Privacy Policy

This Privacy Policy explains what personal data is processed through MARF Site Manager ("MARF", "the Platform", "we", "us"), how it's handled, and what rights individuals have over it. MARF is operated by [MARF Site Manager Ltd — company registration number to be confirmed], a company registered in England and Wales, and processes personal data in accordance with the UK GDPR and the Data Protection Act 2018.

If you are an employee, subcontractor or operative whose data is entered into MARF by your employer or engager, please also check with them directly — as the data controller, they are responsible for telling you what's collected and why, and for handling your rights requests in the first instance (see "Your Rights" below).

Definitions

• Platform — the MARF Site Manager web dashboard, API, and Android mobile app.
• Customer — the construction company that subscribes to MARF and controls the data entered by its users (the data controller under UK GDPR).
• We / Us / MARF — MARF Site Manager, the data processor operating the Platform on the Customer's behalf.
• User / Data Subject — an individual with a login to MARF: office admin, site manager, operative, or subcontractor.
• Operational Data — timesheets, site check-ins, certifications, incident reports, plant checklists, documents and similar records entered into the Platform.

Data We Process

Account & profile data

• Name, email address, job title, department and role/permission tier
• Password (stored as a salted BCrypt hash — never in plain text, never visible to MARF staff)
• Emergency next-of-kin contact details, where a Customer chooses to record them

Operational data (entered by Customers and their users)

• Timesheets — hours worked, site, approval status
• Site check-in/out — timestamp and, where GPS-based check-in is enabled by the Customer, the device's location at the moment of check-in or check-out only — MARF does not continuously track location in the background
• Certifications & training — CSCS/plant tickets, expiry dates, training matrix records
• Incident & near-miss reports — may include health-related details (an injury description, for example), which is special category data under Article 9 UK GDPR and is handled with additional care — access restricted to authorised roles, never used for any purpose beyond safety recording and RIDDOR compliance
• CIS subcontractor declarations — legal name and Unique Taxpayer Reference (UTR), where the Customer engages CIS subcontractors — this is financial data HMRC may require to be retained
• Documents & signatures — RAMS, policies, signed document records and read receipts
• Plant/equipment checklists, leave requests, induction submissions, drawings — as entered by the Customer's users

Billing data

Subscription billing is handled by Stripe, Inc. Card details are entered directly into Stripe's hosted Checkout and Billing Portal — MARF never receives or stores full card numbers. We hold the Customer's billing contact name/email and Stripe's customer/subscription reference IDs only.

Mobile app & push notifications

The Android app registers a device token (via Firebase Cloud Messaging) so the Platform can deliver reminders — expiring certifications, timesheet approvals, and similar. Device tokens are used solely for this purpose and are deleted when a device is removed or a user is deactivated.

Sign-in sessions

The web dashboard stores a short-lived access token and a longer-lived refresh token in your browser to keep you signed in. No third-party advertising or analytics cookies are used in the MARF application itself.

Analytics on this marketing website

This public marketing site (usemarf.com) uses Google Analytics 4 to understand how visitors find and use the site. Analytics cookies are not set until you choose "Accept" on the cookie banner — we run Google Consent Mode with analytics_storage denied by default, so no _ga cookie or analytics identifier is stored if you decline or ignore the banner. IP addresses are truncated before storage, Google Signals / advertising personalisation is disabled, and data is retained for 14 months. Your accept/decline choice is remembered in your browser's local storage; clear it to be asked again. This applies only to the marketing website, never to the logged-in MARF application.

Data We Do NOT Do

• We do not sell personal data to any third party, ever
• We do not share one Customer's data with another — every query is scoped to a single company at the database layer
• We do not run advertising trackers, ad retargeting, or cross-site tracking on the Platform or this website — the only analytics is consent-gated Google Analytics on the marketing site (see above)
• We do not use GPS to track a user's location outside the moment of an explicit site check-in/out (where that check-in method is enabled by the Customer)

Legal Basis for Processing

Where MARF processes personal data as the Customer's processor, the Customer determines the legal basis (typically performance of the employment contract, legal obligation — e.g. HMRC payroll records or RIDDOR reporting — or legitimate interests in running a safe site). Where MARF itself is the controller — for example, billing contact details, or visitor data on this marketing website — our basis is performance of our contract with the Customer and our legitimate interest in operating and improving the Platform.

Sub-processors

A full, current sub-processor list and a Data Processing Agreement are available on request — contact us using the details below.

Data Retention

Each Customer's Financial Admin can configure retention windows for their own company under Settings → GDPR. Defaults are aligned to UK legal minimums:

Your Rights (UK GDPR)

If your data was entered by an employer or engager using MARF, please raise requests with them first — they are the controller and can action most requests directly from their own Settings → GDPR area (Subject Access Request export, erasure request). Where a request needs to reach us directly, you have the right to:

• Access — request a copy of personal data held about you
• Erasure — request deletion, subject to any legal retention obligation (e.g. HMRC, RIDDOR) that may require us to retain certain records regardless
• Rectification — correct inaccurate data
• Object — object to processing carried out on the basis of legitimate interests
• Complain — lodge a complaint with the Information Commissioner's Office (ICO)

Children

MARF is a workforce management tool for employees and subcontractors of construction businesses and is not directed at children. We do not knowingly process data relating to anyone under working age.

Changes to this Policy

We will update the "Last updated" date above whenever this policy changes materially. Continued use of the Platform after an update constitutes acceptance of the revised policy.