App & CRM privacy policy

Last updated: 26 August 2026

This policy explains how GDP Electrical Services LTD (“we”, “us”, “our”) collects and uses personal data when you use the GDP staff mobile application (iOS / Android) or the staff CRM at app.gdpelectrical.uk. It is written to meet UK GDPR and the Data Protection Act 2018. Visiting our public website is covered by the separate website privacy policy.

1. Data controller

The data controller is:
GDP Electrical Services LTD
Companies House number: 10902872
Address: Dunstable, LU6 3LY, United Kingdom
Privacy contact: contact@gdpelectrical.uk

2. What this policy covers

• The GDP staff mobile app (iOS / Android)
• The staff CRM (app.gdpelectrical.uk)

Both are internal tools for GDP employees and authorised subcontractors. There is no public self-registration and no customer-facing portal.

3. Personal data we process

3.1 Staff and subcontractor accounts

Accounts are created by the company when an employee or subcontractor signs their engagement contract. We process:

• Account data: full name, work email, phone number, home address, role and login credentials (stored hashed)
• Employment / engagement details collected under your contract: emergency contact details, qualifications and certifications, and bank details used for payment
• Work and time-tracking data: the projects you are assigned to, your clock-in / clock-out entries and the timesheets built from them
• Location data: a GPS position is captured from your phone only at the moment you clock in or clock out on a project, to confirm on-site attendance. The app does not track your location in the background.
• Photos and media: job-related photos are uploaded through the web CRM. The mobile app does not capture or upload photos.
• Device data: device type, OS version, app version and — once push notifications launch — a Firebase Cloud Messaging token

3.2 Customer / job-related data processed by staff

Through the CRM and app, staff may process customer names, addresses, contact details and job information necessary to deliver electrical services. That data is processed on behalf of GDP Electrical as controller for business operations. Customers do not hold accounts on the CRM or the app.

4. Purposes and lawful bases

• Providing the CRM and staff app — performance of the employment or engagement contract signed with each employee/subcontractor, and legitimate interests in running our business operations.
• Security, audit and fraud prevention — legitimate interests.
• Legal and regulatory obligations — legal obligation (e.g. tax, health & safety, electrical certification records).
• Push notifications (work and shift updates) — legitimate interests in coordinating field work. Delivered via Firebase Cloud Messaging once available; you can disable notifications in your device settings at any time.

5. Who we share data with

We may share personal data with:

• Hetzner — hosting and object (file) storage, on servers located in Germany (EU)
• Sentry — error and crash reporting
• Resend — transactional email delivery
• Google Firebase — push notification delivery (Firebase Cloud Messaging), once notifications launch
• Mobile platform providers (Apple, Google) as needed to distribute the app
• Professional advisers and insurers where required
• Authorities when legally required

We do not sell personal data.

6. International transfers

Our servers and file storage are provided by Hetzner and located in Germany, in the European Union. Transfers between the UK and the EEA are covered by the UK adequacy regulations. Some service providers (Sentry, Resend, Google Firebase) may process limited data in the United States; where they do, transfers rely on the UK Extension to the EU-US Data Privacy Framework or equivalent contractual safeguards.

7. Retention

• Staff account data: kept while the account is active and for 6 months after departure, unless a longer period is required by law.
• Payroll, tax and employment records: 6 years, as required by UK law.
• Job / customer records, certificates and invoices: 6 years.
• Server logs: 90 days.

8. Your rights

Under UK GDPR you may have the right to:

• Access your personal data
• Rectify inaccurate data
• Request erasure (in certain circumstances)
• Restrict or object to processing
• Data portability (where applicable)
• Withdraw consent where processing is based on consent

To exercise these rights, contact contact@gdpelectrical.uk. Staff and subcontractors may also request account deletion via our delete account process.

You can complain to the Information Commissioner’s Office (ICO).

9. Children

The app and CRM are for adult workers. We do not knowingly collect data from children.

10. Security

We use appropriate technical and organisational measures to protect personal data. All data is encrypted in transit and at rest, and access to the CRM and app is restricted through per-account access controls.

11. Changes

We may update this policy from time to time. The “Last updated” date at the top will change when we do. Continued use of the app or CRM after changes means you should review the updated policy.

12. Contact

Questions about this policy: contact@gdpelectrical.uk
General contact: contact@gdpelectrical.uk / +44 7778 999610