Privacy Policy

Harpers South West Ltd is the data controller for the personal data described in this policy. This policy covers the Harpers SW mobile app for Android and iOS, and the Harpers SW web app.

You can reach us about anything on this page at info@harperssw.uk.

Harpers SW is a private app for people who work for or with Harpers South West Ltd — our traffic management operatives on site, and the office team who plan their work. Accounts are issued by us. There is no public sign-up, and the app cannot be used without an account we have created.

Because of that, the personal data here is work data: it exists so that jobs can be planned, carried out, evidenced and paid for.

• Your account and profile — your name, email address, phone number, your role, and the employment, right-to-work and qualification records held for you.
• Your work — the jobs and tasks assigned to you, when you start, pause and complete them, the forms and defect sheets you fill in, and your signature where a form or a policy asks for one.
• Photo evidence— the photos you take in the app, together with the time they were taken, the job site they belong to, and the device’s location at the moment of capture where one is available. See location below.
• Messages— the messages you send in a job’s chat, and which messages you have read.
• Time and pay records — your shifts, hours, the agreed amounts for them, and your timesheet confirmations.
• Feedback you send us — what you type into the in-app feedback form, plus a screenshot of the screen you were on and the steps that led there, when you choose to send one.
• Notification details — a push notification token for your device and the platform it runs on, so we can send you job alerts.
• Technical records — sign-in events, and security and error logs.

What we do not collect: we do not use advertising identifiers, we run no advertising and no third-party analytics or tracking, we do not sell personal data, and we do not read your location except at the moment you take a photo.

The app reads your device’s location once, at the moment you press the shutter to capture job evidence. The coordinates and their accuracy are burned into the photo alongside the capture time and the job site, and stored with the photo record.

The app does not track you:

• There is no background location. Nothing is read while the app is closed or idle.
• No location is read anywhere else in the app — only at photo capture.
• If you decline the permission, or no fix is available within a few seconds, the photo is still accepted and is stamped “NO LOCATION” instead, and the office is told.

Where a location is available and is more than 500 metres from the job site, the upload is rejected. The purpose is narrow and specific: it makes the evidence pack we give a client an honest record of work done at the place it was booked for.

Evidence photos are taken with the camera inside the app. The app does not read your photo gallery and has no file picker — a photo can only be one you have just taken, which is what makes it evidence. Photos are uploaded to our storage and attached to the job they were taken for.

Under the UK GDPR we must have a lawful basis for each use. Ours are performance of a contract, our legitimate interests, and compliance with a legal obligation:

• Running the work — assigning jobs, tracking progress, messaging the crew. Basis: your contract of employment or engagement, and our legitimate interest in operating the business.
• Evidencing work— stamped photos, forms, sign-off and completion reports. Basis: our legitimate interest, and our clients’, in an accurate and tamper-resistant record of what was done, where and when.
• Health, safety and compliance — defect sheets, risk assessments, policy acknowledgements, qualification records. Basis: our legal obligations, and our legitimate interest in working safely.
• Paying you — timesheets, hours, agreed amounts. Basis: your contract, and our legal obligations for tax and record keeping.
• Notifying you — push notifications about your jobs and messages. Basis: our legitimate interest in reaching you about work you are assigned.
• Fixing faults — feedback you send, including its screenshot. Basis: our legitimate interest in a working product.

We do not sell personal data and we do not share it for advertising. We use the following providers to run the product, and they process data only on our instructions:

• Supabase — the database, file storage and sign-in that hold your records and photos.
• Vercel— hosting for the web app and the app’s API.
• Pusher — live updates. Only record identifiers travel over it; the app then fetches the content from us.
• Expo, with Apple and Google — delivery of push notifications to your device.
• Resend — transactional email, such as account and reset messages.
• Trigger.dev — scheduled and background work, such as generating completion reports and expiry reminders.
• Anthropic — turns an incoming job request into structured job details. It is not used to make decisions about you.

Beyond those: our clients receive completion reports for the jobs they book, which contain the evidence and sign-off for that job. When you are allocated to a job, the client who booked it is emailed your name and mobile number so they can contact the crew on the day; this is part of the job, on the basis of our legitimate interest, and our client’s, in the work being carried out safely. We also disclose personal data where the law requires it, or to establish or defend legal claims.

Some of the providers above process data outside the United Kingdom. Where they do, the transfer is covered by UK-approved safeguards — the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with the provider’s own security commitments. You can ask us for details of the safeguards that apply.

We keep your account and profile data for as long as you work for or with us. After that we keep only what we still need, and for no longer than we need it:

• Job and evidence records — kept with the job they belong to, because they are the record of work delivered to a client and may be needed for insurance, safety or a dispute.
• Pay and timesheet records — kept for the period required by tax and employment law.
• Messages, feedback and technical logs — kept while they are useful for running and supporting the product, then deleted.

Under the UK GDPR you have the right to:

• ask for a copy of the personal data we hold about you;
• have inaccurate data corrected;
• ask for data to be erased, where we no longer need it;
• ask us to restrict how we use it, or object to our use of it;
• receive certain data in a portable form; and
• withdraw a permission you gave on your device, at any time.

Some of these rights are limited where we must keep a record by law, or where it forms part of the evidence for a job. To exercise any of them, email info@harperssw.uk.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put it right first.

The mobile app asks for three permissions, all optional at the OS level:

• Camera — to take evidence photos. Without it you cannot capture evidence.
• Location— for the capture stamp described above. Without it photos still work and are stamped “NO LOCATION”.
• Notifications — to alert you about jobs and messages. Without it the app still works; you just are not alerted.

You can change any of them at any time in your device settings, under the Harpers SW app.

Data is encrypted in transit. Access is controlled per-account at the database level, so you see the jobs and records you are entitled to and not other people’s. On your phone, your sign-in token is held in the operating system’s secure keystore, and work saved while you have no signal is stored on the device only until it syncs. No security is absolute, but we take these measures seriously and review them as the product changes.

The app is a workplace tool for people employed or engaged by Harpers South West Ltd. It is not directed at children and we do not knowingly collect data from anyone under 16.

If what the app collects changes, we update this page and the date at the top of it. Where a change is significant we will also tell you in the app.

Questions about this policy, or about the data we hold on you, go to info@harperssw.uk, addressed to Harpers South West Ltd.