Who we are

ValueSight is a commercial intelligence platform for construction. For the purposes of UK data protection law, ValueSight [insert legal entity name, registered address and company number] is the data controller for the personal data described in this notice, unless we expressly act as a processor on behalf of a customer.

If you have questions about this notice or about how we handle personal data, contact us using the details in the contact section below.

What information we collect

We ask customers not to upload special category personal data unless it is strictly necessary and there is an appropriate lawful basis for doing so.

How we use personal data

• to provide, secure and support the ValueSight platform;
• to respond to enquiries, book demos and manage pilots or customer relationships;
• to analyse product usage, improve performance and develop features;
• to send service communications, transactional messages and, where permitted, relevant marketing communications;
• to comply with legal, regulatory and contractual obligations;
• to prevent fraud, misuse, unauthorised access and other security issues.

UK GDPR and Data Protection Act 2018 compliance

ValueSight is designed to operate in line with the UK GDPR and the Data Protection Act 2018. We aim to process personal data lawfully, fairly and transparently, collect only what is needed for specified purposes, keep it accurate where reasonably practicable, retain it only for as long as necessary, and protect it using appropriate technical and organisational measures.

Where ValueSight acts on behalf of a customer, we generally act as a processor and process personal data only on the customer’s documented instructions, subject to applicable law. Where we determine our own purposes for processing, such as website analytics, sales enquiries, account administration, billing, security and service improvement, we act as controller.

We maintain appropriate internal controls for access management, confidentiality, security monitoring, supplier due diligence and incident response. Where required, we assess new processing activities and update our records and controls accordingly.

Lawful bases

Depending on the context, we rely on one or more of the following lawful bases:

• Contract: where processing is necessary to provide our services, manage accounts, book demos or take steps at your request before entering into a contract.
• Legitimate interests: where processing is necessary for running and improving our business, securing our systems, communicating with business contacts, preventing misuse, and understanding how our website or product is used.
• Consent: where required, for example for certain cookies or for marketing communications where consent is the appropriate basis.
• Legal obligation: where we must retain or disclose information to comply with applicable law, regulation or lawful requests.

How long we keep personal data

We keep personal data only for as long as necessary for the purposes described in this notice, including to meet legal, regulatory, tax, accounting, security and contractual requirements. Retention periods may vary depending on the category of data and the nature of the relationship.

• sales and enquiry data: typically up to 24 months after last meaningful contact, unless a longer period is justified;
• customer account and service data: for the duration of the relationship and for a reasonable period afterwards for audit, support and legal purposes;
• security and technical logs: for as long as reasonably necessary for monitoring, investigation and system integrity;
• billing and contractual records: as required by law and normal business record retention practices.

Sharing personal data

We may share personal data with:

• hosting, cloud infrastructure, analytics, customer support, communications and other service providers who support delivery of ValueSight;
• professional advisers, auditors, insurers and legal counsel where necessary;
• regulators, law enforcement, courts or other public authorities where required by law or to protect our legal rights;
• a buyer, investor or successor organisation in connection with a merger, acquisition, financing or sale of assets, subject to appropriate confidentiality measures.

We do not sell personal data.

International transfers

Where personal data is transferred outside the UK, we take steps to ensure an appropriate level of protection. Depending on the destination and circumstances, this may include adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU standard contractual clauses, or another lawful transfer mechanism.

Cookies and analytics

Our website may use cookies and similar technologies to operate the site, understand usage, improve performance and support security. Where the law requires consent for non-essential cookies, we will ask for it through an appropriate cookie mechanism.

You can usually control cookies through your browser settings, although doing so may affect site functionality.

Your rights

Subject to applicable law, you may have the right to request access to your personal data, rectification of inaccurate data, erasure, restriction of processing, objection to certain processing, and data portability. Where we rely on consent, you can withdraw it at any time, although this will not affect processing already carried out before withdrawal.

If you want to exercise your rights, contact us using the details below. We may need to verify your identity before responding.

Complaints

We would appreciate the opportunity to address your concerns first. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection matters.

Contact details

Before publishing, replace all bracketed placeholders with your actual company, contact and retention details, and align the notice with your live vendors, cookie setup and data flows.