Privacy Policy

Alpha Controls Ltd (“we”, “us”, “our”) is a Building Management Systems (BMS) contractor based in Gravesend, Kent, United Kingdom. We install, commission, and maintain building controls systems for commercial and public sector clients.

We also operate govnr.ai, a SaaS platform for contractor workforce management, shift scheduling, compliance tracking, and project administration. This privacy policy covers both the Alpha Controls website (alphacontrols.io) and the govnr.ai platform.

Alpha Controls Ltd is the data controller for the purposes of UK GDPR and the Data Protection Act 2018.

We collect and process the following categories of personal data:

Personal information

• Full name, email address, and phone number
• Emergency contact details
• Profile photograph

Professional data

• CSCS card number and type
• Professional certifications and qualifications
• Skill level and trade classifications
• Day rate and payment information

Work and attendance data

• Shift attendance and timesheet records
• Work locations and site assignments
• Hours worked and overtime

Compliance data

• Digital signatures on compliance documents (RAMS, method statements, inductions)

Communication data

• Call recordings made through our AI phone system for quality assurance and record-keeping
• SMS notification logs

Business data

• Quotation and invoice records
• Project details and associated documentation

Technical data

• IP address, browser type, and device information
• Usage data and analytics collected through our website

We only process your personal data where we have a lawful basis to do so under UK GDPR. The bases we rely on are:

Legitimate interest

• Managing employment and contractor relationships
• Scheduling shifts and tracking attendance
• Processing payroll and invoicing
• Maintaining health and safety compliance records
• Quality assurance through call recordings
• Improving our services through analytics

Contractual necessity

• Providing access to the govnr.ai platform
• Delivering BMS contracting services
• Processing quotes and invoices

Legal obligation

• HMRC record-keeping requirements for financial data
• Health and safety compliance documentation
• Construction industry verification (CSCS checks)

Consent

• Optional AI-powered features (estimation tools, SMS parsing, intelligent scheduling)
• Marketing communications (where applicable)
• Non-essential cookies

Where we rely on consent, you may withdraw it at any time by contacting us or adjusting your account settings.

• Shift management: scheduling operatives, tracking attendance, and managing site assignments
• Payroll and finance: calculating hours worked, generating invoices, and processing payments
• Compliance: recording digital signatures on safety documents, verifying CSCS credentials, and maintaining audit trails
• AI-powered features: automated project estimation, intelligent SMS parsing for shift confirmations, and AI-assisted phone call handling
• Communication: sending shift notifications, updates, and reminders via SMS and email
• Platform improvement: analysing usage patterns to improve the govnr.ai platform
• Quality assurance: reviewing call recordings to improve service delivery

We share your data with the following sub-processors, each of which has their own privacy policy and data processing agreements in place:

We do not sell your personal data to any third party. We may also share data with professional advisors (accountants, legal counsel) and regulatory authorities where required by law.

Some of our sub-processors are based outside the UK. Where data is transferred internationally, we ensure appropriate safeguards are in place:

• Supabase: hosted in the EU (eu-west-2), covered by UK adequacy regulations
• Vercel: global CDN with edge locations worldwide; data processing governed by standard contractual clauses
• Anthropic, Twilio, Retell AI: US-based; transfers rely on standard contractual clauses (SCCs) and supplementary measures as required by UK GDPR
• Stripe: certified under international data transfer frameworks with standard contractual clauses

We retain your data only for as long as necessary for the purposes for which it was collected:

• Financial records (invoices, payment records, timesheets used for payroll): 6 years from the end of the financial year, as required by HMRC
• Operational data (shift records, attendance, project assignments): duration of your engagement with us, plus 12 months
• Call recordings: 30 days from the date of recording, unless a longer retention is required for dispute resolution
• Compliance documents (signed RAMS, induction records): duration of the relevant project, plus 6 years
• Account data: until you delete your account or request erasure
• Analytics data: aggregated and anonymised; retained indefinitely

When data is no longer needed, it is securely deleted or anonymised.

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access: request a copy of the personal data we hold about you
• Right to rectification: request correction of inaccurate or incomplete data
• Right to erasure: request deletion of your personal data (subject to legal retention obligations)
• Right to data portability: receive your data in a structured, machine-readable format
• Right to object: object to processing based on legitimate interest
• Right to restrict processing: request that we limit how we use your data
• Right to withdraw consent: where processing is based on consent, withdraw it at any time

How to exercise your rights

You can exercise your rights by:

• Emailing us at admin@alphacontrols.co.uk
• Deleting your account directly through the govnr.ai portal
• Writing to us at the address listed in the Contact section below

We will respond to your request within one month. In complex cases, we may extend this by a further two months, in which case we will notify you.

Our website uses cookies to provide essential functionality (such as authentication sessions and user preferences) and to collect anonymised analytics data through Vercel Analytics.

For full details on the cookies we use and how to manage them, please see our Cookie Policy.

Our services and platform are not designed for or directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a person under 18, please contact us immediately and we will take steps to delete it.

We may update this privacy policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the “Last updated” date at the top of this page. For significant changes, we will notify you via email or through a notice on our platform. We encourage you to review this policy periodically.

If you are unhappy with how we have handled your personal data, we would appreciate the chance to resolve your concerns directly. Please contact us using the details below.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection. You can contact the ICO at ico.org.uk/make-a-complaint or by calling 0303 123 1113.

If you have any questions about this privacy policy or how we handle your data, please contact us:

• Company: Alpha Controls Ltd
• Email: admin@alphacontrols.co.uk
• Address: Gravesend, Kent, United Kingdom