being viewed. Where data is transferred outside the UK we rely on the UK's adequacy regulations or on the International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses, together with the safeguards those require.

8. How long we keep data

• Demo requests — 12 months after the enquiry is closed, then deleted.
• Order enquiries — 12 months after the order is fulfilled or closed, then deleted.
• Customer platform data — for as long as the customer's subscription runs. The customer decides retention within their own account, because they are the controller. When a subscription ends we delete or return the data in line with our agreement with that customer, and delete our copies within 90 days of the end of that process, other than anything we must keep by law.
• Temporary works and inspection records — these are safety records. A customer will normally need to keep them well beyond the life of the works themselves, and may be legally required to. We follow the customer's instruction and do not delete their records unilaterally.
• Backups — deleted data persists in encrypted backups for a short period before those backups roll off. It is not restored into live use.
• Security and audit logs — kept for a limited period for security monitoring and incident investigation.

Billing and accounting records are retained for six years, as UK tax law requires.

9. How we protect data

Our technical and organisational measures include:

• Encryption in transit — the platform and the app talk to our servers over HTTPS only, and the app is built so that it cannot fall back to unencrypted connections.
• Email addresses and phone numbers are encrypted at rest in our database, and passwords are stored only as a one-way hash.
• Each customer's data is separated from every other customer's, enforced both in the application and independently at the database itself, so that a fault in one layer does not expose another organisation's records.
• Access is controlled by role and by assignment, so people see the projects and records their role requires.
• Changes to safety records are written to an audit trail.
• Staff access to customer data is limited to those who need it to support the service.

No system is perfectly secure. If a personal data breach occurs that is likely to present a risk, we will notify the ICO within 72 hours where required, notify affected customers without undue delay so that they can meet their own obligations as controller, and tell affected individuals directly where the law requires it.

10. Your rights

Under UK GDPR you have the right to:

• Be informed about how your data is used — this page
• Access the personal data held about you
• Rectify data that is inaccurate or incomplete
• Erase your data, in certain circumstances
• Restrict processing, in certain circumstances
• Data portability — receive your data in a portable format
• Object to processing based on legitimate interests
• Withdraw consent at any time, where we relied on consent
• Complain to the Information Commissioner's Office at ico.org.uk, without contacting us first

How to exercise them. Email hello@temptag.co.uk. We respond within one month, and there is no charge. We may need to verify your identity first.

If your employer gave you your TempTag account, please ask them first. They are the controller of that data (section 2), so they are the ones who can act on the request. If you come to us instead we will pass the request to them promptly and support them in answering it — we are not able to change or delete their records on our own initiative.

One limit worth being straight about: the right to erasure is not absolute, and it is often restricted for these records. Completed inspections, permits and appointments are safety records that an employer may be legally obliged to keep, and which may be needed as evidence. Where that applies, your account can be closed and deactivated but the historic record of what was inspected and by whom will normally remain, because removing it would defeat the purpose of keeping it.

11. Closing an account and deleting data

TempTag accounts are issued by an employer, so there is no self-service delete button in the app — one worker being able to erase their own inspection history would undermine the record for everyone.

• If you are a user — ask your organisation's TempTag administrator to deactivate your account, or email us at hello@temptag.co.uk with your name and the organisation you work for and we will pass it to them. Deactivation removes your access immediately.
• If you are a customer administrator — email us to request deletion of your organisation's account and data. We will confirm the request with a named contact before acting, then delete the data as described in section 8.

Uninstalling the app removes everything it stored on the device, but does not delete your account on the platform — use the routes above for that.

12. Automated decision-making

We do not carry out automated decision-making that produces legal or similarly significant effects about you. TempTag calculates things like inspection due dates and whether a competency has lapsed, and it will flag or withhold an action on that basis — but these are fixed rules applied to dates you or your employer entered, not profiling, and a competent person remains responsible for every safety decision.

13. Children

TempTag is a workplace tool, provided to organisations for their workforce. It is not directed at children and we do not knowingly collect data from anyone under 16. Where an employer issues an account to a young worker or apprentice, that remains the employer's decision as controller.

14. Cookies

This website uses a session cookie to protect its forms against cross-site request forgery. The TempTag platform uses a session cookie to keep you signed in and to protect the same way.

Both are strictly necessary cookies, so no consent banner is required for them. We use no advertising, analytics or tracking cookies anywhere — on this website, in the platform or in the app.

15. Changes to this policy

We may update this Privacy Policy from time to time. The date at the top of this page shows when it was last revised. Where a change materially affects how we handle personal data we will tell affected customers directly rather than relying on this page alone.