Privacy Policy

Railston & Company Ltd ("we", "us", "our") operates the Collabaro platform. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our website and services.

1. Information We Collect

Information you provide

We collect information you provide directly, including:

• Name, email address, phone number, and company details when you register or contact us
• Timesheet data, GPS coordinates, photographs, and checklist responses submitted through Collabaro Field
• Project and financial data entered into Collabaro Desk
• Communication records when you contact our support team

Information collected automatically

When you use our platform, we may automatically collect:

• Device information (type, operating system, browser)
• IP address and approximate location
• Usage data including pages visited and features used
• Cookies and similar tracking technologies (see our Cookie Policy)

2. How We Use Information

We use your information to:

• Provide, maintain, and improve the Collabaro platform
• Process timesheets, generate reports, and manage project workflows
• Communicate with you about your account, updates, and support requests
• Ensure the security and integrity of our services
• Comply with legal obligations and enforce our terms
• Analyse usage patterns to improve user experience

We process your personal data on the following lawful bases: performance of a contract (to deliver the services you have subscribed to), compliance with legal obligations, and our legitimate interests in operating and improving a secure and effective platform. Where we rely on consent, you may withdraw it at any time.

3. Data Storage & Security

Customer data on the Collabaro platform is stored and processed on secure servers within the European Union by default. Where a customer has specific contractual, regulatory or jurisdictional requirements, data residency can be configured to another region on request. This website itself is served by Vercel, and the third-party services listed in section 4 process data under their own terms. We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Role-based access controls and multi-factor authentication
• Regular security audits and penetration testing
• Automated daily backups with geo-redundant storage
• Incident response procedures and breach notification protocols

We retain personal data for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Following termination of a subscription, customer data is retained for up to 30 days before being securely deleted, in accordance with our Terms and Conditions.

4. Third-Party Services

We may share your data with trusted third-party service providers who assist us in operating the platform, including cloud hosting providers, analytics services, and email service providers for transactional communications.

This website itself calls the following third parties. We have listed them by name so you can see exactly who receives data when you visit:

• Vercel — serves this website.
• Google Analytics — measures how the site is used. Only loaded with analytics data once you accept cookies; before that it runs in a cookieless mode.
• Google Fonts — supplies the typefaces. Your browser requests them from Google, which discloses your IP address.
• Google Maps — the map embedded on our Contact page.
• Cal.com — the meeting booking widget on our Contact page (EU instance).
• HubSpot — receives the details you enter if you submit our contact form.

Google Fonts, Google Maps and the Cal.com booking widget load as part of the page and so are contacted before any cookie choice is made. They do not set cookies of ours, but your IP address is disclosed to those providers in the process.

We do not sell your personal data to third parties. All third-party providers are bound by data processing agreements that meet GDPR requirements.

5. Your Rights

Under the UK GDPR and Data Protection Act 2018, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (subject to legal retention requirements)
• Object to or restrict the processing of your data
• Request data portability in a structured, machine-readable format
• Withdraw consent at any time where processing is based on consent
• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk

Railston & Company Ltd is registered with the ICO as a data controller under reference ZA542990.

6. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us:

Railston & Company Ltd
Sadler Bridge Studios
Bold Lane
Derby, DE1 3NT
United Kingdom

Email: info@collabaro.com
Phone: +44 (0) 115 678 6189