Worker Privacy Notice
Version 1.0, issued October 2026, next review October 2027.
Interpretation
In this policy, 'the Company' means the TWG company that employs you (or, for policies about how we do business, the TWG company concerned): Roofworx (UK) Limited (Co. No. 08946095), Woodworx (Carpentry UK) Ltd (Co. No. 11828681) or Fire-worx (Fire Safety) UK Ltd (Co. No. 14615772). 'TWG' means those companies together, trading as TWG - The Worx Group.
About This Notice
This notice explains how the TWG companies collect and use personal data about operatives, subcontractors and staff who use the TWG - Projects app, and what rights you have. It is provided under Articles 13 and 14 of the UK General Data Protection Regulation (UK GDPR) and should be read with the GDPR Policy and the Data Retention Schedule.
Who We Are
TWG - The Worx Group is made up of three companies, which act as joint controllers for the TWG - Projects app because they decide together why and how the app is used:
Roofworx (UK) Limited - company number 08946095 - ICO registration ZB099037
Woodworx (Carpentry UK) Ltd - company number 11828681 - ICO registration ZB099030
Fire-worx (Fire Safety) UK Ltd - company number 14615772 - ICO registration ZB581922
Registered office (all three companies): Unit 1, Office 1 Tower Lane Business Park, Tower Lane, Warmley, Bristol BS30 8XT.
The companies will set out in a written joint controller arrangement (UK GDPR Article 26) who is responsible for each part of data protection for the app, with the Office Manager as the single point of contact for individuals. A summary of the arrangement will be made available to you in the app. Whichever company you work for, you can still exercise your rights against any of the three companies.
Data protection contact: the Office Manager, who is the Company's data protection lead (see the GDPR Policy). Email enquiries@roofworx.co.uk, or write to the Office Manager at the registered office. We have not appointed a formal Data Protection Officer.
The Personal Data We Collect
Contact details: your name, address, phone number, email address and emergency contact details.
Right-to-work documents: copies of your passport, Home Office share code check result, or birth certificate and National Insurance number, and the date and outcome of the check (see the Right-to-Work and CSCS Checking Procedure).
CSCS cards: your card type, number, occupation, expiry date, a photo of the card and the result of the online check.
Qualifications: training certificates, tickets and cards (for example working at height, MEWP, abrasive wheels, asbestos awareness and first aid) and their expiry dates.
Selfies: a photograph of you taken in the app when you sign in or out, so that a manager can see that the right person has signed in.
Clock-in and clock-out times: the date and time you sign in and out of each site.
Geofence location: your device's location, taken only at the moment you sign in and the moment you sign out, and checked against a boundary (geofence) around the site. The app does not track your location at any other time. If you sign in outside the geofence, an alert is sent to your manager.
Signed RAMS and toolbox talks: a record that you have read and signed the risk assessments and method statements (RAMS) and attended toolbox talks, with the date and your signature.
Site photos: photographs of work, site conditions and progress taken in the app. You may appear in some of them.
Most of this data comes from you through the app. Some may come from your manager, the main contractor on a project, CSCS (through its online card check) or the Home Office right-to-work checking service on the GOV.UK website.
How We Use Your Data And Our Lawful Bases
Contacting you and managing your work and site allocation: performance of a contract (your employment or subcontract).
Right-to-work checks for employees: legal obligation (Immigration, Asylum and Nationality Act 2006).
Right-to-work checks for individual subcontractors and people on worker's contracts engaged on or after 1 October 2026: legal obligation (Immigration, Asylum and Nationality Act 2006, as extended by section 48 of the Border Security, Asylum and Immigration Act 2025). For agency workers, the agency carries out the check as their employer. For genuinely independent businesses outside the scheme: legitimate interests.
Checking CSCS cards and qualifications so that only competent people work on site: legal obligation (Health and Safety at Work etc. Act 1974; CDM 2015 reg. 8 competence) and legitimate interests.
Selfies to confirm who has signed in: legitimate interests (confirming who signed in, preventing buddy-clocking, and fire roll-call).
Clock-in and clock-out times for site safety, attendance and pay: performance of a contract; legal obligation (working time records under the Working Time Regulations 1998 reg. 9, and HMRC payroll records); legitimate interests (site safety).
Geofence location at sign in and sign out, and alerts to managers: legitimate interests (confirming attendance on the right site and site safety). Location is captured only at sign in and sign out, with no continuous tracking.
Signed RAMS and toolbox talks: legal obligation (health and safety law).
Site photos: legitimate interests (recording work, quality and safety) and performance of client contracts.
Making legal claims and defending them: legitimate interests.
Where we rely on legitimate interests, we have balanced our interests against yours and you have the right to object (see Your Rights). The Office Manager will complete and sign a legitimate interests assessment (LIA) for selfies and for geofence location before the app goes live.
Selfies are only looked at by people. The app does not use facial recognition, and does not carry out any automated face matching. Selfies are kept only as internal records of who signed in, so they are not biometric data or special category data.
Because the app uses location data and photographs of workers, a Data Protection Impact Assessment (DPIA) will be completed and signed off by the Office Manager before the app goes live, as required by the GDPR Policy.
We do not make decisions about you based solely on automated processing. A sign-in outside the geofence only sends an alert to a manager, who will check with you before taking any action.
Who We Share Your Data With
We only share your personal data where we need to. Recipients may include: the other TWG companies; your manager and the site management team; main contractors and principal contractors on our projects (for example site attendance, CSCS and RAMS records); our app and database provider Supabase (contracted by Roofworx (UK) Limited on behalf of all three companies) and other IT service providers; our accountants, payroll provider, insurers and professional advisers; and the Home Office, HMRC, the HSE or other authorities where the law requires. Our service providers act on our instructions under written contracts.
Where Your Data Is Stored
The app's data is held on Supabase, a cloud database service. The hosting region is Europe (London), eu-west-2, so the data is held in the UK. If the data is ever stored or accessed outside the UK, we will make sure the transfer is protected by UK adequacy regulations or by appropriate safeguards such as the ICO's International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.
Access to the app is controlled by user accounts, and people can only see the data they need for their role.
How Long We Keep Your Data
We keep your data only for as long as we need it, as set out in the Data Retention Schedule. In summary:
Right-to-work check records (employees): for the length of employment and 2 years after it ends.
Right-to-work check records (subcontractors): for the length of the engagement and 2 years after it ends.
CSCS card and qualification records: 6 years after your employment or engagement ends.
Selfies: 3 months from the date taken, then automatically deleted, unless needed for an investigation.
Clock-in and clock-out times: the current tax year plus 3 years.
Geofence location at sign in and sign out: 3 months from the date taken (sign-in times are kept separately for pay).
Signed RAMS and toolbox talks: 6 years after the project ends (12 years where the contract is executed as a deed).
Site photos: 6 years after the contract ends (12 years where the contract is executed as a deed).
Contact details: emergency contacts are deleted when your work with us ends; other contact details are kept 6 years after your work with us ends.
Your Rights
Under the UK GDPR you have the right to:
be informed about how we use your personal data;
access your personal data (a subject access request);
have inaccurate data corrected;
have your data erased in some circumstances;
restrict how we use your data in some circumstances;
object to our use of your data where we rely on legitimate interests; and
data portability, where we rely on a contract and process data by automated means.
To use any of these rights, contact the Office Manager. We will respond within one month, or within three months for complex requests, and we will tell you if we need more time. There is usually no charge.
Complaints
If you are unhappy with how we have used your personal data, please contact the Office Manager first so that we can try to put it right. We will acknowledge your complaint within 30 days and tell you the outcome. You also have the right to complain to the Information Commissioner's Office (ICO): www.ico.org.uk, helpline 0303 123 1113.
If You Do Not Provide Your Data
Right-to-work, CSCS and qualification details are needed before you can work on our sites. If you do not provide them, we may not be able to offer you work. Signing in and out through the app is part of the Timekeeping and Attendance Procedure.
Changes To This Notice
We may update this notice from time to time and will tell you through the app when we do.
Document Control
Status: approved for issue by the Directors, October 2026. Owner: the Office Manager, on behalf of the Directors. Approved by the Directors of each TWG company. Reviewed at least annually and whenever the law or the TWG - Projects app changes.
Signed on behalf of the TWG companies: Matthew Coupe, Director. Date: 30 October 2026.
TWG - The Worx Group: Roofworx (UK) Limited, Co. No. 08946095; Woodworx (Carpentry UK) Ltd, Co. No. 11828681; Fire-worx (Fire Safety) UK Ltd, Co. No. 14615772. Registered office: Unit 1, Office 1 Tower Lane Business Park, Tower Lane, Warmley, Bristol BS30 8XT.