Privacy Notice
Effective date: 14 September 2026 · Version 1.0
English is the authoritative language of this document. For assistance, contact [email protected].
This Privacy Notice explains how ControlOps collects, uses, stores and shares personal data in connection with the public website at https://controlops.co.uk and the ControlOps software-as-a-service platform (together, the Service).
It is written for the United Kingdom and is intended to meet transparency requirements under the UK GDPR and the Data Protection Act 2018. It is not legal advice. If anything in this notice is unclear, contact us using the details below.
1. Who we are (data controller)
For personal data we decide how and why to process — including website visitors, demo enquiries, account registration details, billing contact information and Service administration — the data controller is the organisation that operates ControlOps at controlops.co.uk (referred to as ControlOps, we, us or our).
Contact: [email protected]
Territory: United Kingdom
If you need our full legal entity name, company number or registered office address for a formal request or contract, email [email protected] and we will provide those details.
We have not appointed a Data Protection Officer. Privacy questions and data-subject requests should be sent to the contact email above.
2. Our dual role: controller and processor
ControlOps is a multi-tenant workforce operations platform used by business customers (each a Customer). How UK data protection law applies depends on the data:
- Controller. We are the controller for data about website visitors, people who request a demo, people who create or administer a ControlOps account, billing and subscription records for the Customer’s ControlOps subscription, security and access logs we generate to operate the Service, and related support communications with us.
- Processor. When a Customer uses ControlOps to store or process personal data about their workforce, clients, contractors, site contacts or other individuals (together, Customer Content), the Customer is the controller of that Customer Content and ControlOps processes it on the Customer’s instructions to provide the Service. A Data Processing Agreement (DPA) is available to business Customers on request via our DPA page or [email protected].
3. Personal data we collect
Depending on how you interact with us, we may process the categories below.
3.1 Website and communications
- Identity and contact data (for example name, work email, phone number, company name)
- Enquiry data from the book-a-demo form (industry, approximate workforce size, operational challenge, optional current system and preferred demonstration time)
- Technical data such as browser type, device information and IP address where collected by our systems or hosting infrastructure for security and operation of the website
- Preference data such as language selection
3.2 Accounts and Service access
- Account credentials and profile data (name, email address, hashed password where local sign-in is used)
- Email verification and password-reset records
- Where social sign-in is enabled and you choose it: identifiers and profile information provided by Google, Microsoft and/or Apple (such as subject identifier, name and email), used to authenticate and link your account
- Role, permissions and company association within a Customer tenant
- Session, authentication and security event data (including IP address and related access metadata)
3.3 Customer organisation and subscription
- Company or trading name and related organisation settings you provide
- Subscription plan, billing cycle, payment status and related billing records
- Payment-related identifiers and status information processed via our payment provider (we do not store full payment card numbers on ControlOps systems; card payments are handled by Stripe where card checkout is used)
3.4 Customer Content (processed as a processor)
Customers may upload or generate personal data in the Service. Depending on modules enabled and how the Customer configures the platform, this can include workforce and contractor profiles; contact details; documents and licence or right-to-work records; site and client contacts; rota and assignment data; attendance and clock events; location or GPS-related data where features such as geo-verified clock-in or patrol scanning are used; incident and operational records; payroll-preparation and invoicing information; and related files or notes.
ControlOps does not decide which Customer Content a Customer collects. Customers are responsible for ensuring they have a lawful basis and any required notices or consents for that data.
3.5 Support and operations
- Information you include in support or sales emails
- Transactional email delivery logs where email is configured for the Service
4. Sources of personal data
- Directly from you (website forms, signup, account settings, support)
- From authorised users of a Customer account who invite or create users, or who enter Customer Content
- From identity providers if you use Google, Microsoft or Apple sign-in
- From our payment provider in connection with subscription payments
- Automatically from your browser or device when you use the website or Service
5. Purposes and lawful bases
We process personal data only where UK law allows. The main purposes and bases are:
| Purpose | Examples | Lawful basis |
|---|---|---|
| Provide and operate the Service | Accounts, authentication, tenant features, Customer Content hosting | Contract (Art. 6(1)(b)); for Customer Content as processor, under Customer instructions |
| Respond to demo and contact enquiries | Book-a-demo submissions; sales follow-up | Legitimate interests (Art. 6(1)(f)) — responding to B2B enquiries and explaining the Service; or steps prior to a contract where applicable |
| Billing and subscription management | Plans, invoices/receipts, payment status, upgrades, cancellations | Contract; legal obligation where tax or accounting rules require records |
| Security and misuse prevention | Access controls, session management, login attempt limits, audit logs | Legitimate interests — protecting the Service, Customers and users; legal obligation where applicable |
| Service communications | Verification, password reset, billing notices, operational alerts you configure | Contract; legitimate interests for essential Service messages |
| Improve and administer our business | Understanding how the public site is used at a high level; troubleshooting | Legitimate interests — operating and improving a B2B SaaS business, balanced against your rights |
Legitimate interests. Where we rely on legitimate interests, we consider the impact on individuals and use proportionate measures. You may object to processing based on legitimate interests (see rights below).
We do not use personal data to send unsolicited marketing newsletters unless we have an appropriate lawful basis and you can opt out. Demo and sales follow-up after you contact us is treated as a response to your enquiry.
6. Who we share personal data with
We do not sell personal data. We may share personal data with:
- Service providers (processors) who help us host and operate the Service, send transactional email, process payments, provide infrastructure, and (where enabled) authenticate users via third-party identity providers. Categories include hosting and infrastructure providers; email delivery providers; payment processors (including Stripe Payments Europe / Stripe for card and subscription payments where used); and identity providers (Google, Microsoft and/or Apple) when you choose social sign-in.
- The Customer organisation that owns the tenant account you belong to (administrators and other authorised users may see account and operational data according to permissions).
- Professional advisers (for example lawyers or accountants) under confidentiality where needed.
- Authorities where required by law, or to protect rights, safety or security.
- A buyer or successor in connection with a business transfer, subject to appropriate safeguards.
Specific sub-processor names and locations for Customer Content processing can be confirmed in a Customer DPA or on request. We do not list every infrastructure provider here where arrangements may change; we will not invent certifications or transfer tools that are not in place.
7. International transfers
ControlOps is operated for Customers in the United Kingdom. Some providers we use (for example payment or identity providers) may process personal data in countries outside the UK.
Where a restricted transfer occurs, we take steps required by UK data protection law. Depending on the provider and destination, that may include relying on an adequacy regulation or using appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Details for a particular transfer can be provided on request where available from the relevant provider.
8. Retention
We keep personal data only for as long as needed for the purposes above, including to provide the Service, resolve disputes, enforce agreements and meet legal, tax or accounting requirements. Exact periods depend on the record type and legal context. In outline:
- Account and subscription data — for the life of the account/subscription and a further period as needed for billing, security and legal obligations, then deleted or anonymised where practicable.
- Customer Content — retained for the Customer while the subscription is active and thereafter as required to wind down the Service or as instructed by the Customer / required by law. Customers control day-to-day deletion inside the product where the feature allows.
- Demo and enquiry emails — for as long as needed to handle the enquiry and related sales follow-up, then deleted or archived according to our ordinary business email practices.
- Security and access logs — for a limited operational period unless needed longer for investigations or legal claims.
If you need a retention schedule for a specific category for due diligence, contact [email protected].
9. Security
We use technical and organisational measures appropriate to the nature of the Service, including authenticated access, company-scoped (tenant) data separation, password hashing for local credentials, session controls, and role-based permissions within Customer accounts. No method of transmission or storage is completely secure; we work to protect personal data but cannot guarantee absolute security.
Further information for business evaluation is summarised on our Security page, or available on request.
10. Your rights
Under UK data protection law, you may have the right to:
- Access your personal data
- Rectify inaccurate personal data
- Erase personal data in certain circumstances
- Restrict processing in certain circumstances
- Object to processing based on legitimate interests
- Data portability for certain data you provided to us, where processing is automated and based on contract or consent
- Withdraw consent where processing is based on consent (withdrawal does not affect prior lawful processing)
- Complain to the Information Commissioner’s Office (ICO)
To exercise rights in respect of data for which ControlOps is the controller, email [email protected] with enough detail for us to verify your identity and locate the data. We will respond within the timeframes required by UK law.
For Customer Content held in a Customer tenant (for example a guard profile entered by your employer), please contact that organisation first. We will assist Customers with requests as required under our processor obligations and any applicable DPA.
11. Automated decision-making and profiling
We do not use personal data to make solely automated decisions that produce legal or similarly significant effects about you. Security features such as temporary lockouts after repeated failed sign-in attempts are protective controls, not profiling for marketing or eligibility scoring.
12. Cookies and similar technologies
We use cookies and similar technologies as described in our Cookie Policy. Essential cookies support language preference and operation of the site. Session credentials for the signed-in Service are typically stored in browser local storage rather than as a cookie. Theme preference may be stored locally in your browser. Optional Google Analytics (GA4) cookies load only if you accept analytics via the consent banner, and are used to measure public website usage and subscription funnel performance without collecting passwords, payment card details, authentication tokens or confidential tenant data.
13. Children
The Service is a business workforce-operations product and is not directed at children. We do not knowingly collect personal data from children for the purpose of offering the Service to them. If you believe a child has provided personal data to us inappropriately, contact us and we will take appropriate steps.
14. Marketing communications
If you submit a demo or contact enquiry, we may use your details to respond and discuss ControlOps with you. You can ask us to stop further sales follow-up at any time by emailing [email protected]. Transactional messages needed to operate your account (for example verification, password reset or billing notices) are separate from optional marketing.
15. Complaints
Please contact us first so we can try to resolve your concern. You also have the right to complain to the UK Information Commissioner’s Office:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
https://ico.org.uk
Helpline: 0303 123 1113
16. Changes to this notice
We may update this Privacy Notice from time to time. The effective date and version appear at the top of this page. Material changes may also be notified through the Service or by email where appropriate. Continued use of the website or Service after an update constitutes notice of the revised terms of this notice for website and controller processing; Customer contracts and DPAs continue to apply as agreed.
17. Contact
Privacy questions and data-subject requests: [email protected]
General contact: Contact · Book a demo
For questions, book a demo or contact your ControlOps representative.