Privacy notice

1. Who is responsible

Trade My Excess Limited generally acts as controller for account administration, service security, and direct communications. For project records entered by a customer organization, that organization may be the controller and Trade My Excess Limited may process information on its instructions.

2. Information we handle

• Names, work email addresses, profile details, organization roles, and access scopes.
• Project, site, supplier, carrier, material, transfer, waste, and compliance records.
• Photographs, uploaded documents, signatures, approvals, comments, and audit events.
• Device, session, security, and service-performance information.
• Prompts, source references, generated output, model versions, and review history for AI-assisted features.

3. Why we use information

• Provide and administer SiteHub under a contract with your organization.
• Authenticate users, enforce permissions, and protect accounts.
• Process material workflows, evidence, reports, and requested integrations.
• Maintain audit records, investigate errors, prevent misuse, and improve service performance.
• Meet legal obligations and respond to lawful requests.

4. Sharing and service providers

Information may be shared with authorized users in your organization and providers needed to operate authentication, hosting, storage, email, AI-assisted processing, and approved marketplace integrations. Information is limited to what is needed for the relevant service.

5. AI-assisted processing

When you use an AI-assisted feature, relevant prompts, images, documents, or structured data may be sent to OpenAI for processing. Do not submit unrelated personal, confidential, or safety-critical information. Generated output remains subject to user review.

6. Retention

Information is retained according to the customer's agreement, operational requirements, legal duties, dispute needs, and configured record-retention rules. Different record types may have different retention periods.

7. International processing

Some providers may process information outside the United Kingdom. Appropriate contractual and legal safeguards should be used where required.

8. Your rights

Depending on applicable law, you may have rights to access, correct, erase, restrict, object to, or receive certain personal information. Requests about project data should normally be directed first to the organization that provided your SiteHub account.

9. Security and concerns

SiteHub uses access controls and audit records designed to protect information. No service can guarantee absolute security. Report suspected unauthorized access through your organization administrator or the TradeMyExcess support channel provided under your agreement.