Last updated 15 June 2026
Complys is a compliance management platform for UK trades and contractors, operated by Complys Technology Ltd ("Complys", "we", "us"). Complys Technology Ltd is the data controller for the personal data described in this policy, except where we act as a processor on behalf of our business customers (see section 4).
Registered office: 51 Barn Owl Close, Torquay, TQ2 7TN. You can contact us about anything in this policy at support@complys.co.uk.
Account data: the name, email address, phone number and password of the people who sign up to use Complys, plus their company details and subscription information.
Worker and contractor data: where our customers use Complys to manage their workforce, the platform holds personal data about workers and contractors, which can include names, contact details, dates of birth, National Insurance numbers, driving licence details, photographs, qualifications, certificates and compliance records, and documents uploaded by users.
Usage and analytics data: information about how the service is used, such as pages visited, actions taken, device and browser type, and approximate location derived from IP address. This is collected through analytics cookies and only where you have consented (see section 7).
Communications data: records of emails we send through the platform, including whether they were delivered, opened or clicked, so that users can see whether the documents and messages they send have been received.
To provide the service (contract): we process account and workforce data to operate the platform, generate documents, run compliance checks and provide the features you use.
To run and improve our business (legitimate interests): we use analytics to understand how the service is used and improve it, to provide support, to secure the platform and prevent abuse, and to send service-related messages. Where we rely on legitimate interests we have considered the impact on you and you can object at any time.
For billing (contract and legal obligation): we process payment and subscription data to take payment and meet our accounting and tax obligations.
For marketing (consent): where we send marketing communications we do so on the basis of your consent, and you can withdraw it at any time.
When our business customers use Complys to manage their own workers and contractors, that customer is the data controller for the workforce personal data they enter, and Complys acts as the data processor on their behalf. We process that data on their instructions and under our agreement with them. If you are a worker or contractor and want to exercise your rights over data held about you by one of our customers, please contact that organisation, and we will support them in responding.
National Insurance numbers are sensitive identifiers. We collect them only where needed to identify a worker, for example to locate a worker passport. National Insurance numbers are encrypted at rest using strong, industry-standard encryption, are never displayed in full after entry, are not shared with any other customer or third party, and access is restricted to authorised personnel. Other compliance documents are stored securely and are visible only to the customer who holds the record.
We do not sell personal data. We share it only with the service providers we rely on to run Complys, each acting under contract and only to the extent needed to provide their service. These currently include: Neon (database hosting), Vercel (application hosting and file storage), PostHog (product analytics), Anthropic (AI processing of content you submit for generation or review), Resend (sending email), and Stripe (payment processing). We may also disclose data where required by law.
Some of these providers may process data outside the UK. Where they do, we rely on appropriate safeguards such as UK adequacy regulations or standard contractual clauses to protect your data.
We use a small number of cookies that are strictly necessary to run the service, such as keeping you logged in. These do not require consent. We also use analytics cookies (PostHog) to understand how the service is used; these are only set where you have given consent through our cookie banner, and you can change your choice at any time. Declining analytics cookies does not affect your ability to use Complys.
We keep account and workforce data for as long as the relevant account is active, and for a reasonable period afterwards to meet legal, accounting and dispute-resolution needs. When you ask us to delete data, we action deletion requests within 30 days, subject to any records we are legally required to retain.
Under UK GDPR you have the right to access the personal data we hold about you, to have inaccurate data corrected, to have your data erased, to restrict or object to certain processing, and to receive your data in a portable format. Where we rely on consent, you can withdraw it at any time. To exercise any of these rights, email support@complys.co.uk and we will respond within one month.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk, though we would welcome the chance to resolve any concern first.
We may update this policy from time to time. When we make material changes we will update the date at the top and, where appropriate, notify you through the service.
For any privacy question or to exercise your rights, contact us at support@complys.co.uk, or write to us at our registered office above.