The short version
- Hubb is a workplace system for Hubb Engineering Services Ltd, its staff and the people it works with. It is not a consumer app.
- We do not sell personal data, show advertising, or use it to build advertising profiles.
- The app reads your location only at the moment you clock on or off, or add a progress photo. It does not track you in the background.
- You can ask to see, correct or delete your data. See your rights and deleting your account.
1. Who we are
Hubb Engineering Services Ltd (“Hubb”, “we”, “us”) is the data controller. We decide how and why personal data in the system is used.
Company number 12713033, registered in England and WalesRegistered office: Bourne House, Godstone Road, Whyteleafe, England, CR3 0BL
Email: hello@hubbengineeringservices.co.uk
Telephone: 01883 621 080
Unibuild Technologies Limited (“Unibuild”) develops, hosts and maintains the system and the app for us. It acts as our data processor, using personal data only on our instructions.
Company number 17055126, registered in England and WalesRegistered office: 12 Old Bond Street, London, England, W1S 4PW
ICO registration: ZC238395
Email: success@unibuild.co.uk
2. Who and what this covers
This policy applies to the Hubb mobile app for Android and iOS, the portal and mobile site at hubb.software, and the public forms and links the system serves, such as near miss reports, site inductions, feedback forms and shared progress pages.
It covers:
- employees, workers, apprentices and agency staff of Hubb
- subcontractors and their operatives, and client users with a portal account
- people who request an account or use one of our public forms or links
- people named in our records who may never use the system, such as residents, site contacts, witnesses and emergency contacts
If you are a Hubb employee or worker, this policy sits alongside any staff privacy notice and your employment documents.
3. The data we collect
What we hold about you depends on your role and on which parts of the system you use.
| Type of data | What it includes |
|---|---|
| Account and profile | Name, work email address, mobile number, job title, profile photo, employee or user type, role, manager, start date and access permissions. Your password and PIN are stored only as secure hashes. |
| Account requests | Name, email address, password (stored as a secure hash), and optionally your mobile number and job title, if you use “Request an account” in the app. |
| Quote requests and questions | If you send us one from the app without signing in: your name, email address, and what you choose to tell us, such as your phone number, organisation, the site address and the work. We use it to reply and to price or carry out the work. |
| Safety concerns | If you report one from the app without signing in: what you saw, where and when, any photos you add, and your name only if you give it. Nothing about your phone or any account is sent with it. We use it to look into the concern and to keep people safe. |
| Time and attendance | Clock on and off times, job, clocking method, site entrance photo where you choose a job rather than scan its code, travel time, remarks, timesheets, hourly pay rate, shifts and rest periods, holidays and absences. |
| Location | Latitude, longitude and accuracy captured at the moments described in section 4, and the distance from the job. |
| Work records | What you enter or sign in the system, including reports, site diaries, certificates, snags, permits, risk assessment briefings, toolbox talks, PPE issues, deliveries, vehicle and asset checks, call-outs, job messages, photos, videos and drawn signatures. |
| Training and compliance | Qualifications, training and e-learning results, certificates and expiry dates, skills card scheme and number, right-to-work and other staff paperwork references, site induction answers, and policies you have read and signed. |
| Emergency contacts | The name and telephone number you give for your emergency contact during a site induction. Please let that person know you have shared their details. |
| Health data (special category) | Fit notes and advice, return-to-work notes, adjustments, injury and first aid details in accident records, and the date of any fatigue health assessment. |
| Driving and vehicles | Driving licence number, categories, penalty points, photocard expiry and check code; vehicle assignments, mileage and fuel records; and fines or notices linked to you, including offence details. |
| People named in records | Residents’ names, telephone numbers, addresses, comments and any vulnerability recorded in repair and hazard reports; site and client contacts; and the name, date of birth, home address, telephone number and statement of people involved in or witnessing an accident. |
| Subcontractors and suppliers | Business contact details, company and tax references, compliance documents, orders, payment applications and reviews. |
| Device and sign-in | Device identifier, platform, device model, app version, push notification identifier, last use, and a log of each sign-in showing date, time, IP address, country and device. |
| Usage of the portal | Pages viewed, actions, errors and page speed, browser, operating system, device type, screen size, language, referring page and country, with the last part of your IP address removed. When you are signed in, this is linked to your account. |
Where the data comes from. Mostly from you, and from your managers and colleagues as they do their jobs. We also receive data from your employer if you work for a subcontractor, from clients and landlords who instruct us, from training and card scheme providers, and from driving licence checks.
Do you have to provide it? Some data is needed for your job or for us to meet legal duties, such as time records and accident reports. If it is not provided, we may be unable to give you access or meet those duties. Other items are optional, such as a profile photo.
The app does not take payments and does not collect payment card details. It does not read your contacts, calendar or messages.
4. Location data
The app uses your phone’s precise location only while you are using it, and only at these moments:
- Clocking on or off. Your position is saved with the clocking as evidence of attendance, and compared with the job’s location to show how far away you were.
- Adding a progress photo or video. Your position is saved with the file to show where the work was recorded. If a photo you choose already contains location and time details, those may be read and saved too.
The app does not collect location in the background, and does not follow your movements between these moments.
Location is not required. If you refuse permission or no position is available, you can still clock on and off, and the record will show no location. You can change this at any time in your phone’s settings.
Who can see it. People with permission to manage or approve timesheets can see clocking locations. People with access to a job’s progress records can see where its progress photos were taken. Signed-in colleagues may see which job you are clocked on to, but only authorised people can see other people’s times and hours.
5. Phone permissions
The app asks for permission before using these features. You can refuse or withdraw any of them in your phone’s settings, although the feature that needs it will then not work.
| Permission | What it is used for |
|---|---|
| Camera | Scanning job and asset codes, and taking photos and videos for your work records. Images used to read a code are processed on your phone and are not saved. |
| Photos and files | Attaching pictures, videos and documents you choose. The app reaches only the items you select. |
| Location | The moments described in section 4. |
| Microphone and speech recognition | Dictating into a text box, only when you tap the microphone. This uses your phone’s own speech recogniser, which Apple or Google may process under their own terms. We save the resulting text, not a recording. |
| Face ID or fingerprint | Unlocking the app instead of typing your PIN, if you turn it on. Your phone does the check. We never receive your face or fingerprint data. |
| Notifications | Telling you about alerts, approvals and reminders. You can switch these off at any time. |
6. Why we use data, and our legal bases
Under UK data protection law we must have a legal basis for each use of personal data.
| Purpose | Legal basis |
|---|---|
| Giving you an account, and running timesheets, holidays, rotas and pay | Contract, legal obligation (tax and working time rules) and legitimate interests in running our business |
| Health and safety records, including incidents, near misses, inductions, permits, briefings, fatigue and vehicle checks | Legal obligation, and legitimate interests in keeping people safe |
| Carrying out and recording work for clients, including certificates, reports, snagging, and hazard reports under Awaab’s Law | Contract, legal obligation and legitimate interests in delivering and evidencing our work |
| Confirming attendance using clocking location and photos | Legitimate interests in accurate time and pay records and in knowing who is on site |
| Managing training, qualifications and right to work | Legal obligation and legitimate interests in having a competent workforce |
| Managing drivers, licences, vehicles and fines | Legal obligation and legitimate interests in operating vehicles safely and lawfully |
| Security, sign-in logs, support, fixing faults and improving the system | Legitimate interests in keeping the system secure and working well |
| Sending notifications and emails about your work | Contract and legitimate interests. These are service messages, not marketing. |
| Dealing with legal claims, audits and regulators | Legal obligation and legitimate interests in protecting our legal position |
Health data is used only where necessary for employment, health and safety or social protection law, for assessing working capacity, or for legal claims (UK GDPR Article 9(2)(b), (f) and (h), with the Data Protection Act 2018, Schedule 1). Driving offence data is used only where necessary for the same employment and legal duties, or for legal claims (UK GDPR Article 10 and Schedule 1). Vulnerability information about residents is recorded only where needed to keep people safe or to meet housing and safety duties.
Where we carry out work for a landlord or other client, that client may be the controller of data about its residents or customers, and its own privacy notice will also apply.
Where we rely on legitimate interests, you have the right to object. No decision with a legal or similarly significant effect on you is made solely by automated means. The system may flag items such as fatigue limits or expired tickets, but people make the decisions.
8. Transfers outside the UK
The database and uploaded files are stored in the UK. Some providers listed above, including Cloudflare, Amazon Web Services, Brevo, OneSignal, Google and Apple, may process data in the European Economic Area, the United States or elsewhere.
Where data leaves the UK, we rely on UK adequacy regulations, such as those covering the EEA and the UK-US Data Bridge, or on appropriate safeguards such as the ICO’s International Data Transfer Agreement or Addendum. You can ask us for details using the contact details below.
9. How long we keep data
We keep personal data only for as long as it is needed for the purpose it was collected for, and to meet legal, contractual and insurance requirements. When a period ends, data is deleted or anonymised.
| Data | How long |
|---|---|
| Account requests that are declined | Deleted when declined |
| Account and profile | While you have an account, then up to 6 years after your work with us ends |
| Timesheets, clockings (including location), pay rates and holidays | 6 years after the end of the tax year they relate to |
| Absence, fit notes and return-to-work records | Up to 6 years after your work with us ends |
| Training, qualifications and inductions | Up to 6 years after your work with us ends, or longer where a project or safety record depends on them |
| Right-to-work records | 2 years after your work with us ends |
| Driving licence checks and vehicle records | While you drive for us, then up to 6 years |
| Accident and incident records | At least 3 years, and normally 6 years. Longer if a claim is possible, if the person injured was under 18, or if a law requires it. |
| Job records, certificates, safety documents, hazard reports and signatures | The length of the contract plus 6 to 12 years, or longer where building safety or contract law requires it |
| Sign-in log | 12 months |
| Logs of emails and push notifications sent | 12 months |
| Detailed portal usage data | 180 days. After that only daily totals are kept, which do not identify you. |
| App sign-in on a device | Ends after 90 days without use, when you sign out, or when your access is removed |
Deleted data may remain in secure backups for a limited time until those backups are replaced. We may keep data for longer where we need it for a legal claim or investigation, or if a law requires it.
10. Data stored on your phone
So that the app stays signed in and works with a poor signal, it stores some data on your phone: a sign-in token, a secured version of your PIN, recent screen data, drafts, and clockings and photos waiting to be sent. Signing out removes this data from the app. Uninstalling the app normally removes it too.
12. Security
We protect personal data with measures including:
- encrypted connections (HTTPS) between your device and our servers
- hashed passwords and PINs, and a PIN to reopen the app
- access based on each person’s role and permissions, with sign-in logging
- sign-ins that expire, and the removal of access when an account is deactivated
- time-limited links for opening files on a phone
No system is completely secure. Please keep your password and PIN private, and tell us straight away if you think your account or phone has been compromised. If a personal data breach is likely to put you at high risk, we will tell you.
13. Your rights
Under UK data protection law you have the right to:
- access your personal data and receive a copy
- correct data that is inaccurate or incomplete
- erase your data in certain circumstances
- restrict how we use your data in certain circumstances
- object to our use of your data where we rely on legitimate interests
- data portability, to receive data you gave us in a reusable format, in certain circumstances
- withdraw consent where we rely on it, without affecting what was done before
- not be subject to solely automated decisions with legal or similarly significant effects, and to ask a person to review such a decision
To use a right, contact us at hello@hubbengineeringservices.co.uk. There is normally no charge. We will reply within one month, or tell you if we need longer because a request is complex, and we may need to confirm your identity first. Some rights have legal limits, which we will explain if they apply.
14. Deleting your account and data
This section explains how to ask Hubb Engineering Services Ltd to delete your account in the Hubb app and portal, and your associated data.
How to ask
In the app: open My account, then Delete account, and confirm with your password. An administrator reviews the request. Your account works as usual until they decide. Once they approve it, your account is closed and you are signed out everywhere.
Without the app:
- Email hello@hubbengineeringservices.co.uk from the address on your account, with the subject “Delete my Hubb account”. If you cannot use that address, call 01883 621 080.
- We may ask you to confirm your identity.
- We will close your account and reply within one month to confirm what has been deleted and what has been kept, and why.
What we delete
- Your sign-in access, password and PIN, and your registered devices and push notification identifiers
- Your profile photo, mobile number and other profile details not needed for the records we must keep
- Other personal data that we have no continuing need or legal duty to keep
- Sign-in logs and usage data, when their periods in section 9 end
What we may keep
Some records must be kept even after an account is deleted, because the law or a contract requires them, or because they may be needed for a legal claim. These include timesheets and pay records, accident and safety records, signed certificates and job records that name you. They stay secure, are used only for those purposes, and are deleted or anonymised when the periods in section 9 end.
If you work for us, you may need your account for your job, so please speak to your manager or the office as well. Uninstalling the app does not delete your account.
15. Complaints
If you are unhappy with how we have used your data, please contact us first at hello@hubbengineeringservices.co.uk. We will acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome.
You also have the right to complain to the UK regulator, the Information Commissioner’s Office:
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AFTelephone: 0303 123 1113
Website: ico.org.uk/make-a-complaint
16. Children
Hubb is a workplace system and is not intended for children. It is not for anyone under 16, and we do not knowingly collect data from them through the app. A record may name a child where the work requires it, for example a member of a household in a hazard report. If you think a child has given us their data, please contact us.
17. Changes to this policy
We may update this policy when the system, our providers or the law changes. The current version is always on this page, with the date it was last updated. We will tell you about significant changes in the app, in the portal or by email.
18. Contact us
For any question or request about privacy, contact Hubb Engineering Services Ltd at hello@hubbengineeringservices.co.uk, call 01883 621 080, or write to Bourne House, Godstone Road, Whyteleafe, England, CR3 0BL.