Privacy Policy
Effective: 2026-06-02 · Version 1.0
This privacy policy explains how Workwiz Limited ("we", "us", "Coreproma") processes personal data when you use the Coreproma Jobs Tracker service.
If you have any questions about this policy, contact us at privacy@coreproma.com or by post: Workwiz Limited, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.
1. Who we are
- Data controller: Workwiz Limited, a company registered in England & Wales (Companies House number 04999377).
- Brand: Coreproma is a trading brand of Workwiz Limited. Jobs Tracker is one of its products.
- Data Protection contact: privacy@coreproma.com
2. What data we collect
2.1 Account & sign-up data
- Your full name, work email, mobile number.
- Your company's name, registered address and Companies House number (if you choose to use the CH lookup feature).
- A salted hashed password (we never store the password itself).
2.2 Operational data you put into the platform
- Customer/site records, job records, timesheets, photos, RAMS submissions, vehicle data, materials, variations and any other data you enter.
- GPS coordinates captured by the worker app when a worker taps in/out (used to compute travel time and to plot the live fleet map).
- Photographs uploaded by workers, stored on Azure Blob Storage with unguessable URLs.
2.3 Billing data
- Stripe processes payments on our behalf. We never see or store your full card number — Stripe gives us only a customer reference and the last four digits of the card.
- Subscription state (active / past-due / cancelled), invoice amounts, billing email.
2.4 Analytics & service data
- Pages visited, broad geographic region, browser/device type. Collected via Google Analytics 4 with IP anonymisation enabled.
- API access logs (IP address, timestamp, request path) kept for 30 days for security and abuse detection.
- Audit log of mutating actions inside your tenant (who-created / updated / deleted what, when, with old/new values).
2.5 What we do not collect
- We don't sell or share your data with advertisers.
- We don't use your operational data to train AI models without explicit per-tenant opt-in.
- We don't ship analytics events for the worker app outside the EU/UK.
3. Why we process it (lawful bases)
| Purpose | Lawful basis |
|---|
| Provide the service you signed up for | Contract |
| Charge subscriptions through Stripe | Contract |
| Send service-related emails (verification, password reset, welcome pack, trial-ending) | Contract |
| Identify abuse, prevent fraud, secure the service | Legitimate interests |
| Improve the product via aggregate analytics | Legitimate interests |
| Comply with our legal obligations (e.g. tax record-keeping) | Legal obligation |
| Marketing emails outside the service flow | Consent (opt-in only) |
You can object to processing based on legitimate interests at any time — see §7.
4. Where your data is stored
- Primary database: Microsoft Azure SQL Database hosted in the UK South region.
- Object storage (photos, attachments, PDFs): Azure Blob Storage, UK South.
- Payment processing: Stripe (Stripe Payments UK, Ltd.). Card data is processed in the EU / United States subject to Stripe's standard contractual clauses.
- Email delivery: Migadu (EU-based mailbox provider) and/or SendGrid (US-based, with Standard Contractual Clauses).
- Analytics: Google Analytics 4. IPs are anonymised; the property is set to retain user-level data for 14 months maximum.
- Companies House lookups: data fetched from Companies House (UK government open data) and cached for 1 hour in-memory on the API server.
5. How long we keep it
| Data | Retention |
|---|
| Active account data | Until you delete your account, then 30 days |
| Audit log of mutating actions | 7 years (UK construction-sector compliance) |
| Billing records | 7 years (UK tax law) |
| Email verification & password-reset tokens | 24 hours from issue |
| API access logs | 30 days |
| Analytics user-level data (GA4) | 14 months |
| Photos / attachments uploaded by workers | Lifetime of the tenant + 30 days |
You can request earlier deletion under §7.
6. Who we share data with (sub-processors)
We use the following sub-processors. Each is contractually bound to handle your data with at least the protections required under UK GDPR.
| Sub-processor | Service | Region |
|---|
| Microsoft Azure | Hosting, SQL, Blob storage | UK South |
| Stripe Payments UK Ltd | Subscription billing | UK / EU / US |
| Migadu | Outbound SMTP | EU |
| Google LLC | Google Analytics 4, Google OAuth sign-in (admins only) | EU / US |
| Anthropic PBC | LLM API for the AI RAMS drafter feature (opt-in per tenant) | US |
We don't share your operational data with anyone outside this list without your explicit consent.
7. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate data.
- Erase your data (subject to the legal-obligation retention noted above).
- Restrict or object to processing.
- Port your data to another provider (we provide a JSON+CSV export on request).
- Withdraw consent (where consent is the lawful basis) at any time.
- Complain to the UK Information Commissioner's Office (https://ico.org.uk).
Email privacy@coreproma.com to exercise any of these rights. We respond within 30 days.
8. Cookies & similar technologies
- Strictly necessary: session cookie (auth token), CSRF protection. Cannot be disabled — the service won't work without them.
- Analytics: Google Analytics 4 cookies. Disabled by default; you can opt out via the cookie banner.
- Preferences: dismissed-announcement state, theme choice. Stored in
localStorage, not transmitted.
9. Children
Jobs Tracker is a business-to-business platform for adult employees of trades firms. We don't knowingly collect data from anyone under 16. If you believe we have, contact us and we'll delete it.
10. Changes to this policy
We'll post material changes to this URL and prompt existing users to re-confirm. Minor edits (typo fixes, clarifications) won't trigger a prompt. The version & effective date at the top of the page is the canonical reference.
Workwiz Limited · Companies House 04999377 · privacy@coreproma.com