Privacy notice
Last updated: 14 September 2026
Who is responsible for the information
Tap Tap Construction provides digital construction logistics, document, audit, workforce, attendance, inspection, signature and site-booking services. Depending on the customer arrangement, the construction-site customer may act as controller for its workforce and supplier information and Tap Tap may process that information on its instructions. Tap Tap remains responsible for the information it controls directly. For privacy enquiries or data-rights requests, contact the Tap Tap Service Department.
Information we collect
Depending on the modules used, information may include names, business contact details, companies, vehicle registrations and dimensions, delivery details, holiday requests, worker attendance, qualifications, form answers, typed signatures, audit findings, photographs, PDF evidence, inspection results, booking details, equipment movements, timestamps and security/access records. We ask customers and users not to upload information that is not necessary for the relevant site process.
Why we use it
We use information to deliver requested construction-site services, administer site access and logistics, retain necessary safety and compliance evidence, manage bookings and approvals, notify authorised people, protect the platform from misuse, fulfil contracts and meet applicable legal obligations. Where another lawful basis is required, the relevant customer or Tap Tap must establish that basis before collecting the information.
Site email address books
Authorised administrators may save business email contacts needed for notices, approvals, reports and other site operations. Each address book is isolated to one customer site and is not used for marketing. Contacts can be corrected, deactivated or removed, are access controlled and audit logged, and should be reviewed when a person changes role or a project closes. The usual lawful basis is legitimate interests in safe and efficient site operations, subject to the customer's own controller responsibilities and balancing assessment.
Who receives it
Information is restricted to authorised Tap Tap administrators, authorised users of the relevant customer site and service providers needed to operate the platform. Information is not sold. OpenAI hosts the ChatGPT Sites service on Tap Tap's behalf and may use subprocessors to provide hosting, storage, security and support. Email providers process only the information required to send configured notifications.
International processing
The hosting service may process information outside the United Kingdom. Where UK personal data is transferred internationally by the hosting provider, the applicable data-processing terms and transfer safeguards apply. Tap Tap does not represent that all hosted information is stored only in the United Kingdom.
Retention and backups
Records created before the current retention policy started are preserved. New delivery photographs and delivery signature PDFs held in the dedicated delivery-evidence store are scheduled for deletion after six months, unless a lawful hold or documented customer requirement applies. Other construction, audit, signature, safety, attendance and contractual records remain subject to a documented customer or legal review before deletion. Site email contacts receive an annual review date and should be deactivated when no longer needed. Private rolling backups are access-controlled and integrity checked.
Security and access
Customer-site access is role-based and site-scoped. Private delivery evidence and backup snapshots are stored in private object storage and are not given permanent public file URLs. Backup creation, verification and download are restricted to the Platform Owner and security logged. Authorised administrators receive temporary signed evidence links. Worker-record reads and updates are security logged. Holiday booking is restricted to authenticated users assigned to the relevant customer site. The booking page shows only that user's personal leave counters, while the team holiday calendar remains inside the authenticated customer portal. Approval authority remains restricted to named site approvers, and every decision uses a one-time secure email link that stays valid while the request is pending, or an authorised customer session. Public NFC or QR links are used only for resources deliberately configured for that public site-access purpose.
Your rights
Depending on the circumstances, you may have rights to access, correct, erase, restrict or object to processing, receive a copy of your information, or withdraw consent where consent is the lawful basis. Requests may be subject to identity verification and lawful record-retention requirements. You may also complain to the UK Information Commissioner's Office.
Changes
We review this notice as the platform, customer modules, service providers and legal requirements change. Material changes will be reflected in the date shown above.