Subbo privacy notice (DRAFT)
DRAFT for solicitor review. Not in force. Every legal judgement, number and placeholder is marked [SOLICITOR TO CONFIRM]. Structure follows the ICO's "right to be informed" guidance (who we are, what we collect, why and lawful basis, who we share with, how long, your rights, how to complain).
Last updated: [date]. Version: draft 1.
Who is responsible for what (read this first)
Subbo is software that construction firms use to verify subcontractors, work out CIS deductions, run pay and file CIS returns. There are two different roles:
| Whose data | Who decides what is collected and why (the "controller") | Subbo's role |
|---|---|---|
| Information about a firm's workers (names, tax and bank details, right-to-work evidence, pay) | The firm (your employer or the contractor who pays you) | Processor: we hold and process it only on the firm's instructions, under a data processing agreement |
| Information about the firm's own people who use Subbo (owner and manager sign-in details, the firm's account and billing details, how the app is used) | Subbo | Controller |
[SOLICITOR TO CONFIRM] this split. Two points to check: (1) whether Subbo is a controller for any worker data (for example the worker's own app login, security logs, or reminders we send); (2) whether a worker who creates their own login and edits their own details changes the analysis.
If you are a worker, read Part B. If you are a firm owner or manager, read Part A, then see Part B for what we tell your workers.
Part A: for firm owners and managers (Subbo is the controller)
A1. Who we are
[HARRY: legal name, company number, registered address] ("Subbo", "we"). Contact for data protection: [privacy email]. ICO registration number: [not yet registered; to be completed before launch] [SOLICITOR TO CONFIRM whether registration/fee is required and the tier]. We have not appointed a data protection officer [SOLICITOR TO CONFIRM none is required].
A2. What we collect about you
| Information | Where it comes from |
|---|---|
| Name, email address, password (stored scrambled by our login provider, never readable by us), role (owner or manager) | You, when you sign up or are invited |
| Two-step login details (an authenticator code factor), if you turn it on | You |
| Firm name, address, firm VAT status, firm UTR and Accounts Office reference | You |
| Billing details and subscription status [once billing exists] | You and our payment provider [SOLICITOR TO CONFIRM which provider; none chosen yet] |
| A record of what you do in the app (who approved a pay run, filed a return, changed a rate, and when) | Generated by the app. It holds ids and kinds of action only, never UTR, NI, bank numbers or names. |
| Technical data: IP address, device and browser type, error reports | Generated when you use the app |
A3. Why we use it, and our lawful basis
| Purpose | Lawful basis [SOLICITOR TO CONFIRM each] |
|---|---|
| Create your account, sign you in, run the service you signed up for | Contract |
| Keep the service secure, prevent fraud, rate-limit abuse, keep an audit trail | Legitimate interests (keeping the service and your data safe) |
| Send service emails (invites, password reset, filing and right-to-work reminders) | Contract |
| Take payment, keep accounting records | Contract; legal obligation |
| Respond to your questions, fix problems | Legitimate interests |
| Marketing email (only if you opt in) [not planned] | Consent, or soft opt-in for business email [SOLICITOR TO CONFIRM PECR position for sole traders] |
We do not sell personal data. We do not use it for automated decisions that have legal or similarly significant effects. [SOLICITOR TO CONFIRM wording: the app blocks pay for a worker with no valid right to work or HMRC verification by a fixed rule; check whether that is "solely automated decision-making" under Article 22.]
A4. Who we share it with
We use these suppliers ("sub-processors", the same list as in the data processing agreement). They may only use data to provide their service to us.
| Supplier | What for | Where [SOLICITOR TO CONFIRM and verify] |
|---|---|---|
| Supabase | Database, login, file storage | London region intended; verify the live project region [HARRY to confirm in Supabase] |
| Vercel | Hosting the website and app | [location to verify; Vercel may process in the US] [SOLICITOR TO CONFIRM transfer mechanism] |
| Resend | Sending emails | [location to verify, likely US] [SOLICITOR TO CONFIRM transfer mechanism] |
| HMRC | Only when a firm uses Subbo to verify a subcontractor or file a CIS return with HMRC, on the firm's instruction. [Today HMRC is mocked: the owner files on HMRC's own site and ticks "filed".] | UK |
| Payment provider (GoCardless planned, for our fees only) | Collecting our subscription fee. Never your workers' pay. | [to confirm] |
We also share data where the law requires it (for example a court order, or HMRC, the police or a regulator) and with professional advisers under confidentiality. If we sell or restructure the business, data may transfer to the new owner under the same protections [SOLICITOR TO CONFIRM].
Accountants (read-only access)
If a firm invites its accountant, that accountant can read the firm's CIS records in Subbo (workers' names and CIS rates, UTRs of paid workers, pay runs, CIS returns and statements) and can change nothing. They cannot see bank details, National Insurance numbers or right to work documents. The firm decides who is invited and can remove them at any time. [SOLICITOR TO CONFIRM]
A5. International transfers
Where a supplier processes data outside the UK we rely on [UK adequacy regulations / the UK International Data Transfer Agreement or the UK Addendum to the EU SCCs / the UK-US data bridge where the supplier is certified] [SOLICITOR TO CONFIRM for each supplier].
A6. How long we keep it
See the retention schedule (retention-schedule.md). In short: account data while your account is open and for [6 years] afterwards for accounting and legal claims [SOLICITOR TO CONFIRM]; audit entries [6 years] [SOLICITOR TO CONFIRM]; technical logs [30-90 days] [SOLICITOR TO CONFIRM].
A7. Your rights
Access, correction, erasure, restriction, objection, portability (where it applies), and to withdraw consent. We answer within one month (we use a 30-day clock) [SOLICITOR TO CONFIRM: UK GDPR allows one calendar month, extendable by two months for complex requests]. Email [privacy email]. We may ask you to prove who you are. Some data we must keep by law; we will say so.
A8. Security
Described in the data processing agreement, Annex 2. We do not hold any security certification (no ISO 27001, SOC 2 or Cyber Essentials) [SOLICITOR TO CONFIRM this wording is accurate and not misleading; update if a certification is obtained].
A9. Complaints
Contact us first at [privacy email]. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.
A10. Changes
We will tell you about important changes by email or in the app, and show the date above.
Part B: for workers (short version)
Show this in the worker app, in English, Romanian, Polish, Bulgarian, Lithuanian and Portuguese. [Translations must be checked by a native speaker AND the English by the solicitor before use.]
Who is in charge of your information? The firm that pays you ([firm name]) decides what information is collected about you and why. That firm is the "controller". Subbo is the software it uses. Subbo is only the "processor": we keep your information safe and use it only to do what the firm asks. [SOLICITOR TO CONFIRM]
What is held about you
- Your name, phone, email, date of birth and nationality.
- Your UTR, National Insurance number and bank details (so you can be verified with HMRC and paid).
- Your right to work check: photos or scans of documents, a masked document number or share code, the result and the date.
- Your CSCS, insurance and ticket card details and photos, if you add them.
- The weeks you worked, your day rate, what you were paid, CIS deductions, and statements.
- A record of changes to your details (it never shows your numbers).
Why, and the legal basis (the firm's basis; [SOLICITOR TO CONFIRM each])
| Why | Basis |
|---|---|
| Pay you and work out CIS tax | Contract; legal obligation (CIS rules) |
| Verify you with HMRC and file CIS returns | Legal obligation |
| Check you have the right to work in the UK | Legal obligation |
| Check your cards and insurance, keep sites safe | Legitimate interests; legal obligation (health and safety) |
| Keep a record in case of disputes or inspections | Legitimate interests; legal obligation |
Your NI number, UTR and bank details are not "special category" data. Nationality and immigration status in right-to-work checks need care [SOLICITOR TO CONFIRM whether any special category data (for example ethnicity inferred from documents, or biometric data in a photo) is involved and the extra condition needed].
Who sees it
- The firm's owner sees everything about you. Managers see your work and pay, but not your bank, UTR or NI details.
- You see your own information and pay in the app.
- Our suppliers (Supabase for the database and files, Vercel for hosting, Resend for emails) process it for us.
- HMRC, when the firm verifies you or files a CIS return.
- Nobody at another firm can see it.
How long CIS and payment records: 3 years after the end of the tax year they relate to. Right to work records: for as long as you work for the firm plus 2 years. Your phone, email and card photos: removed when your engagement ends unless the firm has a legal reason to keep them. [SOLICITOR TO CONFIRM: HMRC's 3 years is a minimum for CIS records; check firm retention of [6] years for limitation, and the right-to-work "plus 2 years" wording.] Details in the retention schedule.
Your rights You can ask to see your information (the app has a "My data" screen with a download), correct it, ask for it to be deleted, or ask the firm to restrict or stop using it. Raise a request in the app or contact [firm contact]. The firm must reply within one month; we help it keep to a 30 day clock. Some records the firm must keep by law, and we will tell you which and why. [SOLICITOR TO CONFIRM]
Complaints Tell the firm first. You can also complain to the ICO: ico.org.uk/make-a-complaint, 0303 123 1113.
Contact for Subbo: [privacy email].