Last Updated: September 2026
Privacy Policy & GDPR Disclosure
How Building Surplus collects, processes, and protects your personal data and site survey metadata.

1. Data Controller & Scope

Building Surplus operates as a circular materials reuse platform. In accordance with the General Data Protection Regulation (GDPR) and national data protection legislations, this Privacy Policy applies to all users of the Building Surplus web application, including account holders, visitors, and field survey workers utilizing token-based capture links.

2. Information We Collect

Account Information

Name, email address, organization affiliation, and authentication tokens provided when creating an account or logging in.

Site Survey Photos & OCR Text

Photographs of surplus construction materials and automatic Optical Character Recognition (OCR) text extracted from product labels, spec sheets, and delivery packaging.

Precise Geolocation (GPS)

High-accuracy coordinates (latitude, longitude, altitude, accuracy, and timestamp) collected during site surveys to authenticate material locations and enable local circular reuse routing.

Device & Network Telemetry

IP address, browser user-agent, operating system platform, screen resolution, display pixel ratio, and capture session tokens for audit log integrity.

3. Lawful Grounds for Processing (GDPR Art. 6)

  • Contractual Necessity (Art. 6(1)(b)): To manage user accounts, deliver surplus catalog management, and provision collaborative workspaces.
  • Legitimate Interests (Art. 6(1)(f)): To maintain audit trails, verify the authenticity and location of surplus inventory, protect against fraudulent entries, and optimize platform performance.
  • Sensor & Device Access Consent (Art. 6(1)(a)): Explicit permission granted when allowing browser camera, microphone, or GPS geolocation sensors.

Site Survey Privacy Safeguards (Worker Guidelines)

Building Surplus collects visual evidence purely for material identification. Workers must strictly avoid capturing:

  • Faces or identifiable features of workers, site personnel, or members of the public.
  • Personal documents, employee names, or personal contact details.
  • Private vehicle registration numbers or license plates.

4. Local Storage & Cookies (ePrivacy)

We strictly use essential technologies necessary to provide core services:

  • Session Cookies: Strictly necessary authentication tokens managed securely to keep you signed in.
  • IndexedDB Local Queue: Client-side storage on your device (via Dexie) to hold photos and metadata offline until an internet connection is established, preventing loss of site data.

5. Your Rights Under GDPR

Under Articles 15 to 22 of the GDPR, you have the following enforceable rights:

Right of Access (Art. 15): Request a copy of all personal data held about you.
Right to Rectification (Art. 16): Correct inaccurate or incomplete records.
Right to Erasure (Art. 17): Request deletion of your personal data ("Right to be Forgotten").
Right to Restrict Processing (Art. 18): Restrict the processing of your data under specific conditions.

Contact & Supervisory Authority

For questions regarding this policy or to exercise any of your data protection rights, please contact the Building Surplus administrative team. You also have the right to lodge a complaint with your relevant Data Protection Authority (such as the UK Information Commissioner's Office - ICO).