Privacy policy

Who is responsible

Allbase Group Ltd is the controller of the personal data collected through roofcheck.co.uk and its client dashboard, my.roofcheck.co.uk. Roofcheck is its trading name, so anything sent through either reaches the same company and the same team.

What is collected

On roofcheck.co.uk, nothing is collected unless you send it, and there are four ways that happens.

• The quote form. Your name, email address and phone number, and your company where you give it; the building’s address and postcode; your role; your answers about the building, the roof, access and timing; and any notes you add.
• The roof outline. Where you draw the roof on the map, its shape is kept as a set of coordinates, with its area and perimeter. It describes a building rather than a person, but it travels with the rest of the request.
• Photographs and documents. Files you attach to a quote request are uploaded from your browser straight to the Allbase platform’s private file store, held on Vercel Blob, and the request points to them. Photos and documents you upload are stored privately, and only the survey team can open them. A photograph can carry its location in its own details, so send only what you are content to share.
• The message form. Your name, email address and message, and your phone number, and your company where you give it.

Each form also sends the page it was sent from, your browser’s name, the time and the IP address your browser connects from. The IP address is what lets the limits on how often a form can be sent apply to one visitor at a time.

When a quote request is sent, the Allbase platform emails a six-digit code and a link to the address you gave, from Roofcheck, so that the address can be confirmed as yours. Only a scrambled (hashed) form of the code is stored, and it is cleared once it is used. Confirming the address opens your client account.

The client dashboard

The client dashboard, at my.roofcheck.co.uk, shows the survey requests you have confirmed by email, with their quotes and reports, and is where you approve a quote. It runs on the Allbase platform and collects the following.

• Your account. It holds the email address and contact details you gave with your quote request, and it opens when you confirm that address with the emailed code. Nothing more is asked for to set it up.
• Sign-in codes. To sign in, you enter your email address, and if it has an account a six-digit code is emailed to it. Only a scrambled (hashed) form of the code is stored, and the code works once, lasts ten minutes, and is cleared when it is used or a new one replaces it.
• Your session. Once the code is accepted, a cookie keeps you signed in on that device until you sign out, for 30 days at most. It holds a random token, and the Allbase platform keeps only a scrambled form of it, with when the session began and when it ends.
• Quote approvals. When you approve a quote, the name of the person approving it, the purchase order number if you give one, and the time the Roofcheck survey terms were accepted, with the web address of those terms, are stored with the quote and are not written over afterwards. The approval is also noted on your survey’s record, and the survey team is told by email.
• Reports. Your survey reports are held privately in the Allbase platform’s file store, and you open or download one through the dashboard once you are signed in.
• Emails. The dashboard emails the address on your account from Roofcheck: a sign-in code when you ask for one, and a note when a quote or a report is ready, with a link to the survey’s page. It sends no marketing.

Asking for a sign-in code, entering one and opening a report also use the IP address your browser connects from, for the limits on how often each can be done.

The dashboard runs no analytics and loads nothing from other sites. The one cookie it sets is listed in the cookie policy.

Why it is collected, and on what basis

Quote requests and messages are handled so that someone can answer them, quote for a survey where one is wanted, and carry it out. The lawful basis is legitimate interests, specifically responding to a request you have made, and the performance of a contract once you approve a quote.

The email code confirms that the address a quote goes to is yours, and opens your client account. The spam check and the limits on how often a form can be sent protect the forms and the people whose addresses could be typed into them, which is a legitimate interest too.

The client dashboard lets you follow your own surveys, approve a quote and open your reports. Its account, sign-in codes and session keep anyone else out of them, which is a legitimate interest, and a quote approval, with the survey and the report that follow it, is part of the contract the approval makes.

Analytics runs only with your consent, and measures the site rather than you. Personal data collected through this site is never sold, and it is not used for profiling.

Who it reaches

Personal data is passed to the following, and to nobody else.

• The Allbase platform Enquiries and accounts At allbase.co.uk, run by Allbase Group Ltd itself. It receives everything the quote form and the message form send, keeps it as a case, sends the email code, and runs the client dashboard at my.roofcheck.co.uk, with your client account, quotes and reports.
• Vercel Hosting Hosts this site and the client dashboard, and runs their server code, in its Dublin region. Every request to either passes through it, with the IP address your browser connects from.
• Supabase Database Holds the Allbase platform’s database, in its Ireland region. Your requests, messages, client account and quote approvals are kept there, with the dashboard’s sign-in codes and sessions in scrambled form.
• Vercel Blob Files Holds the photographs and documents you attach to a quote request, and your survey reports, privately, in the Allbase platform’s own file store. Your browser uploads each attachment to it directly, and only the survey team can open them. You open a report through the client dashboard, once you are signed in.
• Vercel Web Analytics and Speed Insights Analytics Count page views and measure page loading on this site, only if you allow analytics. They receive the path of the page and any campaign tags on its address, never anything typed into a form. The client dashboard runs neither.
• Cloudflare Turnstile Spam check Checks that a person is sending the quote form or the message form. It runs in your browser on each form’s last step, and this site’s server sends Cloudflare the check’s result and your IP address to confirm it.
• Mapbox Maps Draws the roof maps on the quote form and the roof measurement tool, and the map on the contact page, only if you allow it. It receives the address you enter, to find the building on the map, and the roof maps send it an anonymous ID it counts map loads with.
• Upstash Rate limiting Keeps the counts that limit how often the forms can be sent, a dashboard sign-in code asked for or entered, and a report opened. Each is counted by IP address, and by email address too, in a scrambled (hashed) form for the quote and message forms and as the address itself for the dashboard’s sign-in. Each count lasts at most two hours.
• Resend Email Delivers the emails sent from Roofcheck: the email code for a quote request, and the client dashboard’s sign-in codes and its notes that a quote or a report is ready. It also delivers the notes that tell the survey team about a quote approval and, if a request cannot reach the Allbase platform, a copy of it to the sales inbox, so that nothing is lost.
• Ideal Postcodes Address lookup Suggests addresses as you type the building’s address into the quote form, and completes the one you pick. This site’s server sends it what you type and the address you choose, and nothing else about you.
• postcodes.io Address lookup Finds where a postcode is, to place the building on the map. This site’s server sends it the postcode alone.

Survey details are shared only with the surveyor who carries out the survey.

Some of these services are run from outside the UK. Where personal data leaves the UK, it is protected by the safeguards UK law requires.

How the maps and the analytics are held back until you allow them is in the cookie policy.

How long it is kept

• A quote request, with its roof outline, photographs and documents, and the quotes that follow it, is kept for as long as the enquiry is live, and then for six years from the last contact, which is the period in which a claim about the survey could still be brought.
• Survey reports, and the record of each quote’s approval, are kept for 15 years.
• A message that goes no further is kept for two years.
• The email code is kept only in its scrambled form, with the request, and is cleared once it is used.
• A client account is kept for as long as it stays open, and then for six years from the last contact.
• A dashboard sign-in code is kept only in its scrambled form, and is cleared when it is used or a new one replaces it.
• A dashboard session ends when you sign out, which deletes its record, or after 30 days, and the record of one that has run out is deleted when you next sign in.
• A photograph or document uploaded to a quote request that is never sent is deleted automatically after seven days.
• The counts that limit how often a form can be sent, a sign-in code asked for or entered, or a report opened, are kept for at most two hours.
• Server logs are kept for a short operational period and then discarded.

What the quote form keeps in your own browser, and for how long, is in the cookie policy.

Your rights

Under UK data protection law you can ask for any of the following.

• A copy of the personal data held about you.
• Correction of anything inaccurate.
• Deletion, where there is no longer a reason to keep it.
• Restriction of how it is used, or an objection to that use.
• A portable copy, where you provided it and it is handled by automated means.

Ask by writing to privacy@allbase.co.uk. Every request is answered as UK data protection law requires. If the answer is unsatisfactory, the Information Commissioner’s Office is the regulator to approach, at ico.org.uk.

Getting in touch

Questions about this policy go to privacy@allbase.co.uk, or by post to Allbase Group Ltd, Cutter Mill, Tileyard North, Wakefield, WF1 5FY.