How we use your data.

At Golden Thread Engine (GTE), we take our responsibilities for how we store, secure and use your personal data seriously and always seek to respect your privacy while also meeting our legal obligations. These obligations include the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA), and other regulations/legislation relating to privacy and communications. Read our full privacy statement, including your individual rights. This explains more about how we use your personal information, your rights and how to exercise them.

Why we process your data

We process personal data where it is necessary to provide, operate, maintain and secure GTE's website, applications and services.

Depending on how you interact with GTE, we may process your information to:

• Create and manage your GTE account;
• Authenticate users and maintain the security of our systems;
• Provide access to GTE products, services, plugins and platform functionality;
• Provide customer support and respond to enquiries;
• Manage our relationship with customers and authorised users;
• Process information submitted through GTE as part of projects, assessments, inspections and other workflows;
• Maintain appropriate system, activity and audit records;
• Detect, investigate and prevent fraud, misuse, security incidents and unauthorised access;
• Monitor and improve the performance, reliability and usability of our services;
• Communicate important service, security or account information;
• Meet contractual, regulatory and legal obligations; and
• Establish, exercise or defend legal claims where necessary.

We will only process personal data where we have an appropriate lawful basis under applicable data protection legislation.

If you don't want to share your data

You are not required to provide personal information to GTE unless it is necessary to provide a particular service, fulfil a contract or comply with a legal requirement.

However, certain information is required for GTE to create and administer accounts, authenticate users, maintain security and provide platform functionality.

If you choose not to provide information that is necessary for these purposes, we may be unable to create or maintain your account, provide certain services or allow you to use particular GTE functionality.

Where information is optional, this will be made clear where reasonably practicable.

The data we may use about you

Depending on your relationship and interaction with GTE, we may collect and process information including:

• Your name;
• Business or organisation name;
• Job title or professional role;
• Business email address;
• Business telephone number;
• Account and user identification information;
• Login, authentication and security information;
• User permissions and access levels;
• IP address, device, browser and technical information;
• Records of your interactions with GTE's website and services;
• Customer service and support communications;
• System and audit activity associated with your account;
• Dates and timestamps associated with actions undertaken through the platform;
• Information, documents, photographs and records that you submit or upload to GTE; and
• Other personal information that you choose to provide when communicating with us or using our services.

GTE may also process information contained within building safety, fire safety, inspection, assessment, project and compliance records uploaded by customers or authorised users.

Where a GTE customer provides personal data relating to other individuals, the customer is responsible for ensuring that it has an appropriate lawful basis and authority to provide that information to GTE.

Who we share data with and why

GTE does not sell personal information.

We may share or provide access to personal data where necessary for the operation, security, hosting, maintenance and delivery of GTE's services.

This may include appropriately authorised:

• Cloud hosting, database and infrastructure providers;
• Software and technology service providers;
• Artificial intelligence and data-processing service providers where required to provide specific GTE functionality;
• Security, monitoring and technical support providers;
• Professional advisers, including legal, accounting and insurance advisers;
• Contractors and service providers acting on behalf of GTE;
• Customer organisations and their authorised administrators where information relates to their GTE environment; and
• Regulators, law enforcement agencies, courts or other authorities where disclosure is required or permitted by law.

Where third parties process personal information on our behalf, we seek to ensure appropriate contractual, organisational and technical safeguards are in place.

Further information about relevant third parties and international data transfers, where applicable, is provided within our Full Privacy Statement.

How long we keep your data

GTE retains personal information only for as long as reasonably necessary for the purposes for which it was collected, including providing our services and meeting applicable contractual, legal, regulatory, security and record-keeping requirements.

Different categories of information may therefore be retained for different periods.

When determining an appropriate retention period, we may consider:

• The nature and sensitivity of the information;
• The purpose for which it was collected;
• The duration of our relationship with the customer or user;
• Contractual requirements;
• Legal and regulatory requirements;
• Building and fire safety record-keeping requirements;
• Security and fraud-prevention requirements;
• The establishment, exercise or defence of legal claims; and
• Whether the information forms part of an audit or compliance record that is required to be preserved.

When personal information is no longer required, it will be securely deleted, anonymised or otherwise handled in accordance with our applicable retention procedures.

Individual rights

Data protection legislation provides data subjects with certain rights including the right to access; the right to rectification, the right to erasure; the right to restrict processing; the right to object and rights in relation to decision making. If you are not satisfied with a request, you have the right to make a complaint to the Information Commissioner’s Office.

Further information can be found in the Full Privacy Statement.

Cookies are small text files that are placed on your computer by websites that you visit. They are widely used to make websites work, or work more effectively, as well as to provide information to the owners of the site. The cookies we use do not access your computer to obtain personal information and they do not collect information that could identify you or your business.

The Golden Thread Engine (GTE) website and online services use cookies to:

• Make sure our website works properly;
• Collect data about the use of our website, including the number of visitors and how frequently viewed;
• To ensure the secure function of GTE online services;
• To remember your preferences and what the website/services easy to use.

Golden Thread Engine (GTE) is committed to maintaining the integrity, accuracy and security of information held and processed through its platform. GTE operates a zero-tolerance approach to fraud, dishonesty, deliberate misrepresentation, falsification of records and the misuse of its systems.

Users of GTE are responsible for ensuring that all information, documentation, photographs, inspection records, assessments, certificates and other evidence submitted to the platform are, to the best of their knowledge, accurate, genuine and not deliberately misleading.

Fraudulent activity may include, but is not limited to:

• Knowingly submitting false or misleading information.
• Falsifying, altering or fabricating fire safety, inspection, installation or compliance records.
• Uploading fraudulent or altered certificates, reports, photographs or supporting evidence.
• Misrepresenting the identity, qualifications, competence or authority of an individual or organisation.
• Recording work as completed where the work has not been completed.
• Deliberately providing inaccurate dates, locations, materials, products or installation information.
• Attempting to manipulate, circumvent or interfere with GTE's audit trail, security controls or record-keeping mechanisms.
• Using another person's account or credentials without authorisation.
• Deliberately attempting to conceal, delete or misrepresent information relevant to building or fire safety.
• Using GTE to facilitate fraudulent, unlawful or deceptive activity.

GTE is designed to support transparency, accountability and traceability throughout the lifecycle of building and fire-safety information. Where available, system records, timestamps, user activity, document history and other audit information may be retained to provide evidence of how and when information has been created, submitted, reviewed or amended.

Where GTE identifies or reasonably suspects fraudulent activity, misuse or deliberate falsification of information, appropriate action may be taken. This may include restricting or suspending access, preserving relevant records and audit evidence, notifying the relevant customer or authorised administrator, conducting or supporting an investigation, and reporting the matter to appropriate authorities where required or permitted by law.

GTE does not guarantee that information submitted by users is accurate or genuine solely because it has been recorded within the platform. Responsibility for the accuracy, authenticity and professional validity of information remains with the individual or organisation responsible for creating, submitting, approving or certifying that information, subject to the applicable contractual arrangements and legal requirements.

All employees, contractors, partners and authorised users of GTE are expected to act honestly and responsibly and to report suspected fraudulent activity through the appropriate reporting or escalation process.

GTE will continually review its technical, procedural and organisational controls to reduce opportunities for fraud and protect the integrity of the information entrusted to the platform.