Privacy notice

1. Controller and contact details

Stag Consultancy and Investment Ltd is the controller for personal information used by Subcontract Compass. Company number: 10812149. Registered office: 39 Ludgate Hill, London, England, EC4M 7JN.

Privacy enquiries and rights requests: office@subcontractcompass.co.uk.

2. Information we collect

We may collect names, job titles, business contact details, company information, invoice details, project and contract information, uploaded documents, correspondence, service records and payment status. We also retain limited technical and attribution information, such as the landing page and campaign tags connected with an enquiry.

Contract documents may contain personal information about other people. The submitting business must ensure that it is authorised to provide that information.

3. Where information comes from

Information may be supplied directly through our website, email, meetings or project documents. For business development, we may also use licensed construction databases, public company records, company websites and professional business sources.

Where personal information is obtained from another source, we aim to provide relevant privacy information at the first communication or within the period required by data-protection law.

4. Why we use information

• to assess enquiries and decide whether an assignment falls within scope;
• to provide, administer and improve subcontract-review and commercial-support services;
• to issue invoices, record payments and maintain business records;
• to protect confidential documents, prevent misuse and maintain an audit trail;
• to measure which business-development activity produces enquiries;
• to contact relevant business people about services that may be useful to their organisation; and
• to comply with legal, tax, regulatory and professional obligations.

5. Lawful bases

Depending on the activity, we rely on steps requested before a contract, performance of a contract, compliance with legal obligations, and our legitimate interests in operating, protecting and developing a specialist business service. Where consent is legally required, we will request it separately and it may be withdrawn.

6. Business-to-business marketing

We may contact relevant people at corporate organisations where we reasonably believe the service is relevant. We do not disguise our identity, and every marketing message must provide a clear way to object or opt out.

We apply different rules where an address relates to an individual subscriber, sole trader or certain partnerships. Suppression records are retained so that an opt-out is respected.

7. Who receives information

Information may be processed by secure hosting and storage providers, Microsoft 365, accounting and payment providers, booking services, IT support, professional advisers and carefully selected service providers working under appropriate instructions. We do not sell personal information.

We may disclose information where required by law, to protect legal rights, or as part of a properly managed business sale or reorganisation.

8. International processing

Some technology providers may process information outside the UK. Where this occurs, we will use an available lawful transfer mechanism and appropriate contractual or organisational safeguards.

9. Retention

Unconverted enquiries are normally retained for up to 12 months. Assignment, invoice and core business records are normally retained for seven years after the last relevant service or transaction. Working files and uploaded contract documents are reviewed for deletion when no longer reasonably needed for the assignment, legal claims, insurance or record-keeping.

Minimal suppression information may be kept for longer so that marketing objections continue to be honoured. Retention may be extended where a dispute, legal obligation or investigation requires it.

10. Security

We use access controls, private document storage, secure links, audit records and appropriate technical and organisational measures. Access is limited to people and providers who need the information for an authorised purpose. No system is completely risk-free, and suspected incidents are assessed and handled under applicable data-breach requirements.

11. Website analytics, cookies and attribution

We use limited first-party analytics to understand the number of visits, approximate unique visitors, landing pages, device type and traffic source. The system records campaign tags and the referring website where available. No advertising cookie or third-party behavioural tracking is used, and the system does not store a visitor’s raw IP address. A one-way pseudonymous identifier derived from limited technical information is used to estimate unique visitors and is rotated monthly. Analytics records are normally retained for up to 13 months.

An enquiry also records the campaign tags present on its submission link, the enquiry page path and the referring website’s origin so we can understand which activity generates enquiries.

12. Your rights

Depending on the circumstances, you may ask for access, correction, deletion, restriction, portability or objection to processing. You may also withdraw consent where consent is the lawful basis. We may need to verify identity and may retain information where the law permits or requires it.

13. Complaints

Please contact us first so we can try to resolve the issue. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk.

14. Changes

We will update this notice when our services, providers or processing change. The current version and effective date will remain available on this page.