Privacy Policy

1. Introduction

This Privacy Policy is provided by TRU TRADE GROUP LIMITED, a company incorporated in England and Wales with company number 15642301 and registered office at 6a Althorpe Street, Leamington Spa, England, CV31 2AU (“TruTrade”, “we”, “our” or “us”). We provide the TruTrade digital platform (the “Platform”) and related applications, tools, communications and subscription services for students, construction professionals and tradespeople, including estimating, project management, e-learning materials, materials ordering and land development services, the website and its subdomains, and TruTrade Academy activities (together, the “Services”). This policy explains how we handle personal data in connection with the Services and our wider business activities.

We take your privacy very seriously. Please read this privacy policy carefully as it contains important information on how and why we collect, store, use and share any information relating to you (your personal data).

It also explains your rights in relation to your personal data and how to contact us or the relevant regulator in the event that you have a complaint. Our collection, storage, use and sharing of your personal data are regulated by law, including under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We are generally the controller of personal data used for the website, account and subscription administration, billing, support, security, communications, marketing, Academy activities and our own business operations. Organisations and users may also upload or share personal data through projects, TruChat, TruTeam, student profiles or other collaborative features. The organisation or user deciding why and how that information is used may be a separate controller, and we may act as its processor where we handle the information only on its documented instructions. This policy does not replace any privacy information that such an organisation must provide. Project managers and account administrators are responsible for allocating access appropriately and handling personal data available to them lawfully and securely.

2. What this policy applies to

This privacy policy applies when you visit our website at www.trutrade.co.uk or any of its subdomains; create, receive or use a Platform account or subscription seat; participate in projects or use TruChat or TruTeam; use estimating, project-management, e-learning, materials-ordering, referral, land development or related Services; contact us online, by telephone or offline; receive marketing; or take part in TruTrade Academy activities (the “Academy”, meaning the training, education and professional development programme operated by TruTrade for students, tradespeople and construction professionals, including all associated courses, events and media activities).

You must be at least 18 years old (or, if higher, the age of majority in your jurisdiction) to create or use a Platform account, hold or be allocated a subscription seat, or otherwise use the Platform and related Services (other than Academy activities), consistent with our Platform Terms and Conditions. Academy users may include students and adult learners, and participation in Academy activities may involve individuals under 18. Where a student is under 18, we will provide age-appropriate information, comply with the ICO’s Age Appropriate Design Code where applicable, and obtain consent from a parent or guardian where consent is the appropriate lawful basis and the student cannot validly provide it.

Our website and Services may link to websites or services owned and operated by third parties, including merchants, service providers, payment providers and social media platforms. Those third parties may collect and use personal data as independent controllers under their own privacy notices. We are not responsible for, and accept no liability in connection with, their privacy practices or the content of their websites or services. We encourage you to read their privacy notices before providing them with any personal data. For more information, see the section ‘Who we share your personal data with’ below.

3. Personal data we collect about you

We may collect identity and contact data, such as your full legal name, username, title, date of birth or age confirmation, employer, college or organisation, role, postal address, telephone number and email address. We may also collect account, authentication and verification data, including your password in encrypted or hashed form, account status, profile information, permissions, project allocations, subscription-seat assignments, acceptance records, preferences and records of account provisioning or changes.

We may collect transaction and relationship data, such as enquiries, contracts, subscriptions, free-trial and seat details, orders, invoices, VAT numbers, Construction Industry Scheme (CIS) details, National Insurance numbers, bank account numbers and sort codes entered for invoice generation, payment status, service history and records of our dealings with you. National Insurance numbers, bank account numbers and sort codes are subject to enhanced access controls and encrypted at rest. Card details and payment processing are handled by Stripe; we receive payment identifiers, status and limited transaction information rather than full card details.

We may also collect communications and content data, including support correspondence, recorded calls where notified, TruChat and TruTeam messages, posts, comments, images and other attachments, moderation records, feedback and records of actions taken to resolve an issue. Please do not provide special category or criminal offence data unless it is necessary and an appropriate lawful basis and additional legal condition apply.

We may also create and use aggregated or irreversibly anonymised information, which is not personal data because it does not identify an individual. For example, we may aggregate website, Platform, project or subscription usage data to analyse trends, maintain security and improve the Services. We will not use identifiable content controlled by another organisation for purposes incompatible with those for which the data was originally shared with us, unless lawfully permitted and transparently disclosed.

We collect and use this personal data for the purposes described in the section ‘How and why we use your personal data’ below.

4. Sensitive data

Sensitive personal data (also known as special category data) means personal data revealing racial or ethnic origin; political opinions; religious or philosophical beliefs; trade union membership; genetic data; biometric data (where used for identification purposes); data concerning health; data concerning a person’s sex life; and data concerning a person’s sexual orientation.

We do not ordinarily need special category data for our own purposes. It may nevertheless be included in content you choose to upload, an enquiry, support request, complaint, Academy activity or other communication. We will process it only where an Article 6 lawful basis and an applicable Article 9(2) condition (together with any relevant condition under Schedule 1 of the Data Protection Act 2018) apply, with appropriate safeguards, for example for legal claims, substantial public interest, where you have manifestly made the information public, or with explicit consent where appropriate. We do not use biometric data for identification unless we specifically notify affected individuals before doing so.

Please do not provide special category or criminal offence data unless it is specifically requested or necessary for the relevant purpose. Organisations and users must ensure that they have a lawful basis and, where applicable, an additional legal condition before uploading or sharing such data through the Platform.

Complaints, moderation, disputes and security data: We may process information about complaints, reported or inappropriate content, moderation decisions, disputes, suspected fraud, misuse, security incidents, account restrictions and other compliance matters. This may come from you, account administrators, project managers, other users, colleges, customers, suppliers, partners, public sources, regulators, law enforcement or professional advisers. We use it to investigate concerns, remove content, suspend access, protect the Services and our business, prevent unlawful activity and establish, exercise or defend legal claims. Where it includes special category or criminal offence data, we process it only where the required additional condition applies.

5. How your personal data is collected

We use different methods to collect data from and about you, including through:

(i) Your interaction with us: We collect personal data directly from you when you visit our website, complete a form, create or use an account, accept our policies, buy or use Services, upload content, enable GPS or other device permissions, communicate with support, attend an event, participate in Academy activities, subscribe to communications or otherwise deal with us online or offline. We may also receive data from the organisation, project manager, account administrator or college connected with you; other users; Stripe; merchants, suppliers and business partners; public professional sources; and service providers involved in hosting, security, communications, support or delivery of the Services. Academy footage may be recorded by TruTrade or provided by a student or college.

(ii) Automated technologies or interactions: As you interact with the website or Platform, we may automatically collect technical, usage and location data through cookies, device permissions, software development kits, application and server logs, authentication events and similar technologies. Essential technologies may be used where necessary to provide, secure or remember settings for the Services. Non-essential cookies, analytics or similar technologies are used only where permitted by the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”) and applicable consent requirements. See our Cookie Policy for more information.

6. How and why we use your personal data

Under data protection law, personal data may only be processed where there is a lawful basis. We act as controller for our own website, Academy activities, sales and relationship management, account and subscription administration, contracting, billing, support, marketing, moderation, compliance, security and business-operation purposes. Where we host or handle project, workforce, chat or other content solely on an organisation’s documented instructions, that organisation is normally the controller and we act as processor. Where we act as controller, we rely on one or more of the following lawful bases:

• where you have given consent
• to comply with our legal and regulatory obligations
• for the performance of a contract with you or to take steps at your request before entering into a contract, or
• for our legitimate interests or those of a third party

A legitimate interest is when we or a third party have a business or commercial reason to use your information, so long as this is not overridden by your rights and interests. We carry out an assessment where appropriate to balance those interests against your own. You can obtain further information by contacting us (see ‘How to contact us’ below). Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

We do not currently use solely automated decision-making (including profiling) that produces legal effects concerning you or similarly significantly affects you. Feed ordering, recommendations, fraud indicators or moderation tools may support how content or services are displayed or reviewed, but material account or moderation decisions involve human oversight. If we introduce processing to which Article 22 UK GDPR applies, we will provide the required information and safeguards, including rights to obtain human intervention, express your view and contest the decision.

The table below explains what we use your personal data for and why.

See ‘Who we share your personal data with’ for further information on the steps we will take to protect your personal data where we need to share it with others.

7. Marketing

We may send non-marketing communications about accounts, subscriptions, invoices, support, security, service availability and changes to the Services. Separately, we may send newsletters, product updates, event information and promotional communications where permitted.

Where required by law, including PECR, we will obtain consent before sending direct marketing by email, SMS, WhatsApp or similar electronic means. Where PECR permits marketing without consent, including where the corporate-subscriber rules or soft opt-in properly apply, we may rely on our legitimate interests, always subject to your right to opt out. We seek consent where required for non-essential cookies and similar technologies and record relevant preferences. We only send you WhatsApp messages if you tick the WhatsApp consent box when you sign up, and you can withdraw that consent at any time.

You have the right to opt out of receiving marketing communications at any time by:

• contacting us using the details in ‘How to contact us’, using the contact form at www.trutrade.co.uk/contact, or emailing us at team@trutrade.co.uk; or
• using the ‘unsubscribe’ link included in all marketing emails you may receive from us, or replying STOP to any WhatsApp message from us.

We will not sell or rent your personal data to third parties for their own direct marketing purposes, or otherwise disclose it to third parties for their independent direct marketing without your consent.

For more information on your right to object at any time to your personal data being used for marketing purposes, see ‘Your rights’ below.

8. Who we share your personal data with

We share personal data only where necessary for the purposes and lawful bases set out in this Privacy Policy. Depending on the relevant Service, recipients may include:

(a) the organisation you represent, account administrators, project owners and managers, authorised project participants and other Platform users, where necessary to provide collaborative features and manage access;

(b) suppliers, subcontractors, merchants, estimating, referral or land development partners and other business partners involved in providing or facilitating the Services;

(c) technology providers used for hosting, cloud infrastructure, databases, storage, backup, content delivery, email, notifications, application distribution, logging, analytics, monitoring, customer support and security, including Amazon Web Services for European hosting of chat data and uploaded images;

(d) Stripe and other payment, banking, invoicing and accounting providers used to administer subscriptions, process payments, generate invoices and meet financial obligations; full payment-card details are handled by Stripe, which provides its own privacy information;

(e) identity, authentication, fraud-prevention and compliance providers, where used;

(f) analytics, cookie and device-service providers, including providers supporting GPS or location-enabled functionality;

(g) the advertising platforms and marketing tools we use: Meta, through the Meta Pixel and Conversions API, to measure and target adverts; Google Analytics and Google Tag Manager; and GoHighLevel, the CRM used to send emails, WhatsApp and SMS messages;

(h) colleges, potential employers, Platform users, social media platforms and marketing or media partners where student media is shared for the disclosed Academy or promotional purpose and with the prior authorisation of the individual (or their parent or guardian where the individual is under 18); and professional advisers, auditors, insurers, regulators, courts, law enforcement and other authorities where required or permitted by law.

Where service providers process personal data on our behalf, they do so under contractual obligations and must act only on our documented instructions. Some recipients, including Stripe, merchants, colleges, employers and social media platforms, may act as independent controllers for their own purposes and should provide their own privacy information.

We require processors to provide sufficient guarantees of appropriate technical and organisational measures and to process personal data only on documented instructions, subject to applicable contractual and legal obligations. When users post to TruChat or content is published on social media, it may be visible, copied or reshared by others; users should avoid posting personal data they do not want made available to the relevant audience.

We or the third parties mentioned above may also need to share personal data with:

• external auditors, e.g. in relation to the audit of our accounts and our company; the recipient of the information will be bound by confidentiality obligations
• professional advisers (such as lawyers and other advisers); the recipient of the information will be bound by confidentiality obligations
• law enforcement agencies, courts or tribunals and regulatory bodies to comply with legal and regulatory obligations
• other parties in connection with a significant corporate transaction or restructuring, including a merger, acquisition, asset sale, initial public offering or in the event of our insolvency; information will be anonymised or aggregated where practicable and otherwise limited to what is reasonably necessary, and the recipient of the information will be bound by confidentiality obligations

If you would like more information about recipients or safeguards, please contact us (see ‘How to contact us’ below). Where we process personal data for another controller, details of relevant processors and locations may also be set out in our contract with that controller.

We do not share your personal data with third parties except as described in this Privacy Policy, where otherwise consistent with the purposes and lawful bases set out in this policy, or where required or permitted by law.

9. How long your personal data will be kept

We keep personal data only for as long as reasonably necessary for the relevant purpose, including to provide and secure the Services, manage accounts and relationships, meet legal, tax and accounting obligations, handle moderation and complaints, prevent fraud, enforce agreements and establish, exercise or defend legal claims. We consider the nature, amount and sensitivity of the data, risk of harm, purpose, available alternatives, limitation periods and legal requirements.

Unless a longer period is required or justified:

• project and associated chat data is ordinarily archived after approximately three years and deleted after approximately five years
• account and subscription data is kept for the account relationship and ordinarily up to six years afterwards
• invoices, VAT and accounting records are kept for at least six years after the relevant financial year
• support and complaint records are ordinarily kept for up to two years after resolution
• security and access logs are ordinarily kept for up to 12 months
• marketing suppression records are kept as long as needed to honour an opt-out

Academy footage and images may be kept while they remain needed for the profile, employer-connection or promotional purpose, subject to review at least annually, and will be removed where a valid erasure request or withdrawal of consent requires this, although copies already lawfully published or reshared by independent third parties may not be fully recoverable. Administrators may delete individual chat messages or inappropriate content earlier. Backup copies are overwritten in the ordinary cycle unless law or a legal hold requires retention.

Following the end of the applicable retention period, we will delete or anonymise personal data in accordance with applicable data protection requirements, unless we are required to retain it (for example, due to legal obligations or a legal hold).

10. Transferring your personal data out of the UK

TruTrade is UK-based and uses European hosting for chat data and uploaded images, but some suppliers, social media platforms or their support teams may process personal data outside the UK. Where UK adequacy regulations do not apply, we will use an appropriate safeguard such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, together with any required transfer risk assessment and supplementary measures, or another lawful transfer mechanism. You may request a copy of, or information about, the applicable safeguard, subject to appropriate redactions.

Furthermore, under UK data protection laws, we can only transfer your personal data to a country outside the UK where: the UK government has decided the particular country ensures an adequate level of protection of personal data (known as an ‘adequacy regulation’) under applicable UK data protection law; there are appropriate safeguards in place (such as the IDTA and, where relevant, the UK Addendum to the EU Standard Contractual Clauses), together with enforceable rights and effective legal remedies for you; or a specific exception applies under relevant data protection law.

• The EEA: we may rely on the UK adequacy regulations in respect of EEA countries (where applicable).
• Other countries: we will put in place appropriate safeguards (such as the IDTA and, where required, a transfer risk assessment (TRA)) and other measures required by UK data protection law.

In the event that we could not continue to rely on either of those mechanisms at any time, we would implement an alternative lawful transfer mechanism before any such transfer takes place and would not knowingly transfer your personal data outside the UK without an adequate legal basis under UK data protection law.

11. Your rights

You generally have the following rights, which you can usually exercise free of charge. Where TruTrade acts as controller, you may direct requests to us. For project, workforce, chat or other content controlled by your organisation, you should normally contact that organisation because it decides how to respond; we will assist it as required by law and our contract. Further information is available from the ICO at https://ico.org.uk/.

For further information on each of those rights, including the circumstances in which they do and do not apply, please contact us (see ‘How to contact us’ below). You may also find it helpful to refer to the guidance from the UK’s Information Commissioner on your rights under the UK GDPR.

If you would like to exercise any of those rights or withdraw consent, please email or write to us (see ‘How to contact us’). We may need to verify your identity before responding. We will respond without undue delay and normally within one month; this may be extended by a further two months where permitted because of complexity or the number of requests. Where requests are manifestly unfounded or excessive, we may charge a reasonable fee or decline to act as permitted by law. When contacting us, please:

• provide enough information to identify yourself (for example, your full name, business relationship and account identifier where applicable) and any additional information we reasonably need to verify your identity, and
• let us know which right(s) you want to exercise and the information to which your request relates.

12. Keeping your personal data secure

We use technical and organisational measures designed to provide security appropriate to the risks, taking account of the nature, scope, context and purposes of processing. Measures include secure hosting, encryption where appropriate, role-based access controls, authentication, password protection, confidentiality obligations, supplier due diligence, backup, resilience, testing and incident-management procedures. Access to chat, Academy media and other content is restricted to authorised personnel, users and service providers according to their roles. No system is completely secure, and this notice does not guarantee absolute security. We are not liable for unauthorised access, loss or damage arising from circumstances beyond our reasonable control, including third-party attacks, provided we have implemented appropriate security measures.

We assess suspected personal data breaches and, where required by law, notify the ICO where a breach is likely to result in a risk to individuals’ rights and freedoms, and notify affected individuals where the breach is likely to result in a high risk to them. Where we process personal data as processor for another controller, we notify and assist that controller in accordance with applicable law and our contract; that controller remains responsible for regulatory and data-subject notifications unless the law provides otherwise.

If you want detailed information from Get Safe Online on how to protect your information and your computers and devices against fraud, identity theft, viruses and many other online problems, please visit www.getsafeonline.org. Get Safe Online is supported by HM Government and leading businesses.

13. How to complain

Please contact us if you have any queries or concerns about our use of your information (see ‘How to contact us’ below). We hope we will be able to resolve any issues you may have.

You also have the right to lodge a complaint with the Information Commissioner, although we would appreciate the opportunity to address your concerns before you approach the ICO.

The Information Commissioner can be contacted at https://ico.org.uk/make-a-complaint or by telephone: 0303 123 1113.

14. Changes to this privacy policy

We may change this privacy policy from time to time to reflect changes in the Services, including Platform, subscription, chat, location and Academy features, our processing activities, suppliers, Cookie Policy or legal requirements. We will publish the updated version on our website, update the version number and date above, and any changes will take effect from publication unless otherwise stated, provided that material changes will not take effect until at least 14 days after publication. Where appropriate, we will use a proportionate additional method to bring material changes to affected individuals’ attention. A privacy notice describes processing; continued use is not treated as consent where consent is legally required.

15. How to contact us

You can contact TruTrade’s privacy team by post or email if you have questions about this privacy policy or our use of personal data, wish to exercise your data protection rights, withdraw consent or make a complaint. If your request concerns project, workforce, chat or other content controlled by an organisation, please identify that organisation and contact it directly where practicable.

Our contact details are shown below:

• TruTrade, 6a Althorpe Street, Leamington Spa, England, CV31 2AU
• team@trutrade.co.uk