Privacy policy

This policy explains how FHBM LIMITED (“FortyFive”, “we”, “us”) collects and uses personal data when you visit fortyfive.work, contact us, meet us at an event or use the FortyFive platform. It is written to meet the UK GDPR, the Data Protection Act 2018 and, where it applies, the EU General Data Protection Regulation (GDPR).

Who we are

FHBM LIMITED is a company registered in England and Wales under company number 17531601, with its registered office at c/o Azets, Victory House, Vision Park, Histon, Cambridge CB24 9ZR, United Kingdom. We are the controller of the personal data described in this policy, except where we say otherwise below.

Contact for data-protection questions: [email protected].

When we are a processor

When a business uses the FortyFive platform to manage its field work, that business decides what job data is collected and why. For that operational data (jobs, site details, evidence, approvals) the business is the controller and FortyFive acts as its processor under a data processing agreement. If your data is on the platform because a business commissioned work from you or on your behalf, that business’s privacy notice also applies, and you can ask it about your data.

What we collect

When you visit the website. Our hosting and security providers process technical data such as IP address, browser type and request times to deliver the site and protect it from abuse. We measure visits with Plausible Analytics, which sets no cookies and stores no personal data, and, only if you accept analytics cookies, with Google Analytics 4 (legal basis: consent). See our cookie notice.

When you contact us or meet us. Your name, business contact details, organisation, role and what you tell us, whether by email, at an event or in a meeting.

When we send you business updates. Your business email address, name and organisation, and whether you open our emails or click links in them, so we can keep our list relevant. You can unsubscribe at any time.

When you use the platform. Depending on your role:

• account details: name, business contact details, organisation, role, login and security information;
• for engineers and delivery partners: business and identity details, skills, certifications, insurance and right-to-work documents where a customer requires them, availability, ratings and job history;
• delivery records: photographs, test results, notes, signatures, times and device location captured as part of evidence of work on site;
• commercial records: rates, approvals, invoices and payment details needed to bill and pay for work.

Why we use it and our legal basis

Purpose	Legal basis
Answering enquiries and arranging meetings	Legitimate interests in responding to businesses that contact us
Sending business updates about FortyFive	Legitimate interests (business contacts), or consent where the law requires it
Providing the platform and supporting users	Performance of our contract with you or your organisation
Verifying engineers and delivery partners	Legitimate interests of FortyFive and its customers in a reliable, safe service; legal obligation where checks are required by law
Billing, payments and record keeping	Contract and legal obligation (tax and accounting)
Security, fraud prevention and improving the service	Legitimate interests in operating a secure, reliable service

Location and evidence data captured on site is used to record what was done, where and when. We do not use it to track people outside the jobs they accept.

Who we share it with

• Businesses on the platform, as needed for the work: a business commissioning work sees the profile and delivery record of the people carrying it out, and they see the job details they need.
• Service providers who host and operate our systems for us, listed on our sub-processors page.
• Finance partners, only when payment or financing services are introduced and you or your organisation choose to use them.
• Professional advisers, insurers, and authorities where required by law or to establish or defend legal claims.

We do not sell personal data.

International transfers

Some of our providers process data outside the UK and the European Economic Area. Where they do, we rely on an adequacy decision or put in place appropriate safeguards, such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses.

How long we keep it

We keep enquiry and contact data for up to 24 months after our last contact, unless a business relationship follows. Platform account data is kept while the account is active. Delivery and commercial records are kept for as long as the commissioning business requires and as needed for tax, accounting and legal claims, typically six years after the end of the relevant contract. Delivery records are tamper-evident: corrections are recorded rather than overwritten, which affects how erasure requests are handled for records that others rely on.

Your rights

You can ask to access, correct or delete your personal data, to restrict or object to its use, and to receive a copy of data you provided in a portable format. Where we rely on consent, you can withdraw it at any time. Email [email protected]. We will respond within one month.

You can also complain to a supervisory authority: in the UK, the Information Commissioner’s Office (ico.org.uk); in the EU, the authority in the country where you live or work.

Security

We protect personal data with access controls, encryption in transit and separation of each customer’s data from every other customer’s. No system is completely secure; if we become aware of a breach that affects you, we will tell you and the relevant authority as the law requires.

Changes

We will update this policy as FortyFive and its services develop. The date at the top shows the latest version.