Privacy Policy

1. Information We Collect

We collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device.

• Personal Account Information: When you register or are assigned an account, we collect the necessary personal details to create your profile, such as your name and login credentials.
• Access Rights: We store information about your assigned role to manage your access to specific features within the application.
• Session Data: We use cookies to keep you logged in and secure your session while you use the application.
• Uploaded Content: We process data files (such as Excel spreadsheets) that you upload. This data is used solely to provide the services offered by PatchPlan.
• Guest Fault Reports: If you report a fault on a shared project page without an account, we collect the name and email address you provide, your report description, and any photos you attach. If an attached photo contains embedded GPS location data, we read and store those coordinates to help locate the reported fault; photos without embedded location data are stored without coordinates.
• Activity and Security Logs: To maintain the security and stability of our service, we automatically log certain actions you take. This includes events like logging in, updating data, or making account changes. These logs may include your IP address and browser information to help us identify and resolve issues.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Authentication: To verify your identity and allow you to log in to the system.
• Access Control: To determine which parts of the application you are authorized to view or edit.
• Service Functionality: To process the spreadsheets and data you provide as part of the application's core features.
• Fault Reporting: To identify who submitted a fault report, contact you if we need more information, and (where a photo includes embedded location data) show reviewers where the fault was photographed.
• System Administration: To manage user accounts and ensure the security of the platform.
• Security and Monitoring: To monitor for suspicious login attempts, prevent unauthorized access, and protect the overall security of your account and our platform.
• Troubleshooting and Improvement: To diagnose and fix technical errors, and to analyze usage patterns to improve our application's functionality and user experience.

3. Legal Basis for Processing (UK GDPR)

We rely on the following legal bases, depending on the activity:

• Performance of a contract: account data and uploaded project data, to provide the service you've signed up for.
• Legitimate interests: guest fault-report data (name, email, photos, and any embedded photo location data), which we need to act on the specific report you chose to submit, and security/activity logs, which we need to keep the platform safe from abuse. We do not use this data for marketing or profiling.
• Legal obligation: where we are required to retain or disclose information by law.

4. Cookies

PatchPlan only uses cookies that are strictly necessary for the site to function, so we do not show a cookie consent banner. Specifically, we use:

• Session Cookies: These are essential for the website to function properly. They allow you to navigate the site and use its features, such as accessing secure areas.
• Guest Identity Cookie (pp_guest_token): Set on a shared project page after you provide your name and email to report a fault. It's an HttpOnly cookie used only to recognize you on a return visit and to apply rate limits to report submissions — not for tracking or analytics. You can clear it at any time from the shared page.

You can choose to disable cookies through your individual browser options, but this will prevent you from logging into the application or submitting fault reports.

5. Data Retention

We retain your personal information and uploaded data only for as long as is necessary for the purposes set out in this Privacy Policy, or as required by law. Guest fault-report data (including photos and any embedded location data) is retained for as long as the associated project remains active, or until you request its deletion under Section 6 below.

6. GDPR Data Protection Rights

We would like to make sure you are fully aware of all of your data protection rights. Every user is entitled to the following:

• The right to access: You have the right to request copies of your personal data.
• The right to rectification: You have the right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete.
• The right to erasure: You have the right to request that we erase your personal data, under certain conditions.
• The right to restrict processing: You have the right to request that we restrict the processing of your personal data, under certain conditions.
• The right to object to processing: You have the right to object to our processing of your personal data, under certain conditions.
• The right to data portability: You have the right to request that we transfer the data that we have collected to another organization, or directly to you, under certain conditions.

7. Contact Us

If you have any questions about this Privacy Policy, the data we hold on you, or you would like to exercise one of your data protection rights, please contact the system administrator.