Privacy Policy
APXS-UK LTD, trading as ApexSpark
Effective date: 30 September 2026
Last updated: 5 October 2026
This policy explains how APXS-UK LTD, trading as ApexSpark ("ApexSpark", "we", "us"), collects and uses personal data when you visit apexspark.co.uk, contact us, or use the ApexSpark platform: the office web app and the ApexSpark engineer apps for iPhone and Android (together, the "Service"). It is written to meet the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).
1. Who we are
APXS-UK LTD is a company registered in England and Wales, company number 17467844, registered office 71–75 Shelton Street, London, WC2H 9JQ.
Contact for anything in this policy, including data protection requests: help@apexspark.co.uk. Please put "Privacy" in the subject line.
2. Our two roles: controller and processor
We are the controller for personal data we collect for our own purposes:
- people at our business customers who hold or manage an ApexSpark account (for example the account owner and office admins), as far as we manage the customer relationship;
- people who enquire about ApexSpark, book a demo or contact our support;
- visitors to apexspark.co.uk;
- technical and security data about how the Service is accessed.
We are a processor for the data our business customers (electrical contractors, "Customers") put into the Service about their own engineers and staff, their subcontractors, their clients (builders, developers, landlords) and the homeowners and occupants of properties they work on. The Customer is the controller of that data and decides why and how it is used. We process it only on the Customer's documented instructions, under our Data Processing Agreement. If you are an engineer, a homeowner or an occupant and have a question about your data in the Service, please contact the company you work for or that attended your property first. We will help them respond and, if you contact us, we will pass your request to them.
3. What we collect
3.1 Data we control
- Account and contact details: name, work email, phone number, company name, job role, the web address (subdomain) of your company's workspace.
- Enquiries and demo requests: company name, contact name, email, phone, the plan or number of engineers you mention, and the page you came from.
- Support communications: emails and messages you send us and our replies.
- Contract and invoicing records: what you have ordered from us, invoices and payments (we currently invoice directly; we do not take card payments online).
- Security and technical data: IP address, browser and device type, time of access, sign-in events and error logs, used to run and secure the Service.
- Website cookie notice: that you have seen our cookie notice, so it is not shown again (see our Cookie Policy).
3.2 Data we process for our Customers
Depending on which features a Customer switches on, the Service may hold:
- Engineers and staff: name, work email, role, phone, home address, date of birth, start date, National Insurance number, UTR, subcontractor business details, bank details for payroll (sort code, account number, account name), emergency contacts (name, relationship, phone), driving licence and expiry, ECS/qualification card details and uploaded documents, training records and quiz results, timesheets, clock-in/out times, holidays, overtime, tool allocations, jobs worked, signatures on certificates and reports, and any medical conditions, allergies or medication the engineer chooses to record for health and safety on site.
- Homeowners and occupants (Customer Care visits): property address and plot, the issue reported, access notes, appointment times, notes of contact attempts, before/after photos of the work, the occupant's name and signature on the visit report.
- Clients and suppliers: contact names, emails, phone numbers and addresses of builders, developers and suppliers; quotes, purchase orders, invoices.
- Electrical certificates: installation addresses, test results, engineer and countersigner names and signatures.
- Device and app data: for each signed-in phone, a device identifier, device name, platform (iOS or Android), app version, first and last seen times, and on iPhone an Apple push notification token. We do not use advertising identifiers and the apps contain no analytics or advertising software.
- Location data: see section 4.
- Email (optional): if a Customer connects its own mailbox, copies of emails in that mailbox are cached in the Service so the office can view them.
Special category data. Medical information about engineers is health data. It is optional and entered by the engineer or the Customer; the Customer is responsible for having a lawful condition under Article 9 UK GDPR and the Data Protection Act 2018 (typically employment, health and safety obligations or the engineer's explicit consent).
4. Location data in the engineer apps
Location is only used for time and attendance features that the Customer chooses to use. We never use location for advertising and never sell it.
Clock in / clock out (whether or not on-site attendance is switched on). When an engineer taps clock in or clock out, the app (or browser) reads the phone's position at that moment only and stores it with its accuracy and the time; the Customer's office can see it. Clock-in only succeeds inside (or within 50 metres of) the site boundary the Customer has drawn. The clock-out position is stored wherever the engineer is when they clock out, even if that is off site. Clocking does not track the engineer between those two moments. Tools allocated to an engineer are recorded against those same two positions; tool tracking takes no separate reading. While an engineer is clocked in and has the app open on screen, the app may also check the position occasionally; those checks are stored only when the engineer is inside the site boundary and are otherwise discarded.
On-site attendance (off by default). A Customer can switch on on-site attendance for its workspace. When it is on, and only between an engineer's clock-in and clock-out (for a maximum of 14 hours), the app uses the phone's operating system to detect when the engineer arrives at, leaves or returns to the site, and sends a periodic "still on site" check (about every 15 minutes where the phone allows). The Service:
- stores coordinates only when the engineer is inside the site boundary (plus a 50 metre margin);
- records "left site" events with a time but no position;
- never records location before clock-in, after clock-out, or off site;
- does not use continuous background GPS tracking.
The Customer's office can see arrival, departure and heartbeat times and on-site positions, and can receive an alert if an engineer has been away from site longer than a set time. The engineer is told in the app when attendance checks are running and can turn off location permission in their phone settings at any time (which stops the checks; the Customer's office will see that background checks were off). On Android the app uses Google Play services location and geofencing APIs on the phone to do this.
Before switching attendance on, the Customer is responsible for telling its engineers and, where required, carrying out a data protection impact assessment.
5. Why we use data and our lawful bases (data we control)
| Purpose | Data | Lawful basis |
|---|---|---|
| Providing the Service to our Customer under contract (accounts, sign-in, support) | Account, contact, technical data | Contract (Art. 6(1)(b)) with the Customer; legitimate interests (Art. 6(1)(f)) for the individual users who act for the Customer |
| Replying to enquiries and demo requests | Enquiry data | Legitimate interests (responding to people who ask us about ApexSpark); steps before a contract |
| Service emails (sign-in links, password resets, notifications) | Name, email, message content | Contract / legitimate interests |
| Keeping the Service secure, preventing misuse, diagnosing faults | Technical and security data | Legitimate interests |
| Invoicing and keeping accounting records | Contract and invoicing records | Legal obligation (Art. 6(1)(c)) |
| Telling existing customers about relevant product updates | Name, work email | Legitimate interests; PECR "soft opt-in" for corporate subscribers. You can opt out at any time |
| Responding to legal claims or lawful requests | Any relevant data | Legal obligation / legitimate interests |
For data we process for Customers, the Customer decides the lawful basis.
6. Who we share data with
We do not sell personal data and we do not use Customer data to train AI models. We share data only with the service providers we need to run ApexSpark (our sub-processors):
| Provider | What they do | Location |
|---|---|---|
| Fasthosts Internet Ltd | Server hosting for the Service, databases and uploaded files | United Kingdom |
| Resend (Plus Five Five, Inc.) | Sending service emails (sign-in links, password resets, notifications, reports the Customer chooses to email) | United States |
| Apple Inc. | Delivering push notifications to iPhones (Apple Push Notification service); App Store distribution | United States / global |
| Google LLC | Google Play distribution of the Android app; Google Play services location APIs on Android phones when attendance is on; web fonts loaded in the web app | United States / global |
| Cloudflare, Inc. (cdnjs) | Delivers the map software library to browsers on map pages | Global network |
| OpenStreetMap Foundation | Map tiles and address search on map pages (receives your IP address and, for address search, the text typed) | United Kingdom / EU |
| A specialist AI service provider (data may be processed in the EU and the US, with UK-approved safeguards for any transfer outside the UK) | The optional automatic check in drawing take-off. It runs only for Customers who switch drawing take-off on. It receives small cut-outs of symbols from a builder's drawing (about 0.4 m × 0.4 m of the plan each) and the drawing's electrical notes text, and it sends back a suggestion for each symbol and questions for the builder. Whole drawings are never sent. The provider's terms forbid it to train its models on this data, and it deletes the data within 30 days unless it must keep it longer to enforce its usage policy or by law. | EU and United States, with UK-approved safeguards |
A list of our sub-processors is available to customers on request (help@apexspark.co.uk).
The Android app does not use Firebase or Google push messaging: it checks our servers for new notifications itself.
Customer-chosen services. If a Customer connects its own email account, the Service sends data to those services on the Customer's instruction. Those services are chosen by and contracted to the Customer.
Payments. We do not currently take card payments online. If we start to, we will use Stripe and will update this policy first.
We may also share data with professional advisers, insurers, a buyer of our business (under confidentiality), or where the law requires (for example the police or HMRC with a valid request).
7. International transfers
Our hosting and databases are in the UK. Some providers (Resend, Apple, Google, Cloudflare and our AI service provider) are based in, or may access data from, the United States or other countries. Where personal data leaves the UK we rely on an adequacy regulation (including the UK Extension to the EU-US Data Privacy Framework, the "UK-US data bridge", where the provider is certified under it) or, where it is not, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any extra safeguards needed. You can ask us for details at help@apexspark.co.uk.
8. How long we keep data
| Data | Retention |
|---|---|
| Account and contact data for Customer users | While the Customer's contract is active, then up to 90 days to allow export, then deleted |
| Customer data (engineers, occupants, jobs, photos, location) | As the Customer decides while the contract is active; deleted or returned at the end of the contract under the Data Processing Agreement |
| Enquiries and demo requests that don't lead to a contract | Up to 24 months from last contact |
| Contract and invoicing records | 6 years after the end of the financial year they relate to |
| Server and security logs | Up to 90 days, longer if needed to investigate an incident |
| Expired sign-in and password-reset tokens | Deleted automatically within 7 days of expiry |
| Backups | Nightly backups: each daily copy is kept for 30 days and one copy per month for 12 months, then deleted |
| Drawings uploaded for take-off (Customer data) | Deleted 90 days after the take-off is signed off, or 90 days after upload if it is never signed off. The Customer can set a shorter period. The counts and kits made from the drawing stay with the Customer's other data. Symbol cut-outs sent for the automatic check are deleted by our AI service provider within 30 days, subject to the exceptions above. |
| Customer Care occupant details (the occupant's name, phone number and access notes, notes of attempts to contact them, and the office's progress notes on the job) | Removed automatically 24 months after the Customer Care job is closed or cancelled. The Customer can choose a different period, from 6 to 120 months. The job, its dates, the work done, photos of the work and the occupant's signature stay with the Customer's other records. |
| Records of who viewed sensitive details (access log) | 12 months, then deleted automatically. |
Customers can set their own retention for data they control; we will support reasonable retention settings.
9. Security
We protect personal data with measures including:
- HTTPS encryption for all traffic to the web app, apps and sign-in service;
- passwords stored only as bcrypt hashes;
- bank details, National Insurance numbers, UTRs and medical information encrypted at rest (AES-256-GCM) with a separate key for each Customer workspace, readable only by the office roles that need them;
- a separate database and file store for each Customer workspace;
- uploaded documents and photos kept in private storage and served only to signed-in users with the right permissions;
- session cookies marked Secure, HttpOnly and SameSite=Lax, signed with per-workspace keys; archived users are signed out immediately;
- a record each time someone views an engineer's bank, National Insurance or tax details or pay rates, views Customer Care access notes, or downloads a person's data. The record holds the viewer's user ID, what was viewed, whose it was, which page or screen it was viewed on, and when. It does not hold IP addresses. The Customer's administrators can see it, and it is deleted after 12 months;
- short-lived app access tokens that can be revoked per device;
- least-privilege access for our staff;
- nightly backups of every workspace database, each checked for integrity and with checksums recorded, and regular test restores.
No system is completely secure. If a personal data breach happens we will act quickly, tell affected Customers without undue delay, and notify the ICO and individuals where the law requires.
10. Your rights
Under UK GDPR you have the right to:
- access your personal data;
- have inaccurate data corrected;
- have data erased;
- restrict how we use it;
- object to processing based on legitimate interests, and to direct marketing at any time;
- data portability;
- withdraw consent where we rely on it;
- not be subject to solely automated decisions with legal or similarly significant effects (we do not make any).
To use any of these rights, email help@apexspark.co.uk. We may need to confirm your identity. We will respond within one month, and can extend this by up to two further months for complex requests, telling you why. We do not normally charge.
If your data is held in the Service by a company you work for or that visited your home, that company is the controller and we will pass your request to it and help it respond.
Deleting an app account. Engineers can delete their own account in the app (More › Delete my account) or on the web (Account), or ask their employer's office. This removes their login and personal details straight away. Their employer keeps the work records it must keep, such as timesheets, hours and pay, shown as "Former engineer" and a number instead of their name, and the employer's office is told.
11. Complaints
Please contact us first so we can try to put things right. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
12. Children
The Service is for businesses and their working staff. It is not aimed at children and we do not knowingly collect data from children. Customers should not create engineer accounts for anyone under 16. Details of a child occupant should only be recorded where needed for the visit (for example an access note), and a child should not be asked to sign a visit report.
13. Changes to this policy
We will update this policy when our practices change and show the new effective date above. We will tell Customers about material changes by email or in the Service before they take effect.