MeasureDeck

Legal

Privacy Policy

Last updated: 1 June 2026 · UK GDPR Compliant

1. Who We Are

MeasureDeck Ltd (“MeasureDeck,” “we,” “us,” or “our”) is the data controller for personal data processed in connection with the MeasureDeck platform and website. We are registered with the Information Commissioner's Office (ICO) in the United Kingdom.

Our registered address is: MeasureDeck Ltd, 1 Commercial Street, London, EC1A 1AA. Our Data Protection Officer can be contacted at dpo@measuredeck.com.

This Privacy Policy explains what personal data we collect, why we collect it, how we use it, your rights in relation to it, and how you can exercise those rights. This policy applies to personal data collected through our website (measuredeck.com) and through the MeasureDeck platform.

2. Data We Collect

2.1 Information you provide directly

  • Account registration data: name, email address, company name, job title, telephone number;
  • Payment information: billing address, VAT number (payment card details are processed by Stripe and not stored by MeasureDeck);
  • Profile information: profile photograph, professional qualifications, preferences;
  • Communications: messages, support requests, feedback, and correspondence you send to us;
  • Commercial and project data: project details, contract information, cost data, variation records, application data, and documents you upload to the platform (note: this data may include personal data of third parties such as supplier contacts or project personnel).

2.2 Information collected automatically

  • Usage data: pages visited, features used, actions taken within the platform, session duration, and frequency of use;
  • Technical data: IP address, browser type and version, operating system, device type, time zone, and screen resolution;
  • Cookies and tracking technologies: as described in our Cookie Policy;
  • Log data: server logs including your IP address, access dates and times, and pages requested.

2.3 Information from third parties

  • Information from single sign-on (SSO) providers where you use SSO to access our Services;
  • Information from analytics providers to help us understand how our website and platform are used;
  • Information from payment processors (transaction status, not card details).

3. How We Use Your Data

We use your personal data for the following purposes:

  • Providing the Services: to create and manage your account, process your subscription, provide customer support, and deliver the commercial management tools you have subscribed to;
  • Account security: to verify your identity, detect and prevent fraud, and maintain the security of your account and the platform;
  • Communications: to send you service-related communications including account confirmations, billing notifications, security alerts, and product updates;
  • Marketing: with your consent, to send you information about MeasureDeck products, features, and events — you can withdraw consent at any time by unsubscribing;
  • Improving the Services: to analyse usage patterns, troubleshoot issues, and develop new features — we use aggregated, anonymised data for this purpose where possible;
  • Legal compliance: to comply with our legal and regulatory obligations, including data protection, tax, and anti-money laundering laws;
  • Legitimate interests: to protect our legal rights, manage our business, and carry out internal administrative activities.

4. Legal Basis for Processing

Under UK GDPR, we must have a lawful basis for processing your personal data. The lawful bases we rely on are:

  • Contract performance (Article 6(1)(b)): processing necessary to provide the Services under our contract with you, including account management, service delivery, and billing;
  • Legitimate interests (Article 6(1)(f)): processing necessary for our legitimate interests, including security, fraud prevention, improving our Services, and direct marketing to existing customers — we have conducted legitimate interest assessments (LIAs) and are satisfied our interests are not overridden by your rights;
  • Consent (Article 6(1)(a)): where we have asked for your explicit consent, including for marketing emails to prospects and for the use of non-essential cookies;
  • Legal obligation (Article 6(1)(c)): where processing is required by law, such as for tax or regulatory compliance.

5. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, subject to legal or regulatory requirements. Our retention periods are:

  • Account data: for the duration of your subscription plus 30 days following cancellation (after which it is deleted unless extended retention is agreed);
  • Billing and financial records: 7 years from the relevant transaction, in accordance with HMRC requirements;
  • Audit logs: 7 years from creation, to support dispute resolution and regulatory compliance;
  • Marketing contact data: until you withdraw consent or we determine the data is no longer current;
  • Support communications: 3 years from the date of the communication;
  • Website analytics: 26 months (anonymised aggregates retained indefinitely).

When data is no longer required, it is securely deleted or anonymised in accordance with our data deletion procedures.

6. Your Rights Under UK GDPR

Under UK GDPR, you have the following rights in relation to your personal data. To exercise any of these rights, please contact us at dpo@measuredeck.com or via our contact page. We will respond within one calendar month.

Article 15 — Right of Access

You have the right to obtain confirmation of whether we process personal data about you and, if so, to receive a copy of that data together with information about how it is processed (a “Subject Access Request” or SAR). The first copy is provided free of charge.

Article 16 — Right to Rectification

You have the right to have inaccurate personal data corrected and incomplete personal data completed. You can update most personal data directly within your account settings.

Article 17 — Right to Erasure (“Right to be Forgotten”)

You have the right to request that we delete your personal data in certain circumstances, including where the data is no longer necessary for the purpose for which it was collected, you withdraw consent, or the processing was unlawful. This right is subject to exceptions including where we need to retain data to comply with a legal obligation.

Article 18 — Right to Restriction of Processing

You have the right to request that we restrict the processing of your personal data in certain circumstances, such as while a dispute about accuracy is resolved, or where you have objected to processing pending our consideration of your objection.

Article 20 — Right to Data Portability

Where processing is based on consent or contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller. MeasureDeck supports data export in CSV and PDF formats.

Article 21 — Right to Object

You have the right to object to processing based on legitimate interests or for direct marketing purposes. Where you object to direct marketing, we will stop processing your data for that purpose. Where you object to other legitimate interest processing, we will cease unless we can demonstrate compelling legitimate grounds.

Article 22 — Rights Related to Automated Decision-Making

MeasureDeck does not make decisions about you that produce legal effects or significantly affect you solely by automated means. The AI Copilot provides suggestions and drafts that always require human review.

Right to Lodge a Complaint

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not handled your data correctly. The ICO can be contacted at ico.org.uk or by telephone on 0303 123 1113.

7. Cookies

We use cookies and similar tracking technologies on our website and platform. Our Cookie Policy provides full details of the types of cookies we use, their purposes, and how you can manage your preferences. In summary:

  • Essential cookies: required for the platform to function (no consent required);
  • Analytics cookies: help us understand how the platform is used (consent required);
  • Marketing cookies: used for targeted advertising (consent required).

8. Third Party Services and Sub-processors

We share personal data with trusted third-party service providers (“sub-processors”) to help us deliver the Services. All sub-processors are bound by contractual obligations to process data only on our instructions and to maintain appropriate security measures. Our current sub-processors are listed at measuredeck.com/subprocessors and include:

  • Supabase — database hosting (UK/EU);
  • Stripe — payment processing (UK/EU/USA);
  • OpenAI — AI processing for the Copilot feature (USA — subject to UK GDPR safeguards);
  • Resend — transactional email delivery (USA — subject to UK GDPR safeguards);
  • Cloudflare — CDN, DDoS protection, and document storage (EU/USA — subject to UK GDPR safeguards).

We will notify you of any changes to our sub-processor list that affect personal data processing before those changes take effect.

9. International Data Transfers

Your primary project data and account data is stored in the UK (AWS eu-west-2 via Supabase). Some of our sub-processors, including OpenAI and Resend, are based in the USA. Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place, including:

  • Standard Contractual Clauses (SCCs) adapted for UK international transfers (UK IDTA or equivalent);
  • Adequacy decisions where applicable;
  • Data minimisation — we transfer only the minimum data necessary for the sub-processor to perform its function.

10. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or destruction. These measures include AES-256 encryption at rest, TLS 1.3 in transit, role-based access controls, multi-factor authentication, regular penetration testing, and staff data protection training.

In the event of a personal data breach, we will notify the ICO within 72 hours where required by law and will notify affected individuals where the breach is likely to result in a high risk to their rights and freedoms.

11. Children's Privacy

The Services are not directed at children under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by displaying a prominent notice on the platform. The date at the top of this page indicates when the policy was last updated. We encourage you to review this policy periodically.

13. Contact — Data Protection Officer

For any questions, concerns, or requests regarding this Privacy Policy or your personal data:

  • Data Protection Officer: dpo@measuredeck.com
  • General enquiries: hello@measuredeck.com
  • Post: MeasureDeck Ltd, Data Protection Officer, 1 Commercial Street, London, EC1A 1AA