RoofPass Pro logoRoofPass ProBack to home

RoofPass Pro — Privacy Policy

Last updated: 30 August 2026

1. Who we are

RoofPass Pro is a product owned and operated by Site Skills Passport Ltd ("we", "us", "our"). We are the data controller for personal information collected through this service, except where noted in Section 2 below.

Data Controller: Site Skills Passport Ltd Email: support@roofpasspro.co.uk Website: roofpasspro.co.uk

We are registered with the Information Commissioner's Office (ICO) as a data controller, registration number ZC168090.

2. Our role: controller and processor

2.1 Where we process personal data about you as a registered user (e.g. your name, email, and login activity) for our own purposes (billing, account administration, support), we act as a data controller.

2.2 Where your organisation enters personal data about other individuals into the Service — for example, the names, signatures, and photographs of team members, clients, or suppliers recorded in condition reports, permits, RAMS sign-offs, or completion sign-offs — we act as a data processor on behalf of your organisation, which is the data controller for that information.

3. What personal data we collect

  • Account data: name, email address, role (Owner/Admin/Team Member), organisation, password (hashed).
  • Usage data: login times, actions taken in the Service, device/browser information.
  • Customer Data entered by your organisation, which may include:
    • Names of team members, clients, and suppliers
    • Digital signatures (RAMS sign-off, permit daily logs, completion sign-off)
    • Site photographs (condition reports, work stage photos, post-install photos) — these may incidentally include images of individuals
    • Site check-in/check-out timestamps
    • Permit and RAMS records, including uploaded documents
  • Billing data: processed via our payment provider (Stripe) — we do not store full card details ourselves.

4. How we use your information

We use personal data to:

  • Provide and maintain the RoofPass Pro service
  • Enable team members to sign RAMS documents, complete permits, and record site activity
  • Allow owners/admins to manage jobs, teams, and compliance records
  • Process subscription payments
  • Send transactional notifications about account activity (e.g. permit approvals, RAMS sign-off status)
  • Generate reports and O&M manuals from data your organisation has entered
  • Improve the service through anonymised usage analytics
  • Comply with legal obligations
  • Prevent fraud and protect platform security

5. Legal basis for processing (UK GDPR)

  • Contract: to provide the service you have signed up for
  • Legitimate interest: to improve the service, prevent fraud, and ensure platform security
  • Legal obligation: to comply with applicable law
  • Where we act as a processor (Section 2.2), the legal basis for that processing is determined by your organisation as the data controller.

6. Data sharing

We share data with:

  • Cloud infrastructure (Supabase via Lovable Cloud): to host and store your data securely.
  • Payment processor (Stripe): to process subscription payments securely.
  • We do not sell personal data to third parties.
  • We do not share data for advertising purposes.

7. Data security

We apply technical and organisational measures including:

  • Encryption in transit (TLS) and at rest
  • Row-level database security, scoped so each organisation can only access its own data
  • Secure authentication
  • Private, access-controlled storage for photographs and documents, accessed only via short-lived signed links
  • Regular security reviews

8. Data retention

  • Account data is retained for the duration of your subscription and for a limited period afterwards for legal/accounting purposes.
  • If an organisation's account is deleted, associated data will be removed within 30 days, in line with our standard retention practice, except where we are required to retain it for longer by law.

9. Your rights

Under UK GDPR, you have the right to access, rectify, erase, restrict processing of, port, and object to processing of your personal data, and to withdraw consent where processing is based on consent. To exercise these rights, contact support@roofpasspro.co.uk. We will respond within 30 days. Where we act only as a processor, we will direct requests to the relevant organisation (data controller) unless required to act otherwise by law.

10. Age requirements

The Service is intended for business use. Account holders (Owners, Admins) must be 18 or over.

11. Data hosting and international transfers

12. Changes to this policy

We will notify account Owners of significant changes at least 14 days before they take effect.

13. Cookies

See our separate Cookie Policy.

14. Contact and complaints

Email: support@roofpasspro.co.uk Website: roofpasspro.co.uk

You have the right to complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).

Notes for solicitor review:

  • Confirm ICO registration ZC168090 covers RoofPass Pro's processing activities (Section 1) — this is the single most important open item, given the data types differ meaningfully from Site Skills Passport's registered activity.
  • Confirm hosting region and sub-processors actually used for RoofPass Pro's Supabase project (Section 6, 11) — likely the same infrastructure pattern as Site Skills Passport, but should be confirmed rather than assumed.
  • Confirm payment processor (Stripe, presumed).
  • Confirm age policy for Team Member accounts (Section 10).
  • support@roofpasspro.co.uk is live and confirmed.