This Privacy Policy explains how CNE Software Solutions ("we", "us" or "the Company"), a company registered in England and Wales under company number [Company Registration Number] with its registered office at [Registered Address], collects, uses, discloses and protects personal data when you use the CNE Contract Portal Platform. It is written in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We act as the data controller for personal data processed through the Platform. For data protection enquiries, contact our data protection lead at admin@cnesoftwaresolutions.com or by post at [Registered Address].

1. Personal Data We Collect

• Account data: your username, password (stored securely), role, and the permissions assigned to your account.
• Identity data: your name, job title or role, and signature image when you sign documents.
• Workforce data: names, positions and signatures of working party members and persons in charge recorded on permits and allocations.
• Training and certification data: training records, certificate expiry dates and card numbers (for example CSCS, NPORS or ECS), including photographs of operatives.
• Location data: What3Words addresses and site location references associated with permits, allocations and documents.
• Photographic and document data: photographs of work areas, access routes, hazards and equipment, together with uploaded documents.
• Usage data: information about how you use the Platform, including device type, access times and approximate location derived from your device.
• Correspondence data: the content of any communications you send to us.

2. How We Collect Your Data

We collect data directly from you when you create or update your account, complete forms, sign documents or upload content. We also collect data automatically when you use the Platform (usage data) and from third parties such as the Client who instructs that you be granted access. Training data may be collected by scanning competency cards.

3. How We Use Your Data

• To provide and administer your account and access to the Platform.
• To create, manage and store permits, allocations, risk assessments and other work records.
• To verify identity and competency, including training and certification checks.
• To comply with health and safety, legal and regulatory obligations.
• To communicate with you about the Platform, your account and the works being managed.
• To maintain security, prevent fraud and investigate misuse.
• To improve and develop the Platform and our services.

4. Lawful Basis for Processing

We rely on the following lawful bases under UK GDPR:

• Contract (Art. 6(1)(b)): to provide the Platform and manage the works under your account.
• Legal obligation (Art. 6(1)(c)): to comply with health and safety, employment and record-keeping obligations.
• Legitimate interests (Art. 6(1)(f)): for security, fraud prevention, service improvement and audit, where these interests are not overridden by your rights.
• Consent (Art. 6(1)(a)): where you give consent, for example for certain photographs or optional communications. You may withdraw consent at any time.

For special category data (such as health information relevant to fitness to work or photographs that may reveal biometric data), we rely on your explicit consent or on the substantial public interest basis for occupational health and safety.

5. Sharing Your Data

We may share your data with:

• The Client and other parties involved in managing the works, where necessary for the works.
• Cloud storage and IT service providers who help us operate the Platform (for example document back-up storage), acting as processors under our instructions.
• Regulators, law enforcement or other authorities where required by law.
• Professional advisers and auditors.

We do not sell your personal data. Where we use third-party processors, we put appropriate contracts in place to protect your data.

6. International Transfers

Your data may be processed by service providers located outside the United Kingdom. Where this happens, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement or equivalent measures, so that your data is protected to UK standards.

7. Data Retention

We keep personal data only for as long as necessary for the purposes set out in this policy and to comply with legal and regulatory requirements. Work records, permits and training data are typically retained for the period required by health and safety law and the Client's requirements. Account data is retained while your account is active and for a reasonable period afterwards for audit and legal purposes, after which it is deleted or anonymised.

8. Data Security

We take appropriate technical and organisational measures to protect your data, including access controls, encryption in transit, secure password storage and role-based permissions. Access to personal data within the Platform is restricted to authorised administrators and to the data each user needs for their role. Despite these measures, no system can be guaranteed completely secure.

9. Your Rights

Under UK GDPR you have the right to:

• Be informed about how we use your data (this policy).
• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erasure of your data in certain circumstances.
• Restrict or object to the processing of your data.
• Data portability — to receive your data in a structured, machine-readable format.
• Withdraw consent where processing relies on consent.
• Lodge a complaint with the Information Commissioner's Office (ico.org.uk).

To exercise any of these rights, contact admin@cnesoftwaresolutions.com. We will respond within one month, or where this is not possible, explain the reasons for any extension.

10. Cookies

The Platform uses a limited number of cookies and similar technologies. See our Cookie Policy for details.

11. Children's Data

The Platform is intended for use by authorised workers and contractors and is not directed at children. We do not knowingly collect data from children under 16.

12. Changes to This Policy

We may update this policy from time to time. The "Last updated" date above indicates when it was last revised. We will notify users of significant changes through the Platform or by email where appropriate.

13. Contact

For any questions about this policy or your personal data, contact admin@cnesoftwaresolutions.com or write to CNE Software Solutions, [Registered Address].