Privacy Notice

Who we are

Foresight is a client portal operated by Validity Global ("Validity", "we", "us", "our") for the management of construction project risk, programme and cost information. This notice explains how we collect, use, store and protect personal data when you use the portal, in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

What data we collect

We collect and process the following categories of personal data:

• Account details: your name, work email address, role, and company/organisation.
• Authentication data: a securely hashed password, and records of sign-in activity (including timestamps and IP address) used to protect your account.
• Usage data: actions you take within the portal, such as creating, updating or commenting on tracker items and projects, and notification preferences.
• Time in the portal: how long you actively spend in each area of the portal (for example the 4D model, the tracker or files) and on which project, kept as daily totals. We do not record a history of individual pages, clicks or keystrokes.
• Communications: emails we send you relating to your account, project activity, or notifications you've subscribed to.

We do not knowingly collect special category data (e.g. health, religion, ethnicity) through the portal.

How we use your data

We use personal data to:

• provide you with access to the portal and the projects you're associated with;
• operate core features such as risk tracking, notifications, audit logging and reporting;
• maintain the security of the platform: for example, detecting suspicious sign-in activity and preventing unauthorised access;
• communicate with you about your account or project updates;
• understand which parts of the portal are being used, so we can support you and improve the service; and
• meet our legal and contractual obligations to you and to the organisation you represent.

Our lawful bases for this processing are performance of a contract (providing the service you or your organisation has engaged us to deliver), our legitimate interests (keeping the platform secure and improving our service), and compliance with legal obligations where applicable.

How long we keep it

We retain account and project data for as long as your organisation has an active engagement with Validity, and for a reasonable period afterwards to meet legal, accounting, or contractual record-keeping requirements: typically up to 7 years following the end of a project, in line with standard construction-industry retention practice. Sign-in and security audit logs are retained for up to 12 months, and time-in-portal totals for up to 13 months. Where data is no longer required, it is securely deleted or anonymised.

Who we share it with

We do not sell personal data. We may share data with trusted service providers who process it on our behalf (such as hosting, email delivery, and file storage providers), under appropriate data processing agreements, and only to the extent necessary to provide the service. We may also disclose data where required by law or to protect our rights, property, or safety, or that of our users.

Your rights

Under UK GDPR, you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request erasure of your data, where applicable;
• object to or restrict certain types of processing; and
• request a copy of your data in a portable format.

To exercise any of these rights, or if you have a question or concern about how your data is handled, please contact us using the details below. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

How we protect your data

We apply technical and organisational measures appropriate to the risk, including encrypted connections, hashed passwords, role-based access controls, audit logging, account lockout after repeated failed sign-in attempts, and regular review of our security practices.

Contact us

If you have any questions about this notice or how your data is handled, please contact our data protection lead at privacy@validity.global.