1. Introduction
FabQT ("FabQT", "we", "us" or "our") provides cloud-based fabrication quality, traceability and business management software for fabrication, engineering and construction-related organisations. We are committed to protecting personal data and respecting the privacy of our customers, users and website visitors.
This Privacy Policy explains what personal data we collect, how and why we use it, who we may share it with, how long we retain it, and the rights available to individuals under UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Our role under data protection law
Our role depends on the information being processed:
- Data controller: we generally act as controller for information relating to our customers, account holders, website visitors, subscription administration, billing, support enquiries and our own business operations.
- Data processor: where a customer enters or uploads personal data into FabQT as part of its own business records, we generally process that information on the customer's behalf and in accordance with its instructions. In those circumstances, the customer is normally the data controller.
Further provisions governing customer data processed through the platform may be set out in our Data Processing Agreement (DPA).
3. Information we collect
3.1 Information you provide to us
- Account information: name, email address, username, job role, authentication details and account permissions.
- Organisation information: company name, business contact details, registered or trading address, VAT details, company logo or other branding uploaded to the workspace, and other workspace information.
- Subscription and billing information: plan details, subscription status, billing records and transaction references. Payment card information may be handled directly by our payment provider rather than stored by FabQT.
- Communications: support requests, emails, feedback and other correspondence with us.
3.2 Information entered into the FabQT platform
Customers and authorised users may enter, upload or generate operational information within FabQT. Depending on the modules used, this may include:
- project, client and contract information;
- supplier and subcontractor information;
- quotations, estimates, purchase orders, invoices, credit notes and payment records;
- quality assurance, fabrication, welding, inspection and material traceability records;
- work orders, delivery records, documents, photographs and attachments;
- employee, training, competency, HR and health & safety information where those features are used; and
- other records uploaded or created by a customer in connection with its business activities.
Customers are responsible for ensuring they have an appropriate lawful basis for personal data they enter into the platform and for controlling which of their users can access that information.
3.3 Information collected automatically
- Technical information: IP address, browser type, device type, operating system and similar technical information.
- Usage and security information: login activity, timestamps, pages or features accessed, audit information, error logs and security events.
- Cookie information: information collected through cookies and similar technologies as described in our Cookie Policy.
4. How we use personal data
We may use personal data to:
- create and administer accounts and customer workspaces;
- provide, operate and maintain the FabQT service;
- process subscriptions, billing and payments;
- authenticate users and manage roles, permissions and access;
- provide customer support and respond to enquiries;
- send service, security, billing and other important account communications;
- protect the platform, investigate misuse and prevent fraud or unauthorised access;
- diagnose faults, monitor performance and improve our services;
- maintain appropriate business, financial and compliance records;
- identify and, where permitted by our Terms of Use, promote organisations that use FabQT, including by displaying an organisation’s name and logo on FabQT’s public website, marketing materials or customer showcase content; and
- comply with legal, regulatory and contractual obligations.
5. Our lawful bases for processing
Where we act as a data controller, the lawful basis we rely on will depend on the circumstances. These may include:
- Contract: where processing is necessary to provide FabQT or take steps at your request before entering into a contract.
- Legitimate interests: where necessary to operate, secure, support and improve our business and platform, provided those interests are not overridden by your rights.
- Legal obligation: where we must process information to comply with applicable law, tax, accounting or regulatory requirements.
- Consent: where we have asked for your consent, for example for certain optional communications or non-essential cookies. You may withdraw consent at any time.
6. Customer names, logos and promotional use
Where a Customer uploads or supplies its company name, logo, trade mark or other brand material to FabQT, we may use that branding as permitted by our Terms of Use to identify the Customer as a user of FabQT. This may include displaying the Customer’s name and logo on the FabQT public website, customer lists, presentations, social media, sales materials and other promotional or marketing materials.
We will not use this permission to imply that a Customer endorses FabQT, or to materially alter a Customer’s logo, except for reasonable resizing, formatting or presentation necessary for the relevant medium. A Customer may ask us to stop future promotional use of its name or logo by contacting us. This does not affect uses already published or materials already produced before we have had a reasonable opportunity to action the request.
Company logos and trade marks are generally not personal data. However, where branding or related material contains personal data, we will handle that personal data in accordance with this Privacy Policy and applicable data protection law.
8. How we share information
We do not sell personal data. We may disclose personal data where reasonably necessary to:
- hosting, infrastructure, backup, email, payment, support and security service providers that help us operate FabQT;
- professional advisers such as accountants, lawyers, insurers and auditors;
- law enforcement, regulators, courts, government bodies or other authorities where disclosure is required or permitted by law;
- other authorised users within the same customer organisation, according to the permissions configured within FabQT; and
- a purchaser, investor or successor organisation in connection with a genuine corporate transaction, subject to appropriate confidentiality and data protection safeguards.
Where a third party processes personal data for us, we require appropriate contractual and organisational safeguards.
8. Payments
Where paid subscriptions or other charges are processed through a third-party payment provider, payment information may be submitted directly to that provider. FabQT may receive transaction identifiers, payment status, billing details and limited payment-related information needed to administer your subscription, but we do not need to store complete payment card details ourselves.
9. International data transfers
Some suppliers that support our service may process information outside the United Kingdom. Where personal data is transferred internationally, we take reasonable steps to ensure that an appropriate safeguard is in place as required by UK data protection law, such as a UK adequacy regulation or approved contractual safeguards.
10. Data security
We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful loss, alteration, disclosure, misuse or unauthorised access. Measures may include access controls, authentication, encrypted connections, backups, logging, tenant separation and restricted administrative access.
No internet-based service can guarantee absolute security. Customers should also protect their user accounts, use appropriate passwords and permissions, and notify us promptly if they suspect unauthorised access.
11. Data retention
We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including providing the service, maintaining appropriate business records, resolving disputes, enforcing agreements and meeting legal, tax and accounting obligations.
Retention periods may vary depending on the type of record and the customer's instructions. Customer data may also remain temporarily within secure backups after deletion from the live service until those backups are overwritten in accordance with our backup and retention processes.
12. Account closure and customer data
If a FabQT subscription or customer account is cancelled, access to the platform may end in accordance with the applicable terms. Customers should export any information they are required to retain before their account is permanently deleted. We may retain limited information after closure where necessary for legal, security, fraud prevention, accounting or dispute-resolution purposes.
13. Your data protection rights
Depending on the circumstances, UK data protection law may give you the right to:
- request access to personal data held about you;
- request correction of inaccurate or incomplete personal data;
- request erasure of personal data in certain circumstances;
- request restriction of processing in certain circumstances;
- object to processing based on legitimate interests or to direct marketing;
- request data portability where the legal requirements apply;
- withdraw consent where processing is based on consent; and
- raise a complaint with the Information Commissioner's Office (ICO).
If your information has been entered into FabQT by your employer, customer, contractor or another organisation, that organisation may be the relevant data controller. We may therefore need to refer your request to that organisation or assist it in responding.
14. Cookies
Our website and platform may use cookies or similar technologies for essential functionality, security, preferences and, where enabled and permitted, analytics. Please see our Cookie Policy for further information and available choices.
15. Children's privacy
FabQT is a business-to-business platform and is not designed or intended for use by children. We do not knowingly offer the service directly to children.
16. Third-party links
Our website or platform may contain links to third-party websites or services. Those organisations are responsible for their own privacy practices, and we recommend reviewing their privacy information before providing personal data to them.
17. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to FabQT, our suppliers, legal requirements or our data handling practices. The date shown at the top of this page indicates when the policy was most recently updated. Where appropriate, we may also notify customers of material changes through the platform or by email.
18. Contact and complaints
If you have a question about this Privacy Policy, wish to exercise a data protection right, or have a concern about how personal data is handled, please contact FabQT using the contact or support details published on our website.
You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO). Further information is available from the ICO's official website.