Privacy policy

Last updated: 17 October 2026

Who we are

UrProject Ltd is the controller of your personal data. We are registered in England and Wales, company number 16336005, at 20 Wenlock Road, London, England, N1 7GU.

ICO registration number: ZC265262. Contact us about privacy at privacy@urproject.co.uk.

We have not appointed a data protection officer, because the law does not require one for a business of our size.

Who this policy covers

People who use the UrProject app or website, people who contact us, and people at construction companies we contact about UrProject.

Data we collect from app and website users

• Identity and contact details: name, email, phone, login details.
• Checks: ID documents and right to work evidence.
• Work details: qualifications and cards (such as CSCS), which can include health information.
• Work records: availability, clock-ins and location at clock-in and clock-out, timesheets, daily logs, photos, expenses, travel distance and payslips.
• Messages sent in the platform.
• Technical data: IP address, device and browser details.

We process health information only with your explicit consent or where the law requires it.

How we use it

• To run the platform and your account.
• To check identity and right to work, and keep those checks current.
• To record hours, expenses and site activity, and produce timesheets, payslips, reports and audit trails.
• To keep the platform secure and improve it.
• To send service messages.

We do not sell personal data. We do not make automated decisions with legal effect about you.

Our lawful bases

• Contract: to provide the account and the platform.
• Legal obligation: for example tax, right to work and health and safety records.
• Legitimate interests: for example security, fraud prevention, improving the platform, and contacting businesses about UrProject (see below). We have assessed and recorded these interests.
• Consent: where we ask for it, for example optional marketing emails, health information and non-essential cookies. You can withdraw consent at any time.

Location data

This section explains how the UrProject worker app uses location.

• Clock-in and clock-out: when you clock in and when you clock out, the app records your phone’s location (latitude, longitude and how accurate the reading is). It records your location only at those two moments. It does not track you during your shift.
• Why: to check that you were at the job site. The company you work for sees whether each clock-in and clock-out was verified. Company staff who are allowed to review location checks can also see the recorded location and how far it was from the site.
• If no location is recorded: when your phone cannot give a location, we store the reason instead. The reasons are that it took too long, location permission was refused, location is switched off in your phone’s settings, or no location was available.
• Your choice: you can refuse location access. You can still clock in and out, but the shift will show as unverified and the company will review it.
• Weather: the app’s home screen shows the local weather. If you have already allowed location, the app uses your phone’s position, rounded to about 1 km, and sends it to Open-Meteo to get the weather and to BigDataCloud to get the name of your area. If you have not, it uses your job site’s position, also rounded to about 1 km. The app never asks for location just for the weather, does not work out your location from your IP address, and we do not store the position used for the weather.
• Photos: when you upload photos to daily logs and documents, we re-encode them and remove the location data that phones store inside photos (EXIF data).
• Job site addresses: until you are engaged on a job, you see only its general area. This is the town, the county, the first half of the postcode, and a position rounded to about 1 km. You see the exact address once you have accepted an offer for the job, or where the company has chosen to show it.
• Lawful basis: contract, to provide the timesheet service, and legitimate interests, to confirm that hours were worked at the site and to prevent fraud.
• How long we keep it: clock locations are kept with the timesheet they belong to. Timesheets are pay and tax records, so we keep them while the company you worked for uses UrProject, and then for 6 years after the end of the UK tax year in which the shift was worked. If you delete your account, we remove the exact clock-in and clock-out locations from your timesheets. The company keeps the timesheet and whether each shift was verified.

Business contacts we reach out to

This section is for people at construction companies who receive an email, call or LinkedIn message from us without having signed up.

• Where your details came from: public and commercial sources. These are LinkedIn, construction project data from Barbour ABI, and business contact data from Apollo.io.
• What we hold: your name, role, business email, business phone, company, and information about your company’s projects.
• Why: to tell people at UK construction companies about UrProject, business to business.
• Lawful basis: legitimate interests. We contact people in their work role at companies where UrProject is relevant, and we keep messages short and few. We only email limited companies and LLPs without consent. We do not email sole traders or partnerships without consent.
• Who sees it: our team and the services we use to send and record messages, which are HubSpot (EU data centre), Apollo.io and Microsoft 365.
• Email tracking: our emails do not use open or click tracking.
• How long we keep it: if you do not reply, we delete your details no later than 12 months after our last message. If you reply, we keep them while we are in contact. If you opt out, we keep only your name and email on a do-not-contact list so we never contact you again.
• How to opt out: reply no to any message, use the unsubscribe link in any email, or email rayno@urproject.co.uk or privacy@urproject.co.uk. We will stop straight away.

Who we share data with

• Other users, where needed to deliver a project (for example a company sees the hours its workers submit).
• Service providers who work for us under contract, such as AWS (hosting), Didit (identity checks), Stripe (payments), HubSpot, Apollo.io and Microsoft 365.
• Weather services: Open-Meteo (the weather) and BigDataCloud (the name of your area) receive a position rounded to about 1 km, and nothing else about you: no name, email, phone number or account ID. The request goes straight from your phone, so, as with any internet request, they also see your device’s IP address.
• Authorities such as HMRC when the law requires it.

Everyone we share data with is bound by confidentiality and security terms. We share only what is needed.

Where data is stored and how we protect it

Data is stored in the UK and the EEA (AWS London and AWS Stockholm) with encryption and access controls.

Where a provider handles data outside the UK, we use recognised safeguards such as the UK International Data Transfer Agreement or an adequacy decision.

If a breach puts your rights at risk, we will tell you and the ICO within 72 hours where required.

How long we keep data

• Account and payment records: up to 7 years after the account closes, for tax and legal reasons.
• Identity checks: 2 years from your last activity.
• Logs and records: 1 to 2 years for accuracy and security.
• Data linked to a legal claim or dispute: as long as the law requires.
• Business contact data: as set out in the business contacts section above.

After that we delete or anonymise it. We review these periods every year.

Your rights

You can ask to see, correct or delete your data, to restrict or object to how we use it, and to receive a copy to take elsewhere. You can object to marketing at any time, and we will stop.

Send requests to privacy@urproject.co.uk. We may ask you to confirm your identity. To delete an app account, see Delete your account.

You can complain to the Information Commissioner's Office at ico.org.uk. We would like the chance to put things right first.

Cookies and analytics

Essential storage (your cookie choices) is always on. Everything else loads only if you allow it in the cookie banner. You can change your choices at any time through Cookie settings in the footer.

Turning off analytics does not affect how the site works.

Children

UrProject is for people aged 18 and over. If we find we hold data about a child, we delete it.

Changes to this policy

We will update this page when things change, and tell users of the app about major changes by email or in the app.

Contact

privacy@urproject.co.uk. For outreach opt-outs you can also email rayno@urproject.co.uk.