Privacy policy

1Who we are

My Van Stock is a stock control web app for alarm, CCTV and access control installers. It is run by [business name], [registered address], [company number, if a limited company].

For anything in this policy, email [[email protected]]. Our registration number with the Information Commissioner's Office (ICO) is [ICO registration number].

2Who is in charge of your data

Each company that uses My Van Stock (our "customer") has its own portal at myvanstock.co.uk/their-name.

• The company is the data controller for everything in its portal. It decides who gets a login, what is recorded and how long it's kept.
• We are the data processor. We only use that data to run My Van Stock for the company, on its instructions, under a data processing agreement with it.
• We are the controller for a small amount of our own business information: contact details for the people we deal with at each customer (for setup, billing and support), and emails people send us.

If you use your company's portal as an engineer or in the office, your employer's own privacy notice for staff should explain why it uses My Van Stock. Questions about your data in a portal are best sent to your employer first. We'll help them answer.

3What we hold

Company details

Company name, portal web address, email domain, logo, brand colour, the address that stock emails go to, and which stock alerts are switched on.

Staff names and logins

First and last name, username (first.last), the login email address made from it, role (admin, engineer or no access), which van the person is assigned to, their password (hashed, see section 6), and whether they've replaced their starting password yet.

Stock and job records

Vans and stores (names and registrations), products, part numbers, barcodes, suppliers and costs, and how many of each item is on each van. Every stock movement is recorded with who made it and when, along with the job reference typed in when stock is used. Stock requests and any note sent with them are kept too.

Technical information

When you use the site, our providers record standard technical details such as your IP address, browser type and the time. These are used to keep the service secure and to fix problems.

What we don't hold

• Camera pictures. Barcode scanning happens on your phone. Pictures from the camera aren't sent to us.
• Card details. [How customers pay, and who handles the payment.]
• Your customers' details. Job references and notes are free text, so we ask companies not to put their own customers' names, addresses, phone numbers or alarm codes in them. A job number is enough.

4What we use it for

• Running the service: signing people in, showing each person the right stock, recording movements, and sending stock request and stock alert emails.
• Keeping it secure: stopping misuse, keeping each company's data separate and investigating problems.
• Support: we look at a company's stock data only when we need to, to answer that company's support request or fix a fault. The My Van Stock platform admin page doesn't show any company's stock.
• Our own customer relationship: setting companies up, billing them and telling them about changes to the service.

We don't sell data, use it for advertising, or share it with anyone other than the providers in section 5. For our own business information, we rely on our legitimate interest in running and protecting the service and on our contract with each customer. Each company decides its own lawful basis for the data in its portal.

5Where it's stored and who helps us

Some of these providers are based in, or have staff in, the United States. Where data may leave the UK, it's covered by the provider's data processing terms and the safeguards UK law approves, such as the UK International Data Transfer Addendum or the UK–US data bridge. [Solicitor to confirm the safeguard for each provider.]

We'll tell our customers at least [30 days] before we add or change a provider that handles portal data, so they can object.

6How we keep it secure

• Hashed passwords. Supabase stores passwords scrambled (hashed). Nobody can read them, including us. If someone forgets theirs, their office resets it. We can't look it up.
• One-time starting passwords. Every new person, and every password reset, gets their own random starting password. It's shown once, to the person who set it up. It works once and stops working after 7 days.
• Nothing visible until changed. Someone signed in with a starting password can't see any data until they've chosen their own. The database enforces this, not just the screen.
• Strong chosen passwords. At least 10 characters, nothing containing the person's own name or the company name, and common passwords are refused.
• Each company kept separate. Every record is tied to its company, and the database's own security rules only return a company's records to that company's logins. Engineers only see their own van. Admins can't see anything belonging to another company.
• Resets sign people out. Resetting someone's password signs them out on every device.
• Encryption. Everything travels over an encrypted (HTTPS) connection, and Supabase encrypts stored data.

If we find a security breach affecting a company's data, we'll tell that company without undue delay, and within [24 hours], with what we know. That gives it time to meet its own duty to report to the ICO within 72 hours.

7How long we keep it

• While a company uses My Van Stock, we keep its data so the app works. Stock history builds up over time, so the company can look back at what was used on each job. A company can ask us to delete history older than a date it chooses.
• When someone leaves, a company admin can set them to "No access", which stops them seeing anything straight away. To remove a person's login and name completely, the company asks us and we do it within [30 days]. Their past stock movements then show as "Removed user".
• Starting passwords stop working after 7 days.
• When a company stops using My Van Stock, it can download its stock, products and history as spreadsheets from Setup → Export. We delete its portal, logins and records within [30 days] of the agreement ending, unless the law requires us to keep something. Backups containing it are overwritten within a further [7 days].
• Technical and email logs are kept by our providers for their standard periods, usually [a few weeks].
• Our own business records, such as invoices, are kept for [6 years] because UK tax law requires it.

8Cookies and storage on your device

We don't use advertising or tracking cookies, and we don't run analytics.

The app keeps your sign-in in your browser's storage so you stay signed in. It also remembers a few things to save you time: the tab you were on, the van you were working on, how you last sorted the stock list and the last job reference you typed. These are needed for the app to work as you'd expect, so we don't ask for consent. Signing out removes your sign-in.

9Your rights

Under UK data protection law you can ask to see the personal data held about you, have it corrected or deleted, limit or object to how it's used, and get a copy to take elsewhere.

• For data in a company portal, ask your employer, because it is the controller. If you contact us instead, we'll pass your request to them (with your permission) and help them answer.
• For our own business information, email [[email protected]]. We'll reply within one month.

You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd be grateful for the chance to put things right first.

10Changes to this policy

We'll post any changes on this page and update the date at the top. If a change affects how a company's data is handled, we'll email that company's admins before it takes effect.

11Contact us

[Business name], [address].
Email [[email protected]].

See also our terms of use.