Legal
Privacy policy
What we collect, why we collect it, who we share it with, how long we keep it and what you can ask us to do about it.
About this policy
Last updated: 30 Sept 2026
We need a fair amount of personal information to apply for a CSCS card or book a CITB test on your behalf — including your National Insurance number and a copy of your ID. This policy explains what we do with it, in plain English.
Who is responsible for your information
The data controller is UKCS CONSULTING SERVICES LIMITED (trading as UK Construction Support), a company registered in [[COUNTRY OF REGISTRATION: England & Wales / Scotland / Northern Ireland]] with company number 16360747, registered address 5 Brayford Square, London, United Kingdom, E1 0SG.
We are registered with the Information Commissioner's Office under registration number 16360747.
How to contact us about your information
Email privacy@ukconstructionsupport.com, or use the phone, WhatsApp or postal details on our contact page. Put “privacy” in the subject line and we will get it to the right person.
[[DATA PROTECTION OFFICER: name and contact details if one has been appointed, or delete this line — most small businesses do not need a DPO.]]
What we collect, why, and our lawful basis
Under UK GDPR we have to have a lawful basis for everything we do with your information. Here is the whole list. “Contract” means we need it to do the job you paid us for; “legitimate interests” means it is reasonably necessary to run the service and does not override your rights; “consent” means you chose to say yes and can change your mind.
| What we collect | What we use it for | Lawful basis |
|---|---|---|
| Name, email address, phone number | Identifying you, sending confirmations and updates, answering your questions | Contract; legitimate interests (answering enquiries) |
| Date of birth | Card and test applications require it, and it confirms you are old enough to order | Contract |
| Postal address and postcode | Applications, invoices, and finding your nearest test centre | Contract |
| National Insurance number | Card scheme and test bookings require it to identify you. Stored encrypted; we keep the last four characters separately so staff can match your record without the whole number being shown | Contract |
| Photo ID, certificates and other documents you upload | Checking you meet the requirements, and evidencing your application to the scheme | Contract |
| Your answers to the questions on each service (trade, job role, qualifications, preferred dates and locations) | Choosing the right card, test version or course and booking it | Contract |
| Order, payment and invoice records | Taking payment, issuing invoices, refunds, and our accounts | Contract; legal obligation (tax and accounting) |
| Account email and password, and whether your email is verified | Letting you sign in, see your applications and upload documents securely | Contract |
| Notes, tasks and a record of our calls, emails and WhatsApp messages with you | Handling your case properly, so whoever picks up your file knows where it got to | Contract; legitimate interests (running the service) |
| Recordings of phone calls, where recording is switched on | Training, quality and checking what was agreed | Legitimate interests (quality and resolving disputes) |
| Marketing consent, if you tick the box | Recording that you are happy to hear from us. The box is never ticked for you | Consent |
| IP address, the page you arrived from and any campaign tags in the link you clicked | Security, spotting abuse of our forms, and knowing which of our pages people actually find useful | Legitimate interests (security and improving the site) |
| What you searched for in the card finder and the test-centre finder | Improving the finders — the searches are stored without your name unless you also ask us to send you the result | Legitimate interests (improving the service) |
| Fraud or misuse records | Preventing and reporting fraudulent applications | Legitimate interests; legal obligation |
Extra care with your National Insurance number and your ID
These are the two most sensitive things we hold, so they get extra protection. Your National Insurance number is encrypted before it is stored, and it is never shown in full in emails or WhatsApp messages. Uploaded documents are kept outside the public part of the website and can only be opened by signed-in staff, or by you in your own account.
We only ask for a document when an application actually needs it. If you send us something we do not need, tell us and we will delete it.
What we do not collect
We do not ask for information about your health, your ethnicity, your religion, your politics or anything else UK GDPR treats as a special category, and we do not want it. Please do not send us documents that reveal it. We do not make any decision about you by automated means alone — a person checks every application.
How long we keep things
The periods below are the ones the service is built around. [[RETENTION PERIODS: confirm these with your accountant and, where you are unsure, a solicitor — then delete this note.]]
| What | How long | Why |
|---|---|---|
| Uploaded ID and certificates | While your application is live, then [[DOCUMENT RETENTION, e.g. 12 months]] after it finishes | So we can answer queries from the scheme, and reapply without asking you for everything again |
| Application and case records | [[CASE RECORD RETENTION, e.g. 6 years]] from the end of the application | Answering later queries and defending claims |
| Orders, invoices and payment records | 6 years after the end of the financial year they fall in | Required for tax and accounting |
| Call recordings | 90 days, then deleted automatically. The period is set in our admin settings and can be shortened | Training, quality and resolving disputes — no longer than needed |
| Emails and WhatsApp messages with you | With the case record they belong to | Keeping a complete history of what was agreed |
| Your online account | Until you ask us to close it | So you can come back to your records and reorder |
| Marketing consent record | While you are happy to hear from us, plus a record of when you withdrew | Proving we had your consent, and respecting it when you withdraw |
| Card finder and test-centre searches | [[FINDER SEARCH RETENTION, e.g. 24 months]] | Improving the finders. These are not linked to you unless you asked us to send the result |
When you ask us to erase your information, we delete what we can and keep only the minimum the law requires — for example the figures on an invoice, with your personal details removed.
Your rights, and how to complain
Under UK GDPR you can ask us to:
Give you a copy of the information we hold about you (a subject access request)
Correct anything that is wrong or out of date
Delete your information, where we do not have to keep it
Stop using it for a while, if you think it is wrong or we should not be using it
Stop using it altogether, where we rely on legitimate interests
Send it to you, or to someone else, in a machine-readable file
Take back a consent you gave us, at any time
Email privacy@ukconstructionsupport.com or contact us any other way listed on our contact page. We will reply within one month. It is free, and we may ask you to confirm who you are first so we do not hand your information to someone else.
Some rights have limits. We cannot delete an invoice we are required to keep, and we cannot withdraw an application from the scheme after it has been submitted — you would need to ask the scheme directly.
Complaining to the ICO
Please come to us first — it is usually quicker. If you are not satisfied, you can complain to the Information Commissioner's Office, the UK's data protection regulator:
Helpline: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Changes to this policy
If we change how we use your information, we will update this page and change the date at the top. Where the change matters to you, we will tell you.