Privacy Policy

Clever Works Ltd (company number 13947390, registered office 128 City Road, London, EC1V 2NX) ("we", "our", "us") is the data controller for the personal data described in this policy. This Privacy Policy (version 2.1, updated 27 September 2026) explains how we collect, use, disclose, and safeguard your information when you visit clever-works.co.uk, contact us, or use our drainage services.

We may collect and process the following data about you:

• Identity Data: first name, last name, and similar identifiers.
• Contact Data: billing address, service address, email address, and telephone numbers.
• Financial Data: bank account details you provide for payment or refunds, and payment records. We do not collect payment card details through our website.
• Transaction Data: details about payments to and from you and other details of services you have purchased from us.
• Job Data: survey footage, photographs, test results, reports and site records created while performing your work. Site photographs and CCTV survey footage may incidentally capture neighbouring property.
• Call Data: recordings and voicemails from calls with our office number, and transcripts generated from them (see section 4).
• Technical Data: limited technical information when you use our website (see section 8 - our analytics are cookieless).

We use personal data for the following purposes, on the following lawful bases:

• Providing a quote or performing your contract (UK GDPR Article 6(1)(b)): responding to your enquiry, preparing and delivering quotations, attending site, producing reports, and managing your account.
• Legal obligations (Article 6(1)(c)): invoicing, VAT and accounting records, and health and safety records.
• Legitimate interests (Article 6(1)(f)): call recording and quality assurance, site photographs and survey footage, cookieless site analytics, service improvement, debt recovery, and establishing or defending legal claims.
• Marketing (Article 6(1)(f) legitimate interests under the soft opt-in, or your consent where required): occasional service emails to existing customers; every message contains an unsubscribe link and you can opt out at any time.

When you call us, or we call you back, calls answered by our team may be recorded; a notice is played before recording starts. Voicemails you leave are also recorded. We record calls for quality assurance, staff training, and to keep an accurate record of instructions, bookings and agreements. Recordings and voicemails may be automatically transcribed by our telephone provider acting on our instructions; providers do not use your data for their own purposes. Recordings are stored securely and kept for up to 12 months from the call date, or longer where needed for a live dispute, complaint or legal claim.

We share personal data with trusted service providers who process it on our instructions: website hosting and cookieless analytics (USA), telephone system and call handling (Twilio Inc., USA), transactional email (Sinch Mailgun, EU servers), database hosting (Neon), secure file storage including reports and call recordings (Infomaniak, Switzerland - a country the UK recognises as providing adequate protection), and accounting (FreeAgent, UK). Where a provider is outside the UK, we rely on the UK International Data Transfer Addendum or, for certified US providers, the UK-US Data Bridge.

We may also share personal data with subcontractors performing your work, with a buyer if our business or its assets are acquired, and where we are under a legal duty to disclose it.

• Enquiries that do not become jobs: up to 24 months.
• Quotes, contracts, survey reports, footage and correspondence: up to 6 years after completion (the limitation period for contract claims).
• Invoices and payment records: up to 6 years, or longer where required by law (HMRC requirements).
• Call recordings and voicemails: up to 12 months.
• Cookieless page-view statistics: stored only as a daily-rotating hash that cannot identify you.

Any record may be kept longer where it is needed for a live dispute, complaint or legal claim, or where the law requires it.

You have the right to request access to, correction of, or erasure of your personal data; to object to or request restriction of processing; to data portability; and to withdraw consent where processing is based on consent (such as optional marketing), without affecting prior processing.

To exercise any right, email us at the address below with enough information to verify your identity. We respond within one month (extendable by two months for complex requests, in which case we will tell you). Exercising these rights is free unless a request is manifestly unfounded or excessive.

You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, or 0303 123 1113. We would appreciate the chance to resolve your concern first.

Our website uses essential storage for secure sign-in, saving your quotation-form draft and remembering your cookie choices. You can send an enquiry and use the portal with optional tracking switched off.

On your first visit, our privacy panel offers Reject optional, Accept optional and individual settings. Optional purposes start switched off. Use Cookie settings in the website footer to change or withdraw your choices at any time. We remember your choices for up to 180 days and ask again if the purposes change.

Essential storage

• Sign-in cookies: set when you sign in to keep the portal secure; removed when you sign out or they expire.
• Quotation draft: answers saved locally in your browser while completing the enquiry form; removed after successful submission or when you clear the draft.
• Cookie choices (cwk_cookie_preferences): a first-party cookie recording your purpose choices, notice version and save time for up to 180 days. It contains no visitor identifier or enquiry details.

Optional website statistics and performance

With permission, our first-party visitor counts, Vercel Web Analytics and Vercel Speed Insights measure public-page visits, enquiry sources and page speed. Our visitor counts use a daily-rotating hash derived from connection information, not a persistent visitor cookie. Vercel receives technical browser and connection information and reports aggregate statistics. We exclude private portal, sign-in and bearer-link pages and do not send enquiry names, contact details, addresses or private tokens to these services. See Vercel Web Analytics privacy information and Speed Insights privacy information.

Optional enquiry history

A first-party, HttpOnly cookie (cwk_recognised_browser) can link this browser’s enquiries, supplied contact details, job addresses, IP/network information and limited visits to quotation and service pages for up to 180 days. Clever Works uses this to understand repeat enquiries and investigate potential misuse. It does not identify a person with certainty. Only a hash of the random browser token is stored in our database. Withdrawal stops recognition and removes browser links; submitted enquiries are retained under the separate enquiry-processing rules in this policy.

We do not use advertising cookies or access other websites’ cookies. Choosing optional cookies is separate from asking us to quote or agreeing to work. Information needed to handle enquiries, protect the service and maintain business records is explained elsewhere in this policy; it is not treated as blanket consent through the cookie panel.

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. We limit access to your personal data to those employees, agents, contractors, and other third parties who have a business need to know.

If you have any questions about this Privacy Policy or our privacy practices, please contact us at:

Email: hello@clever-works.co.uk

Phone: 01252 917235

Clever Works Field is our mobile app for authorised field staff. It supports assigned jobs, inspection records and communication with the office. The controller, lawful bases, retention periods and rights described above also apply to these records.

Sign-in and device information. We use your name, work email, account permissions and a generated device identifier to manage access. Sign-in uses emailed codes. Device registrations include platform information. Security and operational records can include account identifiers, IP addresses, sign-in attempts and upload or synchronisation errors. The app does not offer self-service staff account registration.

Work you record. Depending on the tools you use, records can include notes, site photographs, inspection videos, survey measurements, signatures, tasks, work-calendar entries, receipts, expenses and mileage claims. They are synchronised with company systems and available to authorised staff. Relevant evidence may be included in client reports or sent to recipients you select through the work-request tools. Only record or upload information you are authorised to use for work.

Camera and location. Camera and photo-library access lets you capture or select evidence. With location permission, a position and its accuracy can be attached to evidence, assets and journey start or finish records when you use those features. This is not continuous background location tracking. You can decline or withdraw permissions in your phone settings; features needing that permission may then be unavailable or incomplete.

Phone contacts. Saving a job contact to your phone and importing phone contacts are optional. Before an import, a separate confirmation explains that contacts with a telephone number or email address will be uploaded to the shared Clever Works directory and visible to staff. Cancelling that confirmation does not read your address book. Only import contacts you are authorised to share for work.

Offline storage and uploads. Downloaded jobs, field records and pending uploads are stored on your device for offline use. Queued work is sent when synchronisation is available. Signing out clears cached operational records and the upload queue, so sync work you need to keep first. It does not delete records already uploaded, or photographs and videos saved separately in your phone's Gallery. Uninstalling the app does not delete company records.

Services used to process records. Company-server traffic uses HTTPS. Hosting and processing use Vercel, database storage uses Neon, file storage uses Infomaniak kDrive, and sign-in email uses Mailgun. Approved accounting records may be transferred to FreeAgent. Optional receipt-reading and text-assistance features can send relevant document images or text through Vercel AI Gateway to the configured model provider, including Google, OpenAI or Anthropic, or through an authorised OpenAI connector. Existing office-call recordings may be played in the app; call handling is described in section 4. The current app uses local phone notifications rather than a remote push-notification registration service and does not use an advertising identifier.

Inspection-camera connections. Optional camera tools communicate directly with supported inspection equipment over its local Wi-Fi or USB network. Some equipment uses unencrypted local-network protocols. Use these tools on a trusted camera network. This equipment connection is separate from uploads to our HTTPS company server.

Retention and deletion requests. Uploaded project and accounting records follow the periods in section 6. Account, device and security records are retained as needed to manage access, investigate incidents and meet legal obligations. To ask for access, correction, removal of app access or deletion of app-related personal data, email hello@clever-works.co.uk with the subject "Clever Works Field data request" and your account email. Do not send a password or sign-in code. We verify the request and explain any records that must be retained for legal obligations or live claims. Signing out alone is not a deletion request.

Our staff site-assessment tool offers an optional Google satellite view. It connects to Google only when a staff member selects Satellite. Google receives the map area requested and connection information such as the device IP address and browser details. We do not pass client names, contact details, quotation amounts or payment information to this map. Google's handling of data is described in the Google Privacy Policy, which applies to the Google Maps feature. The OS map can be used without opening the Google view.