Privacy notice

This explains what personal information QualTrack holds, why, who it's shared with, how long it's kept and your rights. QualTrack is run by QualTrack Ltd, a company registered in England and Wales (company number 17506852, registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ). Contact us about anything here at support@qualtrack.co.uk.

Two kinds of information, two roles

Account information is about the people who use QualTrack: the owners, admins, managers and viewers at each organisation that subscribes. For this we decide what's collected and why, so we're the controller.

Operative records are what our customers put into QualTrack about their workforce: operatives, their tickets, training and certificates. Here the customer (usually the operative's employer) decides what's recorded and why, and is the controller. We hold and process it for them as their processor, under our data processing terms. If you're an operative, your employer is the first place to go with questions or requests about your records; we'll help them answer.

What we hold

About people who use QualTrack

• Name, work email address, role, and department if you have one.
• When you signed in, and the changes you make (the audit log your organisation can see).
• Technical information when you use the site: IP address and browser, kept in our hosting and sign-in providers' security logs.
• For whoever pays: the plan, billing history and Stripe customer reference. Card details go straight to Stripe; we never see or store them.
• If your organisation signed up with a training partner's code, which partner it was. We don't tell the partner anything about that.
• Quote requests you send to our training partners: the course, how many people, where and when, any note, and your name, work email and (if you give it) phone number.
• Messages you send us, by email or through the contact form on our website.
• Features you suggest in QualTrack (“Ideas and updates”): what you wrote, who sent it and when, and which ideas your organisation voted for.

About visitors to our website

• Which pages of qualtrack.co.uk you visit and what you click, where you came from (for example a search engine), and your browser, device and rough location (country or city, worked out from your IP address, which isn't kept).
• If you accept cookies, a recording of your visit: how you moved around and scrolled, with anything typed hidden.
• If you join our mailing list: your email address, which page you joined from, and when you joined and confirmed.

This only happens on our website, never inside the QualTrack app, so it never includes anyone's records. We don't try to work out who website visitors are.

About people at businesses we'd like to work with

We keep sales records about construction and utility businesses that might use QualTrack, and the people we deal with there:

• The business's name, Companies House number, website, phone number, area, what it does and roughly how big it is.
• People's names, job titles and work contact details, and notes of our calls, emails and meetings with them.
• Where it comes from: public sources such as Companies House and the business's own website, what you tell us, and sales enquiries sent through the contact form on our website (questions about your account or billing aren't added).

We only use contact details that you or your business have made public or given us, never guessed ones. When an organisation signs up, its sales record is linked to its account, so we can see how its trial is going.

We use Claude, an AI assistant made by Anthropic, to help research businesses from public sources and draft emails, which a person checks and sends. It works with the sales records it's asked about, and never with anyone's records inside QualTrack.

About operatives, recorded by their employer

• Name, employee reference, job role, department, start date and whether they're active, and who they're employed by if they work for a subcontractor or agency.
• Optionally, an email address and mobile number, so they can be sent their own reminders.
• Tickets and training: what they hold, card numbers, dates and expiry dates, and copies of certificates or evidence. When someone checks a card against its register or sees it in person, how they checked it, when, and who did.
• Optionally, a photo for their Passport. We remove location and other hidden information from every photo.
• Renewal and training bookings, and the reminders sent to them and when.
• When their site card was scanned: the time only, nothing about who scanned it.

Site cards. Each operative can be given a printed card with a QR code, which also appears on an exported Passport. Whoever scans it sees, for that day, the operative's name, photo, job role, who they're employed by, employee reference, department, whether they're cleared for site work, and their tickets and training with expiry dates, including how and when a ticket was checked against its register (not who checked it). Never their contact details, card numbers or certificates. Their employer can replace a lost card, which stops the old one working, or switch cards off altogether. If their employer orders printed cards from us, we send the cards, exactly as the employer could download them, to our card printer CardHero (Lesar UK Ltd), which prints and posts them under a written contract that lets it use them for nothing else.

QualTrack doesn't need, and isn't designed to hold, sensitive information such as health details, National Insurance numbers or dates of birth. Please don't record them unless a ticket itself requires it.

QualTrack works out from these records whether each operative's required tickets and training are in date (for example “site ready” or “not cleared”). That's information for their employer, who makes any decision about work.

Why we use it, and the legal basis

• To provide QualTrack to the organisations that subscribe: accounts, records, reminders, exports. Basis: our contract with your organisation, and our legitimate interest in providing the service your employer has chosen.
• To send service emails and texts: sign-in links, expiry reminders, booking notices and the weekly summary. These aren't marketing. Basis: contract and legitimate interests.
• To keep QualTrack secure: sign-in checks, the anti-robot check at sign-up and sign-in, logs, and error reports. Basis: legitimate interests.
• To take payment and keep accounts. Basis: contract, and the law (tax records).
• To pass on quote requests to the training partners you choose. Basis: legitimate interests (getting you prices you asked for).
• To decide what to build next from the features you suggest and vote for, and to email whoever asked when an idea is built or ruled out. Other customers only ever see how many organisations want an idea, written in our words, never who asked or what they wrote. Basis: legitimate interests (improving QualTrack for the people who use it).
• To help when you ask, by email or through support access your organisation grants. Basis: legitimate interests.
• To find and talk to businesses that might use QualTrack: keeping sales records and getting in touch about QualTrack at work. Basis: legitimate interests (telling businesses about a service that helps them keep their workforce compliant). You can object at any time, and we'll stop.
• To email our mailing list: new blog posts and changes to ticket rules, sent through Resend. You're only on it once you've pressed the button in the confirmation email we send when you join. Basis: consent. Every email has a link to leave, and leaving deletes your address straight away.
• To understand how our website is used and improve it: counting visits without cookies. Basis: legitimate interests. With cookies and recordings of visits, only if you accept. Basis: consent, which you can withdraw at any time.

We don't sell personal information or use it for advertising. Any sales email we send goes to a work address, says who we are and where we got your details, and lets you opt out. If you opt out, we keep your email address on a do-not-contact list so it never happens again.

Who it's shared with

We use these companies to run QualTrack. Each only uses information to provide its service to us, under a contract.

Some of these are US companies or store some information outside the UK. Where information leaves the UK, it's protected by the safeguards UK law requires, such as the UK's data bridge with the US or the UK international data transfer agreement.

QualTrack staff can't see operative records unless the customer's owner turns on support access, which lasts at most 72 hours, is read-only, and is logged where the customer can see it. We may also share information if the law requires it.

Training partners. When you ask for quotes in QualTrack, we send the training partners you choose your company's name, your name, work email and phone number if you gave it, and what you asked for, so they can reply to you. They use it to answer you, as their own business. We never send them anyone's records or an operative's name.

How long we keep it

• An organisation's account and records are kept while it has a plan. If it cancels, or its free trial ends without a plan, the account stays read-only for 12 months so it can still export its records, then everything in it is deleted. Its owners are emailed a month before.
• When an organisation's owner asks us to delete its account (in Settings, or by email), we delete its records, files and its team's logins 7 days later (giving them time to change their mind), and always within 30 days, and from backups when those are overwritten.
• Billing records are kept for six years, as tax law requires.
• Website analytics are kept for up to a year, and recordings of visits for up to 30 days.
• Sales records about a business that hasn't become a customer are deleted two years after we were last in touch, or sooner if you ask. Do-not-contact entries (just the email address) are kept for good, so we can honour them.
• Mailing list addresses are kept until you leave the list, when we delete them at once. An address that isn't confirmed within 30 days of joining is deleted.
• Feature suggestions and votes are kept with the organisation's account and deleted with it. A person's name stops showing against a suggestion when they leave the team.
• Quote requests are kept with the organisation's account, so it can see what it asked for and from whom. What a training partner keeps is up to them.
• Operative records are deleted when the customer deletes them, or with their account. Deleting an operative also deletes their certificates and photo, and removes their name and contact details from the alert history and audit log. An operative who has left can be marked as left instead: their records are kept, but they get no messages and their site card stops working. Records of when a site card was scanned are deleted after 13 months.

Cookies

In the QualTrack app, we only use the cookies needed to keep you signed in. There are no analytics, advertising or tracking cookies there. The anti-robot check at sign-up and sign-in (Cloudflare Turnstile) looks at your browser to tell people from automated scripts, and isn't used to track you.

On our website (qualtrack.co.uk), we ask before setting any analytics cookies. If you accept, PostHogsets cookies and browser storage that recognise you across visits and let us record visits. If you reject them, or haven't chosen yet, we still count visits, but without cookies or anything stored on your device: PostHog works out a code from your IP address and browser that changes every day, so it can't follow you from one day to the next. We remember your choice on your device. You can change it at any time with “Cookie settings” at the bottom of every page of the website. If your browser sends a “Do not track” signal, we don't collect website analytics at all.

We don't use advertising cookies anywhere. Fonts are served by QualTrack itself, not loaded from Google.

Keeping it safe

Information is encrypted on its way to and from QualTrack. Each organisation can only ever see its own records, and the database itself enforces that. Certificates and photos are stored privately and only shown through short-lived links, except that an operative's photo is shown on their site check page to whoever scans their card. QualTrack staff need a code from an authenticator app to use the admin tools, and every look and change they make is logged.

Your rights

You can ask for a copy of your information, ask us to correct or delete it, ask us to stop or limit using it, object to how we use it, and ask for it in a form you can take elsewhere. Email support@qualtrack.co.uk. We'll reply within a month. If you're an operative, we'll work with your employer, who controls your records.

If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office at ico.org.uk. We'd appreciate the chance to put it right first.

Changes

If we change this notice in a way that matters, we'll tell account owners by email or in QualTrack before the change takes effect.

Last updated 7 October 2026. Questions: support@qualtrack.co.uk.