Privacy notice

This notice explains what personal information Recover collects, why, who sees it and what your rights are. We have tried to keep it short and plain.

1. Who we are

Recover is a trading name of Recover Software Ltd, a company registered in England and Wales (company number 17555568), whose registered office is at 66 Paul Street, London EC2A 4NA (“we”, “us”). You can contact us about privacy at privacy@getrecover.co.uk or by post at our registered office. We are registered with the Information Commissioner's Office (ICO) under reference [ICO registration number].

2. Two different roles

It helps to know which role we play, because it decides who is responsible for the information.

• For visitors, enquiries and the people who log in (enquiries, account details and sign-in records) we decide how the information is used, so we are the “controller”.
• For what a customer company puts into Recover (projects, compensation events, notes, photographs, diary hours and so on) the customer company decides what is recorded and why. The customer is the controller and we are its “processor”: we store and handle that information only on the customer's instructions and to run the service. If you are a member of a customer's staff and want to see or correct information about you in their records, please ask your employer first. We will help them answer.

3. What we collect

• If you register your interest: your name, company, email address, telephone number (optional), anything you write in the message box, and whether you asked to receive updates.
• If we contact you about Recover: your name, company, job role and work contact details, and our notes of any conversation. See section 4 for where we find these.
• If you are a customer contact: your name, work email, phone number and role, and our record of calls, emails and agreements with your company.
• If you have an account: your name, your email address, your password (kept only in a scrambled form that we cannot read), your company, what you are allowed to access, and the date you accepted our terms.
• What you add to the service: project and compensation event details, notes, photographs, diary entries and the names of people and plant recorded against them. Every note and record is stamped with the date, the time and the name of the person who added it, and cannot be edited after it is saved (it can only be marked private). Photographs may show people or places.
• Dictated notes: if you use the microphone button, your phone or browser turns your speech into text. We receive only the text you choose to send, not the recording.
• Technical records: sign-in sessions, and basic logs such as IP address, device type and error reports, which we use to keep the service secure and working.

We do not ask for, and ask you not to add, special category information such as health details.

4. Where we get it from

• From you, when you fill in our form, email or call us, or use the service.
• From your employer, when it invites you to Recover (your name, work email and what you can access) or names you in its records.
• From public business sources, when we contact you about Recover for the first time: for example LinkedIn, Companies House, your company's website or industry directories, or a referral from someone who knows you. We only collect work details, and we tell you where we found them in our first message.

5. What you need to give us

You do not have to give us any information. But we need a name and email address to reply to an enquiry, and a work email address to set up an account, because that is how you sign in. Without them we cannot reply or give you access. Everything else is optional, unless your employer asks you to record it as part of your work.

6. Why we use it, and our legal basis

• To reply to your enquiry and arrange a call: our legitimate interest in answering people who contact us, and steps you ask us to take before a contract.
• To manage our relationship with customer companies: our legitimate interest in running our business, and our contract with your company.
• To set up and run your account and the service: to carry out our contract with your company, and our legitimate interest in giving its users a working service.
• To send service emails such as invitations, sign-in links and password resets: as above.
• To keep the service secure, prevent misuse and fix faults: our legitimate interest in running a safe service.
• To meet legal obligations, such as keeping accounting records: a legal obligation.
• To contact people at construction businesses about Recover for the first time, by email, LinkedIn message or phone: our legitimate interest in telling businesses about a product relevant to their work. We only contact people in their work role, we say who we are and where we found their details, and every message lets you say no to further contact. If you work for yourself as a sole trader or in a partnership, we only email you about Recover if you have asked us to or are already a customer.
• To send occasional updates about Recover: if you ticked the box asking for them, or as a follow-up to our contact with you in your work role. You can unsubscribe at any time, and we will stop straight away.

We do not make decisions about you by automated means that have legal or similarly significant effects.

7. Who we share it with

We do not sell personal information. We use a small number of suppliers to run the service. The ones that handle customer information are listed, with where they hold it, on our supplier list.

• Supabase: the database, sign-in and file storage. Our project is hosted in London (UK).
• Vercel: serves the website and app.
• Resend: sends emails such as invitations, alerts and password resets.
• HubSpot: keeps our record of enquiries and customer contacts. It does not hold what customers add to the service.
• Microsoft: our business email.
• Your browser's maker (for example Google, Microsoft or Apple): if you use dictation, they turn the speech into text under their own terms.

Within a customer company, other users of the same company can see what you add, according to the access that company has given them. Companies cannot see each other's information. We may also share information with our professional advisers, with a buyer if our business is sold, where the law requires it, or to protect our legal rights.

8. Sending information outside the UK

Customer content is stored in London. Some of our suppliers are US companies and may handle some information in the United States, for example to send an email. Where they do, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework for certified suppliers) or on the UK International Data Transfer Agreement or Addendum in the supplier's data processing terms. Ask us if you would like details.

9. Cookies

We use only the cookies needed to keep you signed in securely. We do not use advertising, analytics or tracking cookies, so there is no cookie banner. If that ever changes, we will ask for your consent first and update this notice.

10. How long we keep it

• Enquiries, and details of people we have contacted, that do not lead to a customer relationship: 2 years from our last contact, then deleted. If you ask us not to contact you again, we keep only your name and email on a do-not-contact list, so we can respect that.
• Account details and customer content: for as long as the customer company uses Recover. When the agreement ends, the customer can export its information for 30 days, and we then delete it within 90 days unless the law says we must keep it.
• Customer contact, contract and billing records: 6 years after the agreement ends, for tax and legal reasons.
• Technical logs: up to 30 days.
• Backups are kept on a rolling basis for 7 days and then overwritten.

11. How we protect it

Information is encrypted while it travels and when it is stored. Each company's information is kept separate by rules in the database itself, not just in the screens you see. Notes and records cannot be edited once saved, and once a compensation event is marked implemented, nothing can be added to or changed in its records unless it is reopened. Access to our systems is limited to people who need it. More detail is on our security page. No system is perfectly secure; if there is a breach that affects you we will tell you and the ICO as the law requires.

12. Your rights

You can ask us to:

• give you a copy of the personal information we hold about you;
• correct information that is wrong;
• delete information, where the law allows;
• restrict or stop how we use it, or object to it, including asking us never to contact you about Recover again;
• give it to you, or another organisation, in a portable format;
• withdraw your consent, where we rely on it.

Because notes and records are time-stamped evidence, some cannot be changed or removed while they are needed to support a customer's contract position. We will explain if that applies. To use any right, email privacy@getrecover.co.uk. We will reply within one month. If your request is about information a customer company added, we will pass it to that company and help it respond.

13. Complaints

If you are unhappy with how we have handled your information, you can complain to us by email at privacy@getrecover.co.uk or by post at our registered office. Tell us what happened and what you would like us to do. We will acknowledge your complaint within 30 days, look into it, keep you updated, and tell you the outcome without undue delay. You can also complain to the ICO at ico.org.uk/make-a-complaint or on 0303 123 1113.

14. Children

Recover is for businesses and is not aimed at anyone under 18.

15. Changes

If we change this notice we will update the date at the top. If the change is significant we will tell account holders.