Privacy Policy

OHMLEY is job management and site reporting software for UK electrical contracting companies. It is operated by OHMLEY LTD, a company registered in England and Wales with company number 17416512, whose registered office is at 9 St. Andrews Park Road, Tunbridge Wells, England, TN4 0NL.

Privacy enquiries and data rights requests: support@ohmley.com. Security matters: support@ohmley.com. Everything else: support@ohmley.com. We aim to acknowledge every privacy enquiry within 5 working days.

We are the controller when you visit our website, enquire about OHMLEY, create an account, contact support, or when we manage our own billing, security and audit records.

We are a processor for the operational records your employer (our customer) puts into OHMLEY — jobs, reports, diaries, photographs, signatures and similar. Your employer is the controller of those records and decides how they are used and how long they are kept. We only act on their documented instructions, under our Data Processing Agreement.

• Account data: name, work email address, work mobile number (verified by code so we can reach you about live jobs and confirm it is really you), employer, job role, access level (engineer, manager or admin), permissions, invitation records, sign-in activity and email verification status.
• Employment details recorded by your employer inside OHMLEY: job title, department, team, who you report to and an internal payroll or employee reference, used to route approvals and identify who did what on site records.
• Business details of the customer company: legal and trading name, registered office, company number, VAT number, industry and approximate size.
• Your marketing choices: separate opt-ins for product emails and SMS, each recorded with the date so we can show what you agreed to.
• Pseudonymised product usage events (which features are used, and when) recorded against your company rather than a named person, so we can see what is adopted and what needs work.
• Operational records created in the app: jobs, sites, client and project references, site reports, site diaries, Safe Start records, quality inspections, snags and defects, plant and calibration records, drawings and documents.
• Photographs and uploaded files, which may incidentally show people, vehicles or registration plates.
• Signatures, signatory names, IP address and timestamps captured on documents, reports and job sign-offs, kept as evidence that a document was signed.
• Audit and delivery records: who did what and when, email delivery status and failures, client link opens and invitation acceptances.
• Voice notes and the resulting transcript where an engineer chooses to use the optional voice-to-report feature.
• Support correspondence and anything you choose to tell us in it.
• Technical data needed to serve the app securely: IP address, browser and device type, and security logs held by our hosting and authentication providers.
• Billing and subscription data for the customer company: plan, seat counts, contact and invoicing details.

We do not ask for special category data (such as health or trade union data) and OHMLEY is not designed to hold it. If your employer needs to record such data, it must have its own lawful basis and appropriate condition for doing so.

OHMLEY is business software. We do not knowingly collect data about anyone under 18 and accounts must not be created for children.

• To provide, host and support the service — performance of a contract with our customer, and our legitimate interests in serving that customer's users (Article 6(1)(b) and 6(1)(f)).
• To create and secure accounts, verify email addresses, prevent unauthorised access and maintain audit trails — legitimate interests in the security and integrity of the platform, and legal obligation where an incident must be recorded and reported (Article 6(1)(f) and 6(1)(c)).
• To send service communications such as reports, sign-off notices, document reminders and invitations — performance of a contract and legitimate interests. These are not marketing and cannot be switched off while you hold an account.
• To handle support requests, investigate faults and improve the product, including pseudonymised feature-usage measurement that does not identify you — legitimate interests (Article 6(1)(f)).
• To verify a mobile number by one-time code — performance of a contract and legitimate interests in account security. The code and its hash are deleted once used or expired.
• To take payment and keep accounting records — performance of a contract and legal obligation.
• To place optional cookies or similar storage, and to send any marketing emails to prospects — consent, which you can withdraw at any time (Article 6(1)(a) and PECR).
• To comply with the law, respond to lawful requests, and establish, exercise or defend legal claims — legal obligation and legitimate interests.

Where we rely on legitimate interests we have considered the effect on you and concluded our interests are not overridden by your rights. You can object at any time using the contact details above and we will explain the outcome.

• Customer operational records (jobs, reports, photographs, forms): kept for as long as the customer's account is active, or for the retention period the customer sets in OHMLEY (Governance → Retention), whichever is shorter. Electrical, safety and construction records often need to be kept for long periods — each customer sets its own period.
• After a customer account closes: data is deleted or returned within 90 days, unless the customer asks for it sooner or the law requires us to keep it longer.
• Account and profile data: kept while the account is active and for 12 months after it is deactivated, so access questions and disputes can be resolved.
• Deletion requests: held for the 30-day grace period, then actioned; a record that the request was made and completed is kept for 6 years.
• Security, audit and email delivery logs: 12 months.
• Cookie consent records: 12 months, so we can show what was agreed.
• Billing and accounting records: 6 years after the end of the relevant financial year, as required by UK tax law.
• Support correspondence: 24 months.

When a period ends we delete the data or irreversibly anonymise it. Backups roll off on their own cycle and are never restored to bring deleted data back into live use.

We never sell personal data and we do not share it for advertising. We use the following service providers (sub-processors), each bound by a written contract and acting only on our instructions:

available on request The current list of hosting, database, file storage, email delivery and AI providers is published on the Legal notice page and in the DPA. We do not name providers we have not actually engaged.

We may also disclose data to our professional advisers, to insurers, to law enforcement or regulators where we are legally required to do so, and to a buyer or successor if the business or part of it is transferred — in which case we will tell affected customers.

OHMLEY includes optional AI features, such as turning a spoken site note into structured report text. When someone uses one, the content they submit is sent to our AI provider, Lovable AI Gateway (Google Gemini models), processed, and the result is returned to the app. We send only the content needed for that task, we do not send your contact details, and content submitted through these features is not used to train third-party models under the provider terms we operate on. AI output can be wrong and must always be checked by a competent person before it is signed or issued.

Passwords are handled by our authentication provider using industry-standard hashing and are never stored in the application database. Data is encrypted in transit (TLS) and at rest. Access is controlled by role and permission and enforced at database level by row-level security, so one company cannot reach another company's records. Uploaded documents and photographs are held in private storage and served only through short-lived authorised links. Significant actions are written to an audit trail. See the Security page for a fuller description, including what we do not yet claim.

If a personal data breach occurs that is likely to result in a risk to people's rights, we will report it to the ICO within 72 hours of becoming aware of it, and will tell affected customers without undue delay.

Our primary hosting region is United Kingdom (London). Some providers may process limited data (for example email delivery metadata or AI request content) outside the UK. Where that happens we rely on UK adequacy regulations, or on the UK International Data Transfer Agreement or the EU Standard Contractual Clauses together with the UK Addendum, supported by a transfer risk assessment. The mechanism used for each provider is listed with the sub-processor list in the DPA.

• Be informed about how your data is used — this policy.
• Access a copy of your personal data.
• Have inaccurate or incomplete data corrected.
• Ask for erasure where the law allows it.
• Ask us to restrict how we use your data.
• Object to processing based on legitimate interests, and to direct marketing at any time.
• Data portability, where processing is by consent or contract and carried out by automated means.
• Withdraw consent at any time where we rely on it — for example optional cookies — without affecting earlier processing.
• Not be subject to a decision based solely on automated processing with legal or similarly significant effects. OHMLEY does not make such decisions.

We respond within one month, which can be extended by two further months for complex requests — we will tell you if that applies. There is no charge unless a request is manifestly unfounded or excessive. We may ask you to verify your identity first.

If your data sits in your employer's OHMLEY workspace, please contact them first: they are the controller of those records. We will support them in responding. Requests to us go to support@ohmley.com.

Please contact us first so we can put things right. You also have the right to complain to the Information Commissioner's Office: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, ico.org.uk. Complaining to the ICO does not affect any other legal remedy you may have.

This policy is versioned. When it changes materially we update the version number and effective date shown at the top, keep the previous version on record, and where appropriate ask users to acknowledge the update the next time they sign in. Minor clarifications may be made without notice.