Privacy Policy
This policy explains how HiveSuite Limited collects, uses, shares, and protects personal data in connection with our platform and website.
1 Who We Are
HiveSuite Limited ("HiveSuite", "we", "us", "our") is a company registered in England and Wales (Company No. 16791803). We are registered with the Information Commissioner's Office (ICO).
We provide cloud-based business management software for UK contractors, trades, and mobile service businesses, including HiveCRM, HivePlanner, HiveIntel, HiveCrew, HiveAssist, the Customer Portal, and related features.
For questions about this policy or to exercise your data protection rights, contact us at privacy@hivesuite.co.uk.
2 Our Role: Controller and Processor
HiveSuite acts in two capacities depending on the context:
Data controller
For personal data relating to our own customers' accounts, billing, website visitors, marketing, and support interactions. We determine the purposes and means of processing this data.
Data processor
For personal data that our customers enter about their customers, employees, team members, and contacts. Our customers are the data controllers for this information, and we process it on their behalf to provide the service. This includes data entered into CRM records, job details, customer portal accounts, public form submissions, SMS messages, crew/team member information, compliance documents, and invoices.
Where we act as a processor, our customers are responsible for having a lawful basis to collect and process personal data using HiveSuite. Our Data Processing Agreement sets out the terms on which we process data on our customers' behalf.
3 Information We Collect
We collect and process the following categories of personal data:
Account and Contact Data
- Name, email address, phone number
- Business name, address, and VAT number
- Account credentials (passwords are hashed using bcrypt)
- User role and permission settings
- Referral codes and promotional information
Billing and Payment Data
- Subscription plan and billing history
- Stripe subscription and invoice identifiers
- Payment amounts and dates
- Payment card details are handled directly by Stripe - we do not see or store full card numbers
Business Data (entered by you)
- Your customers' names, addresses, and contact details
- Job details, quotes, invoices, and purchase orders
- Team member and crew information
- Inventory and stock records
- Financial records, expenses, and receipts
- Compliance documents, certificates, and checklists
- Documents, images, videos, and file attachments
Communications Data
- SMS message content, recipient numbers, and delivery status
- SMS consent and opt-out records
- SMS credit purchase and usage history
- Email communications sent through the platform
- Customer Portal messages between you and your customers
Location and Workforce Data
- GPS location data from the HiveCrew mobile app (where enabled by the account holder)
- Time tracking records
- Job site photographs and notes uploaded by crew members
- Job site addresses used for mapping and directions
AI Feature Data
- Queries and prompts submitted to HiveIntel
- Data provided to HiveAssist (quotation text, receipt images, template content)
- AI-generated outputs and responses
Public Form Submissions
- Information submitted through embeddable public enquiry forms
- The specific fields collected are determined by the HiveSuite customer who configured the form
Usage and Technical Data
- Pages visited and features used
- Device type, browser, and operating system
- IP address
- Session data, login times, and access logs
- Error logs
4 Legal Basis for Processing
Under UK GDPR, we rely on the following lawful bases when acting as a data controller:
Contract performance (Article 6(1)(b))
Processing necessary to deliver HiveSuite services you have subscribed to, including account creation, service provision, billing, support, and communications necessary for the service.
Legal obligation (Article 6(1)(c))
Processing required to comply with UK law, including financial record-keeping obligations, tax requirements, and responding to lawful requests from regulatory authorities.
Legitimate interests (Article 6(1)(f))
Processing for fraud prevention, platform security, product improvement, website analytics, and direct marketing to existing customers (where our interests do not override your rights). You may object to processing based on legitimate interests at any time.
Consent (Article 6(1)(a))
For non-essential cookies and analytics on our website. You may withdraw consent at any time.
Where we act as a data processor on behalf of our customers (for example, processing their customers' personal data, SMS messages, or form submissions), we process data on the basis of our customer's documented instructions. Our customers are responsible for establishing their own lawful basis for processing.
5 How We Use Your Information
We use the data we collect as a controller to:
- Provide, maintain, and improve HiveSuite services
- Create and manage your account and tenant workspace
- Process subscription payments and manage billing
- Deliver customer support and respond to enquiries
- Send transactional communications (account notifications, welcome emails, service updates)
- Send marketing communications to existing customers (where permitted by law and subject to your right to opt out)
- Analyse website and platform usage to guide product development
- Detect, prevent, and investigate fraud, security incidents, and misuse
- Comply with legal and regulatory requirements
Data we process on your behalf. When you use HiveSuite to manage your business (entering customer records, sending invoices, messaging via SMS, using the Customer Portal, etc.), we process that data solely to provide the service to you. We do not use your business data or your customers' data for our own marketing, profiling, or any unrelated purpose.
6 Data Sharing and Subprocessors
We never sell your personal data. We share data only where necessary to operate our service or where required by law. We use the following categories of third-party service providers (subprocessors):
Payment processing
Stripe processes subscription payments and customer-to-customer payments. Stripe handles payment card data directly and holds PCI-DSS certification. We do not store payment card numbers.
Email delivery
We use SMTP2GO to deliver transactional and service emails (such as welcome emails, quote notifications, and invoice reminders). Email content and recipient addresses are shared with this provider for delivery purposes.
SMS delivery
SMS messages are delivered through a third-party telecommunications provider. Message content, recipient numbers, and delivery metadata are shared with this provider. See our Subprocessors page for the current provider.
AI service providers
HiveIntel and HiveAssist use third-party AI providers to process queries and generate outputs. Data submitted to AI features (such as natural-language questions, quotation text, and receipt images) may be transmitted to these providers. See our Subprocessors page for details.
Website analytics
Microsoft Clarity is used on our marketing website for session recordings and heatmaps to help us improve the website experience. Google Ads (via Google Tag) is used for conversion tracking and advertising measurement. These services may set cookies on your device.
Accounting integrations
Where you connect HiveSuite to Xero or QuickBooks Online, relevant financial data (invoices, expenses, contacts) is synchronised with the accounting provider you have chosen. These integrations are optional and initiated by you.
Hosting and infrastructure
Our platform is hosted on infrastructure providers. See our Subprocessors page for current provider details and processing locations.
A full list of our current subprocessors is available on our Subprocessors page.
We may also disclose personal data where required by law, to comply with legal process, to enforce our Terms of Use, or to protect the rights, property, or safety of HiveSuite, our users, or others.
7 Customer Portal, Public Forms and End-User Data
Customer Portal. When a HiveSuite customer enables the Customer Portal, their customers can log in, view jobs and quotes, accept quotations, pay invoices, and exchange messages. We process this data as a data processor acting on behalf of the HiveSuite customer. The HiveSuite customer remains the data controller and is responsible for having a lawful basis and providing appropriate privacy information to their customers.
Public forms. Embeddable public enquiry forms may collect personal data from individuals visiting the HiveSuite customer's website. The HiveSuite customer determines which data is collected and is responsible for lawful collection, consent, and privacy notices. We process submitted data as a processor on their behalf.
SMS recipients. When a HiveSuite customer sends SMS messages to their contacts, we process recipient phone numbers, message content, and delivery metadata as a processor on the customer's behalf. The customer is responsible for lawful messaging and recipient consent.
8 AI Features and Data Processing
HiveIntel and HiveAssist use third-party AI providers to process your queries and data. When you use these features:
- Your queries, prompts, and relevant business data may be sent to third-party AI providers for processing
- We select AI providers that offer appropriate data processing terms and do not use submitted data to train their general models, where such terms are available from the provider
- AI providers may temporarily process or cache data for the purpose of generating responses, as described in their own terms
- We recommend that you avoid submitting sensitive personal data (such as financial account numbers or health information) to AI features where it is not necessary
See our Subprocessors page for the current AI provider(s) used.
9 Data Security
We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, alteration, or disclosure. These measures include:
- Encryption of data in transit using TLS
- Password hashing using bcrypt
- Role-based access controls within the platform
- Session management and login security measures
- Regular backups
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office in accordance with UK GDPR requirements and, where required, inform affected individuals without undue delay.
10 Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law:
- Active accounts: Data is retained for the duration of your subscription.
- After cancellation: We recommend that you export any data you need before your subscription ends. Following cancellation, we may retain your data for a limited period to allow for export or reactivation, after which it will be deleted or anonymised. [Note: the specific post-cancellation retention period and data export availability are subject to operational review. Contact us at support@hivesuite.co.uk for current details.]
- Billing records: Retained for up to 6 years to comply with HMRC record-keeping requirements.
- Support records: Retained for up to 3 years after the interaction is closed.
- SMS records: Message content and delivery metadata are retained for the duration of the active subscription and subject to the post-cancellation retention period above.
- Website analytics: Analytics data is retained according to the retention policies of the relevant analytics provider (Microsoft Clarity, Google).
- Security and access logs: Retained for a reasonable period for security, debugging, and fraud prevention purposes.
11 International Data Transfers
Some of our third-party service providers may process data outside the United Kingdom or European Economic Area. This includes providers of payment processing, email delivery, SMS delivery, AI services, and analytics.
Where personal data is transferred outside the UK, we ensure that appropriate safeguards are in place in accordance with UK GDPR, which may include: reliance on UK adequacy regulations (where the destination country has been deemed adequate by the UK Government); use of the UK International Data Transfer Agreement or Addendum; or the standard contractual clauses approved by the ICO. Details of the processing locations of our subprocessors are available on our Subprocessors page.
12 Cookies and Tracking Technologies
We use cookies and similar technologies on our website and platform. For full details, see our Cookie Policy. In summary:
Essential cookies
Required for the platform to function (session management, authentication, security). These cannot be disabled.
Analytics cookies
Microsoft Clarity (session recordings, heatmaps) and Google Ads (conversion tracking) help us understand website usage and measure advertising effectiveness.
13 Marketing Communications
If you become a HiveSuite customer, we may send you product updates, tips, and information about new features that may be relevant to your business. For existing customers, we rely on the legitimate interest (soft opt-in) exemption under PECR. For non-customers, we will only send marketing with your consent.
You can unsubscribe from marketing emails at any time by clicking the "unsubscribe" link in any email, or by contacting us at support@hivesuite.co.uk. Unsubscribing from marketing does not affect transactional emails necessary for the service (such as invoices, security alerts, or account notifications).
14 Your Rights Under UK GDPR
Where we act as a data controller, you have the following rights. To exercise any of these rights, contact us at privacy@hivesuite.co.uk. We will respond within one month.
Right of access
Request a copy of the personal data we hold about you.
Right to rectification
Ask us to correct inaccurate or incomplete personal data.
Right to erasure
Request deletion of your personal data where there is no compelling reason for continued processing.
Right to restriction
Ask us to restrict processing in certain circumstances.
Right to data portability
Receive your personal data in a structured, machine-readable format.
Right to object
Object to processing based on legitimate interests or to direct marketing.
15 Children's Privacy
HiveSuite is a business platform and is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us and we will delete it promptly.
16 Changes to This Policy
We may update this privacy policy from time to time. When we make material changes, we will update the version number and effective date at the top of this page and notify you by email or through the HiveSuite portal. We encourage you to review this policy periodically.
17 Contact Us
If you have questions about this policy, wish to exercise your rights, or want to raise a privacy concern:
HiveSuite Limited - Company No. 16791803 - Registered in England and Wales