Terms & Conditions and Privacy Notice

1. About this system

This system is provided by Risby Homes to record site inductions and the arrival and departure of everyone attending our developments. Signing in is a condition of entry onto site. By signing in you confirm that the information you provide is accurate, that you will comply with all site rules, signage, PPE requirements and the instructions of site management, and that you accept these terms.

2. Who is responsible for your data

Risby Homes is the data controller for the personal data collected through this system, as defined by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. If you have any questions about how your data is handled, or wish to exercise your rights, contact Risby Homes site management or email amy@risbyhomes.co.uk.

3. What data we collect

• Identity and contact details: name, company name (where applicable), home address and postcode, telephone number, email address and date of birth.
• Attendance records: the site attended, sign-in and sign-out date and time, the visitor host or manager you are visiting, and the network (IP) address of the device used to sign in or out.
• Emergency contact details: the name, telephone number and relationship of the person you nominate.
• Health information: whether you have any medical condition that may affect your work, whether you are taking medication, and whether anything has changed in the last six months, together with any details you choose to give. This is special category data.
• Competence information: your trade and any qualification or certification documents you upload.
• Induction records: your PPE confirmation and your answers to the site safety questions.
• Sales enquiries: for sales visits we collect only your name, telephone number, email address and the development visited.

4. Why we collect it and our lawful basis

• Legal obligation. To meet our duties under the Health and Safety at Work etc. Act 1974 and the Construction (Design and Management) Regulations 2015, including maintaining an accurate record of who is on site, verifying competence and delivering site inductions.
• Vital interests and legal obligation. To account for everyone on site during a fire evacuation or other emergency, and to enable emergency services or first aiders to act on your health information and contact your nominated emergency contact. Special category health data is processed under Article 9(2)(b) and 9(2)(c) UK GDPR (employment health and safety obligations and protection of vital interests).
• Legitimate interests. To manage site security, prevent unauthorised access, investigate incidents and accidents, and administer contractor attendance. Sign-out codes (your initials and year of birth) exist so that only you can close your own attendance record.
• Consent. For sales enquiries, where you ask us to contact you about a development. You may withdraw consent at any time.

We do not use your data for automated decision making or profiling, and we never sell your data.

5. Who can see your data

Access is restricted to authorised Risby Homes site management and administrators, who must sign in with an individual password-protected account each time they open the admin area. We may share records where we are legally required or permitted to do so: with the Health and Safety Executive or other regulators, with the emergency services, with your employer or principal contractor in relation to an incident, and with our insurers or legal advisers. Data is hosted by our technology providers acting as data processors under written terms, on servers within the UK or European Economic Area, or under appropriate safeguards such as the UK International Data Transfer Addendum where a transfer outside that area is necessary.

6. How we keep it secure

• All data is transmitted over encrypted HTTPS connections.
• Data is stored in a managed database that is encrypted at rest and backed up regularly.
• Row-level security rules mean the kiosk device can only create a sign-in or sign-out record. It cannot read back other people's personal details, health information or documents.
• Uploaded qualification certificates and site plans are held in private storage and are only retrievable by authenticated administrators.
• Administrator passwords are stored only as salted hashes and are never visible to anyone, including us.
• Administrator actions such as a manual sign-out are recorded with a time and network address for auditability.
• Access is granted on a least-privilege basis and reviewed when roles change.

7. How long we keep it

Attendance and induction records are retained for three years from the date of the visit, to satisfy health and safety, insurance and accident investigation requirements. Where a record relates to an accident, incident or claim, or to work that may give rise to a personal injury claim, it may be retained for longer as permitted by law. Sales enquiry details are retained for up to twelve months unless you ask us to delete them sooner or you become a customer. Records are securely deleted once the retention period ends.

8. Your rights

You have the right to be informed, and to request access to, correction of, or erasure of your personal data. You may also ask us to restrict processing, object to processing based on legitimate interests, request data portability, and withdraw consent where consent is our lawful basis. Some records must be kept to meet our legal health and safety obligations, so a deletion request may not always be possible for those records — we will always explain our decision. We will respond within one month.

To make a request, contact amy@risbyhomes.co.uk. If you are unhappy with our response you may complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

9. Site rules and your responsibilities

• Sign in on arrival and sign out on leaving, every time.
• Do not share your sign-out code with anyone else, and do not sign in or out on behalf of another person.
• Wear the PPE you confirmed at induction at all times in working areas.
• Follow the fire plan, evacuation route and assembly point shown at induction and displayed on site.
• Report all accidents, near misses and hazards to site management immediately.
• Only competent, qualified persons may alter scaffolding or operate plant.
• Tell site management if your health, medication or emergency contact details change.

10. Cookies and technical data

This system does not use advertising or tracking cookies. It stores only the technical data needed to keep an administrator signed in during a session and records the network address used for each sign-in or sign-out as part of the safety audit trail.

11. Changes to these terms

We may update these terms and this privacy notice from time to time. The current version is always shown on this page with the date it was last updated. Continued use of the system means you accept the version in force at the time you sign in.