CompletionIQ
This policy explains what personal information CompletionIQ collects, how we use and share it, and the choices you have. It covers completioniq.com and the CompletionIQ application, including the field app.
1. Who we are
CompletionIQ is a completions and handover management platform for capital projects. It is operated by IOT Edge Ltd ("CompletionIQ", "we", "us"). We are the data controller for the information described in this policy, except where we act as a processor on behalf of a customer (see section 2).
You can contact us about anything in this policy at hello@completioniq.com.
2. What this policy covers
This policy applies to:
- The website at completioniq.com, including the contact form.
- The application: the CompletionIQ workspaces provided to each customer at their own address (for example
yourcompany.completioniq.com), and the CompletionIQ field app that can be installed on a tablet or phone from that address.
We act in two different roles:
- As a controller for website visitors, contact-form enquiries, and the account and sign-in information of people who use the application (user records, credentials, sessions, devices and security logs). We decide how this information is processed in order to run the service.
- As a processor for project content ("Customer Data"): the areas, systems, tags, checksheets, punch items, photographs, certificates and reports recorded in a customer's workspace. The customer, usually the project owner or main contractor that licensed CompletionIQ, is the controller of that content and we process it on its instructions under our agreement with it.
If you use CompletionIQ through your employer or a project you work on, that organisation's own privacy notice also applies to you. Questions about how it uses your information should go to it first, and we will help it respond.
3. Information we collect
3.1 Information you give us
- Contact form. Your name, email address and message. The website emails these to us; it does not store them in a database.
- Account information. Your name, email address, role, contractor company and project assignments. These are usually entered by your organisation's administrator when they create your account or invite you. If you sign in with a password, we store it only as a salted hash.
- Security settings. Two-factor authentication secrets and recovery codes (stored encrypted), your signature PIN (stored as a hash), your notification preferences, the names of devices you have signed in from, and your active browser sessions.
- Work you record. Checksheet answers and readings, punch items and comments, constraints, test results, milestone certificates, override reasons, uploaded documents, and photographs you take with your device, together with your electronic signature on the records you sign. This forms part of Customer Data.
- Correspondence. Anything you send us when you ask for support or otherwise get in touch.
3.2 Information collected automatically
- Log and device data. IP address, browser type and version, operating system, the date and time of requests and the pages or endpoints requested. This is recorded in our hosting provider's logs and used for security and reliability.
- Audit trail. The application records who created, changed, signed, reviewed or approved a record and when. Sign-in events may record your IP address and browser so that you and your administrator can spot unauthorised access.
- Cookies. See section 6.
3.3 Information from sign-in providers
If you or your organisation choose to sign in with Google or Microsoft, the provider shares your basic profile with us: your name, email address, the provider's unique identifier for your account and, where available, your profile picture. Section 5 explains exactly how this is used.
3.4 Information stored on your device
The field app is designed to work without a connection. When you download a project or work pack for a shift, the app keeps a copy of the data you selected, together with the changes you make while offline, including photographs taken with the device camera, in your browser's local storage on that device. This data stays on the device until it has been synchronised and you sign out or clear the app's site data.
- Camera and photographs. The camera is used only when you choose to take a photograph for a record, and photographs are resized on the device before they are stored or uploaded.
- Location. We do not collect your precise location.
- Push notifications. If you turn notifications on, your browser or operating system issues a push subscription that we store so that we can deliver notifications to that device. You can turn notifications off in the app's settings or in your browser at any time, which removes the subscription.
4. How we use information
We use personal information for the purposes below. Where the UK GDPR or EU GDPR applies, the lawful basis we rely on is shown alongside each purpose.
| Purpose | Information used | Lawful basis |
|---|---|---|
| Responding to enquiries sent through the website | Contact-form details | Our legitimate interest in responding to you, and steps taken at your request before entering into a contract |
| Providing the application: signing you in, showing you the projects and records you are assigned to, synchronising the field app, and generating certificates and reports | Account information, security settings, the work you record | Performance of our contract with the customer; our legitimate interest in operating the service. For Customer Data we act on the customer's instructions |
| Keeping the service secure: detecting unauthorised access, enforcing two-factor authentication, and managing sessions and devices | Log and device data, audit trail, sign-in events | Our legitimate interest in protecting the service and its users; legal obligations to keep personal data secure |
| Sending service notifications, such as assignments, review requests, punch updates and weekly status reports | Account information, notification preferences, push subscriptions | Performance of the contract; your consent, for push notifications you have turned on |
| Maintaining the audit trail of signed records that the completions process requires | Audit trail, electronic signatures | Performance of the contract; our legitimate interest and the customer's in keeping records that can be relied on; legal obligations where records must be retained |
| Supporting, maintaining and improving the service | Log data, support correspondence | Our legitimate interest in running a reliable service |
| Complying with the law and enforcing our terms | Any of the above, as required | Legal obligation; our legitimate interests |
We do not use your information for advertising, we do not sell it, and we do not make automated decisions about you that have legal or similarly significant effects.
5. Signing in with Google or Microsoft
Where your organisation has enabled it, you can sign in to CompletionIQ with a Google or Microsoft account instead of a password. This is optional: signing in with an email address and password is always available.
When you sign in with Google, Google asks for your permission to share your basic profile with us: your name, email address, Google account identifier and profile picture. We use this information only to:
- match you to the CompletionIQ account your organisation has already created for you (signing in with Google never creates a new account or grants access your organisation has not given you); and
- sign you in and show your name and picture in the application.
We do not request access to your Gmail, Google Drive, Calendar, Contacts or any other Google data. We do not store the access tokens Google issues; the only link kept between your CompletionIQ account and your Google account is the account identifier. You can disconnect Google from your profile page in the application at any time, and you can revoke CompletionIQ's access from your Google Account permissions page.
CompletionIQ's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Signing in with Microsoft works the same way: we receive your name, email address, account identifier and, where available, profile picture, and nothing else. You can disconnect Microsoft from your profile page, and revoke access through your Microsoft account settings or your organisation's administrator.
8. International transfers
The application and its data are hosted in the United Kingdom. Some processing may take place outside the UK or the European Economic Area, for example when static assets are cached by a content delivery network edge near you, when you choose to sign in through a provider based elsewhere, or when a support tool we use is hosted abroad. Where that happens we rely on an adequacy decision, the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses, as applicable, so that your information receives equivalent protection.
9. How long we keep information
- Contact-form enquiries are kept in our mailbox for as long as needed to deal with your enquiry and any follow-up, and then deleted.
- Account information is kept for the life of your account. When your account is deactivated, we keep only what is needed to preserve the integrity of the audit trail: your name stays on the records you signed, because a completions record must show who signed it.
- Customer Data is kept for the duration of the customer's agreement with us and handled afterwards as that agreement provides. Typically the customer has 30 days to export its data after the agreement ends, after which it is deleted from live systems, with backups following within a further period.
- Log data is kept for short periods, typically 30 days, unless it is needed to investigate a security incident.
- Data on your device stays on the device until it has been synchronised and you sign out or clear the app's site data.
10. Security
We take appropriate technical and organisational measures to protect personal information. Data is encrypted in transit using TLS, and uploaded files are encrypted at rest. Passwords and signature PINs are stored only as hashes, and two-factor authentication is available to every user and can be required by role. Access to a project is limited by role and by contractor company, every change to a record is logged, and access to production systems is limited to the people who need it to run the service. No system can be guaranteed to be completely secure, so please keep your credentials and devices safe and tell us straight away if you suspect a problem.
11. Your rights
Depending on where you live, you may have the right to:
- access the personal information we hold about you;
- have inaccurate information corrected;
- have your information erased, where there is no good reason for us to keep it;
- restrict or object to how we process it;
- receive a copy of the information you gave us in a portable format;
- withdraw consent where we rely on it, for example for push notifications; and
- complain to a supervisory authority. In the United Kingdom this is the Information Commissioner's Office; in the European Economic Area it is the authority in the country where you live or work.
To exercise any of these rights, email hello@completioniq.com. We may need to verify your identity before acting on a request. Where the information forms part of Customer Data, we will pass your request to the customer that controls it, or direct you to it, and help it respond. Many changes, such as updating your name or notification preferences, can be made directly from your profile page in the application.
12. Children
CompletionIQ is a professional tool for people working on construction and commissioning projects. It is not directed at anyone under 18 and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.
13. Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last changed. If a change materially affects how we use your information, we will notify customers through the application or by email before it takes effect.
14. Contact
Questions, requests and complaints about privacy can be sent to IOT Edge Ltd, trading as CompletionIQ, at hello@completioniq.com.