Privacy Notice

Version 1.1, effective 7 October 2026. Download a copy
## Part 2: Privacy Notice

This Privacy Notice has the same version number and effective date as the Terms of Service above.

### 1. Who we are

SJ Developments North West Ltd, trading as SJAI (company number 16371408, 1 Fields End, Liverpool, Merseyside, L36 5YQ). Privacy contact: privacy@sjai.uk. ICO registration number: ZC045057.

The SJAI Job Hub app on Google Play opens this same hosted service in app form. It collects no extra data beyond what is described in this notice. It may ask for notification permission, to send you job alerts you switched on. If you take a photo inside the app, that uses your device's camera through your browser's own permission prompt, not a separate app permission.

### 2. Two different roles

(a) Controller: for information about builders who hold accounts, people who contact us, people who join our waitlist, and visitors to our website, we decide how it is used. This notice covers that information.

(b) Processor: for information a builder puts into Job Hub about its own customers, workers and supervisors, the builder is the controller and we process it only on the builder's instructions (see Part 3). If you are a builder's customer or worker, the builder's own privacy information applies, and you should contact the builder first. We will help the builder respond to you. If you cannot reach the builder, contact us and we will pass your request on.

### 3. What we collect and why

| Who | Information | Why | Lawful basis (UK GDPR) |
|---|---|---|---|
| Builder account owners | Name, business name, email, phone, password (stored only as a one-way hash), two-factor settings (the authenticator secret is stored encrypted), backup codes (stored only as hashes), account settings | Run the account and keep it secure | Contract |
| Builder account owners | Plan, billing and payment records (once paid plans are available) | Take payment, keep accounts | Contract; legal obligation (tax records) |
| Builder account owners | Records of full-data exports, account closure and deletion | Keep the account secure and prove deletion happened | Legitimate interests (security and accountability); legal obligation |
| All users of Job Hub | Security information: IP address, time, device/browser type, failed sign-in and code attempts, lockouts | Stop break-ins and misuse, investigate incidents | Legitimate interests (security) |
| All users of Job Hub | Push notification subscription (a browser address, not a phone number), if switched on | Send job notifications you switched on | Legitimate interests; consent is asked by your browser before any notification |
| Waitlist and enquiries | Name, business, trade, email, what you tell us | Reply and let you know when Job Hub opens | Consent (waitlist); legitimate interests (enquiries) |
| Support and complaints | Messages you send us and our replies | Help you and handle complaints | Contract; legitimate interests; legal obligation (complaints) |
| Website visitors | IP address and technical request data handled by our website's network provider | Deliver the website securely and protect it from attack | Legitimate interests (security) |

We do not use advertising or tracking technology on our website or inside the Job Hub app.

We do not make decisions about you based solely on automated processing.

### 4. Photos and location

Job Hub keeps original photos as uploaded. Photos from phones can contain metadata, including where and when they were taken. Customers see a stamped display copy, not the original. Job Hub does not ask the browser for your live location.

### 5. Cookies and storage on your device

Job Hub uses only the storage it needs to work:

| What | Purpose | How long |
|---|---|---|
| Sign-in session cookie | Keeps you signed in and protects forms from forgery | Up to 30 days |
| Trusted-device cookie (owners only, if you tick "remember this device") | Skips the two-step code on that device | 30 days |
| Photo upload queue (browser storage on your phone) | Keeps photos taken on poor signal until they have uploaded | Until the upload is confirmed |
| Installed-app files (if you add Job Hub to your home screen) | Opens the right screen for your role | Until you remove the app |

These are strictly necessary for the service you have asked for, so the law does not require consent for them. We do not use analytics, advertising or social media cookies. If we ever add analytics, we will update this notice first and will only use analytics that the law allows without consent where we give you a simple way to object, or we will ask for your consent.

### 6. Who we share it with

We use these service providers:

| Provider | What for | Where the data is |
|---|---|---|
| Railway Corporation | Hosting the Job Hub app and its stored data | EU West (Amsterdam, Netherlands). Railway is a US company; see section 7 |
| SJAI (our own computer in the UK) | Encrypted backup copies of the service | United Kingdom |
| Browser push services (for example Google, Apple, Mozilla) | Delivering notifications you switched on | Various. Notification content is encrypted end to end and the push service cannot read it |
| Zoho | Our business email (support@, privacy@ and hello@sjai.uk), including messages you send us | European Union (Zoho's EU data centre) |
| Cloudflare | Delivering and protecting our website and managing our domain's email settings (not the Job Hub app) | Global network |

A full, current list of the providers that handle builder data is in Annex C to Part 3. Before paid plans start, we will add our payment provider to this notice.

We do not sell personal information. We may share information if the law requires it, to protect people or the Service, or with professional advisers under a duty of confidence. If the business is sold, information may pass to the buyer, who must use it in line with this notice.

### 7. International transfers

Job Hub data is stored in the European Economic Area (the Netherlands), which the UK recognises as providing adequate protection. Railway states that its primary processing operations take place in the United States, so its staff and some of its own providers may access data from the US. Railway is certified under the UK Extension to the EU-U.S. Data Privacy Framework, and its data processing addendum also includes the UK International Data Transfer Addendum as a fallback.

### 8. How long we keep it

| Information | Kept for |
|---|---|
| Builder Data (job records, photos, messages etc.) | While the account is open. Deleted from the live Service within 30 days and from backups within 90 days after the account closes (Terms clause 9) |
| Owner account details | As Builder Data, except the minimum needed to show that the account existed and was closed |
| Closure and deletion record (account id, event and date only) | 6 years, to show deletions were done and re-apply them after any restore |
| Billing and tax records | 6 years after the end of the financial year they relate to |
| Security logs | Up to 30 days, and never longer than our hosting provider's log retention; longer only when needed for a specific investigation |
| Export records | 12 months |
| Waitlist | Until you ask to be removed, or 12 months after Job Hub opens to the public if you have not signed up |
| Enquiries, support messages and complaints | 2 years after the last message, or longer if needed for a legal claim |

### 9. Your rights

You can ask to see a copy of your information, correct it, delete it, restrict or object to how we use it, move it to another provider, or withdraw consent where we rely on consent. Email the privacy address. We will respond within one month. If a request is complex or you send several, we may extend this by up to two further months and will tell you why within the first month. If we need more information to find your data or confirm who you are, the time limit starts once we have it. We will make reasonable and proportionate searches. Requests are free unless they are manifestly unfounded or excessive.

To close your account, or to ask us to delete your data, email privacy@sjai.uk. Builders' customers and workers: see section 2(b) above — contact your builder first, or contact us if you cannot reach them and we will pass your request on.

If your information is Builder Data (you are a builder's customer or worker), we will pass your request to the builder and help them answer it.

### 10. Complaints

If you are unhappy with how we have handled your information, you can complain to us by email to the privacy address, or by post to our registered office. We will:
(a) acknowledge your complaint within 30 days of receiving it (in practice we aim for 5 working days);
(b) look into it properly and keep you updated on progress; and
(c) tell you the outcome without undue delay.

You can also complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113. The ICO usually expects you to have complained to us first.

### 11. Security

We protect information with encryption in transit, one-way password hashing, optional two-factor sign-in for owners, separation between builders' data, restricted file permissions, rate limiting and lockout on sign-in, and encrypted backups. Annex B to Part 3 has more detail. No system is perfectly secure, and we will tell affected people and the ICO about a serious breach where the law requires.

### 12. Wording builders can give their own customers and workers

Short version (for a quote, invoice footer or first message):

"We use SJAI Job Hub to manage your job. Your name, contact details, the site address, photos, documents, messages and payment records for your job are stored in it. SJAI hosts it for us in the EU and only uses your information to run the service for us. Contact us if you have any questions about your information or want to use your data protection rights."

Longer version for workers:

"We use SJAI Job Hub to share job details, photos and messages with the site team. Your name, the jobs you are assigned to, the photos you upload and your messages in the site-team thread are stored in it and can be seen by us and, for photos, by the customer for that job. We keep them for as long as we need them for the job and our records. SJAI hosts the service for us and only uses your information to run it."