Home » Subcontractor Data Notice

Subcontractor Data Notice

Total Cladding and Roofing Ltd
Effective date: 1 November 2026

This notice explains how Total Cladding and Roofing Ltd (“TCR”, “we”, “us”) handles the information that clients and subcontractors give us through our portal at app.scopeflow.us/pm/portal/tcr-uk, and the information we gather when we check subcontractors’ documents. Where it is about a person, such as a sole trader, a contact or someone named on a trade card, it is personal information under UK data protection law (the UK GDPR and the Data Protection Act 2018). This notice adds to our Privacy Policy, which covers our website and our customer communications. Our Subcontractor Portal Terms of Use set out the rules for using the portal. Although this page and those terms say “Subcontractor” in their names, both cover everyone who signs in to the portal, clients as well as subcontractors.

1. Who is responsible for your information

Total Cladding and Roofing Ltd (company number 13436132), Unit 7 Westmead Trading Estate, Westmead, Swindon SN5 7YS, is the controller of the information described in this notice. You can reach us at info@tcandr.co.uk or 020 4652 9219.

2. What we collect

First, what we collect from subcontractors. What we collect from clients follows it.

Your business and contact details: company name, contact name, email address, and your phone number and website if you give them.
Your work: your trades, your base location and the regions you cover.
Your documents: your public liability and employer’s liability insurance certificates or schedules; your Unique Taxpayer Reference (UTR) and CIS registration details; and any optional documents you add, such as CSCS, IPAF, PASMA or SMSTS cards for the people you send to site (which can show their name, photo and card number), a sample method statement and your health and safety policy.
What is read from your documents: the document type, issuer, insured name, policy number, limits and dates; for insurance, also the insurer, the business activities the policy covers and any exclusions; and any corrections you make before you confirm them.
How you found us: the trade you picked on our website’s subcontractors page, if you started there.
Sign-in and security records: the email address each sign-in request was for, its date and time, and the internet (IP) address it came from. The portal sets a cookie that keeps you signed in for up to 30 days, may set one that remembers your language setting, and, when you use the Client & subcontractor login box on our website, sets one that holds the email address you typed for 20 minutes so that the portal’s “Check your email” page can show it. All are needed for the portal to work; the portal does not use advertising or analytics cookies.
Price requests: the jobs we invite you to price, whose documents you can see in the portal; whether you accept or decline each one, and any reason you give; the price, notes and quote file you send, with their earlier versions, which we hold with the rest of your record; and the outcome.
Messages: the messages you and our team send each other in the portal, who wrote each one and when, and whether it has been read. They are kept in the portal with your record. When we write you a message, our email tells you only that a message is waiting; you read it in the portal. Emails telling you that we declined a document or an application, or put your account on hold, include our note.
Contracts you sign online: the contracts we send you in the portal and when you first open each one. When you sign one, we keep with a signed copy of it the name and position you type, the email address you signed in with, the date and time, and a fingerprint (a SHA-256 code) of the copy you read and of the signed copy, which shows that neither has changed since.
The people on your crew: if you list them in the portal, or our team adds them for you, each person’s name and trade, and their email address and phone number if given; photos of their cards (such as CSCS, IPAF or PASMA cards), what is read from each card, and our team’s check of it; and, at our sites, when each person signs in, the site rules they read and sign at their induction on our site manager’s phone or tablet, and the reason our site manager gives if someone is let in without every card in date. Each of them can use the rights in section 9 for their own information.
Our own records: our review decisions, the result of the automatic insurance check and its reasons (section 4), the notes we write when we decline a document or an application or put your account on hold, the reminders we send you, the jobs you work on, and our CIS verification and payment records.

If we invite your business to price a job before you have applied, we set up your portal record from the details we already hold (your company name, contact name and email address), so that you can sign in and reply.

If you are a client (someone at a business we have sent a quote to, or someone our team has added to a job), we collect:

Your contact details: your name, email address and company, and your phone number if you or our team give it. We hold your email address because we sent a quote to it, or because a member of our team added you to a job.
Your access: which quotes and jobs you can see, whether a quote sent to you or a member of our team gave you access, any request you make for access to a job and whether we agreed to it, and when you last signed in.
Your quotes: the quotes we sent you, every version of each one, the documents sent with them and our message that went with each.
Your answers: your answer to a quote (accept it, accept it subject to contract, or ask for changes), the wording you confirmed, any question you ask, and the date and time of each.
Your contracts: the contracts we send you in the portal, the ones you upload for us to sign, and when you first open each one. When you sign one, we keep with a signed copy of it the name and position you type, the email address you signed in with, the date and time, and a fingerprint (a SHA-256 code) of the copy you read and of the signed copy, which shows that neither has changed since.
What we show you: the approved risk assessments and method statements (RAMS) for your job and the site photos our team chooses to show you.
What you open: a record, for our team, of your answers and of which quotes and documents you open and when.
Sign-in and security records: you sign in with a one-time link or a 6-digit code we email to you. We keep the same sign-in and security records, and set the same cookies, as for subcontractors (above).

3. How we use it, and why we are allowed to

To review your application and check that your insurance and other documents are valid and current, so that we only appoint subcontractors with the skills, knowledge, experience and cover the work needs. We do this to take the steps you ask for before entering into a subcontract, in our legitimate interest in working safely with competent businesses, and to meet our duties under the Construction (Design and Management) Regulations 2015.
To verify you with HMRC under the Construction Industry Scheme, make the deductions HMRC tells us to and keep the CIS records the law requires. This is a legal obligation.
To decide whether to offer you work: to call or email you about jobs that fit your trades and regions, to invite you to price jobs through the portal, where you can see each job’s documents, and to compare the quotes we receive and award the work. This is to enter into and carry out subcontracts with you, and in our legitimate interests.
To send you messages about your application, your documents and our work together, and to read and answer yours. This is to take the steps you ask for before entering into a subcontract, to carry out subcontracts with you, and in our legitimate interests.
To send you contracts to read, download and sign online, and to keep a record of who signed each one, when and what they signed. This is to enter into and carry out subcontracts with you, and in our legitimate interest in being able to show what was agreed.
To check that the people you send to our sites hold the cards their trade needs, and to sign them in and take them through our site rules at each job. This is in our legitimate interest in keeping our sites safe, and to meet our duties under the Construction (Design and Management) Regulations 2015.
To remind you before a document expires, in our legitimate interest in keeping your cover current.
To show our clients, main contractors and insurers that the businesses working on their jobs are insured and trained, when a job requires it, in our and their legitimate interests.
To keep the portal secure, prevent misuse and keep a record of what was confirmed and when, in our legitimate interests.

For clients, we use it:

to send you our quotes and every new version, show them to you in the portal, take your answers and follow them up with you. This is to take the steps you ask for before entering into a contract, and in our legitimate interest in running our business and keeping you informed;
to send you contracts to read, download and sign online, to take contracts you upload for us to sign, and to keep a record of who signed each one, when and what they signed. This is to enter into and carry out contracts with you, and in our legitimate interest in being able to show what was agreed;
to show you the approved RAMS and site photos for your job, to carry out our contract with you; and
to let our team see which quotes and documents you have opened and what you answered, so that they know where each quote stands and can reply to you, in our legitimate interests.

We do not sell your information or share it for advertising, and we do not use it to send you marketing.

4. How documents are read and checked automatically

When you upload a document, or a photo of a crew member’s card (with that person’s name), the portal sends it to Anthropic, the company that provides the Claude artificial intelligence service, which reads the document type, issuer, policy number and dates so the form fills itself in. You check and correct what was read before you confirm it, and a member of our team checks every card.

We also check your public liability and employer’s liability insurance automatically. The portal sends each of those documents to Anthropic again, with your company name, the trades you told us and the minimum cover we require for that kind of insurance. Anthropic only reads the document. The portal’s own rules then compare what was read with our insurance requirements:

the named insured is your business;
the policy dates show it is in force;
the limit of cover is at least our minimum for that kind of insurance;
the insurer is named;
the policy covers the trades you told us, with no exclusion that applies to them;
the document could be read clearly;
nothing suggests a quotation, a cover note or an altered document; and
what you typed agrees with what was read.

A document that meets every requirement may be approved automatically, and once every document your application needs is approved, your application may then be approved automatically. The automatic check never declines an application or sends a document back. Anything it cannot approve, including when the check cannot run, is reviewed by a member of our team, and all other documents are approved only by a member of our team. We keep a record of each automatic approval and its reasons with your record. If you think the automatic check got something wrong, email us at info@tcandr.co.uk and a member of our team will look at it again.

Anthropic processes what we send only to return its reading to us. It does not use it to train its models, and it deletes it within 30 days unless it holds it longer for a safety review. We do not send clients’ quotes, contracts or other documents to Anthropic.

5. Who we share it with

Our software and service providers, who handle your information on our behalf and only to provide their service: ScopeFlow, the project management and customer relationship management software in which we keep your record and documents, and your price requests and quotes (and, for clients, the quotes we send you, your answers and your contracts), and the cloud hosting and database providers it runs on; Anthropic, for reading and checking documents (section 4); Resend, which delivers our emails; and Google, whose Maps service suggests addresses as you type and shows your base and regions on a map.
Insurers and brokers, ours and yours, when we confirm your cover or deal with a claim.
Our clients, main contractors and their insurers, when a job requires proof that the businesses working on it are insured or trained. We share only what that job needs, such as an insurance certificate, and never your UTR.
HMRC and other authorities, for the Construction Industry Scheme and our tax returns, and anyone else when the law requires it or when it is needed to protect the rights, property or safety of our workers, clients or others.
A buyer or successor, if all or part of our business is sold or reorganised. They must handle your information as this notice describes.

6. Where it is stored

Your record and documents are hosted in the United States, and some of our service providers store or process information there. Where information leaves the UK, we rely on the safeguards UK data protection law requires, such as the UK’s International Data Transfer Addendum or the UK Extension to the EU–US Data Privacy Framework.

7. How long we keep it

While you are on our list (applying, approved or on hold), we keep your record and documents and ask you to renew the ones that expire. When you renew a document, we keep the earlier one with your record, so we can show what cover was in place on a given date.
CIS verification and payment records: for at least three years after the end of the tax year they relate to, as HMRC requires.
Records for jobs you worked on (the documents that applied while you were on the job): for up to six years after the job is finished, or twelve where the subcontract was signed as a deed, the periods in which claims about construction work can usually be brought in England and Wales.
Clients: we keep the quotes we sent you, your answers and your contracts, with a signed contract and its record, with our records of the job, for the period in the point above. When our team removes your access, or you ask us to, you can no longer sign in to that job.
Price requests and your quotes: for a job you are awarded, with the records for that job, for the period for records for jobs above; for a job you are not awarded, with your record while you are on our list.
Messages: with your record while you are on our list; messages about a job you worked on, with the records for that job.
Contracts you sign online: the signed copy and its record, with the records for that job.
The people on your crew: each person’s details and cards while they are on your crew list and you are on our list; their sign-ins and inductions at a job, and the cards that applied then, with the records for that job.
Declined and unfinished applications: deleted, with their documents, within 12 months of our decision or your last activity, unless the law requires us to keep something longer.
When you ask us to remove you: we delete your record and documents within one month, except anything we must keep under the points above, which we delete when that period ends.
Sign-in links and codes stop working after 20 minutes or once used. We keep the record of each sign-in request for security.

8. How we protect it

Your information is kept in our ScopeFlow account, separated from every other company’s information, and only members of our team who sign in to that account can see it. Documents are stored privately and open only through links that expire within minutes. Information travels over encrypted (HTTPS) connections, and sign-in codes and session keys are stored only in scrambled (hashed) form. No system is perfectly secure, so tell us at once if you think your account has been misused.

9. Your rights

You can see and update your details and documents in the portal at any time.
You can ask us for a copy of the personal information we hold about you, and ask us to correct it, delete it (subject to section 7), restrict or object to our use of it, or give it to you in a format you can reuse. Email info@tcandr.co.uk from the email address on your account. We may ask you to confirm the request, and we will respond within one month.
You can tell us at any time that you no longer want to be contacted about work.

If you are unhappy with how we have handled your information, please tell us so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113).

10. Changes to this notice

We may update this notice. The effective date at the top shows when it last changed. If a change is significant, we will tell you by email or in the portal.

11. Contact us

Total Cladding and Roofing Ltd
Unit 7 Westmead Trading Estate, Westmead, Swindon SN5 7YS
info@tcandr.co.uk
020 4652 9219