SnagSort is operated by GMBF Ventures Ltd, a company registered in England and Wales under company number 17286832, with registered office at 124 City Road, London, EC1V 2NX, United Kingdom.
This notice explains how personal data is handled when you visit SnagSort, make an enquiry, hold an account, or access project information through a client or contractor workspace.
1. Our role depends on the data
For our own website, enquiries, customer administration, service security and business records, GMBF Ventures Ltd generally acts as a controller.
For project photographs, snag records, contractor responses, close-out evidence and other project information that a customer places in SnagSort for its own project purposes, the customer will normally determine why that information is processed. In that situation GMBF Ventures Ltd normally acts as a processor for the customer and processes the information on the customer's documented instructions, subject to applicable law and the parties' contract.
If you are an employee, contractor, subcontractor, consultant or other external project participant and your question concerns project content, the relevant client/customer organisation will usually be the appropriate first point of contact for data-protection requests. We will assist that customer where required.
2. Information we may process
Depending on how you use SnagSort, this may include:
- your name, work email address, company, role and account identifiers;
- authentication, access, invitation and security records;
- project membership, external-party allocation and audit records;
- enquiry and customer relationship information;
- snag descriptions, locations, notes, programme dates and close-out responses;
- photographs and other project evidence, including completion evidence uploaded by contractors or subcontractors;
- information visible within photographs, which can include people, badges, vehicle registrations or other identifying details;
- technical information such as browser/device details, timestamps and service logs;
- cookie or analytics information where used in accordance with our cookie choices.
SnagSort is a business service and is not directed at children.
3. Why we process personal data
Where we act as controller, our purposes may include:
- providing and administering SnagSort and customer accounts;
- responding to enquiries and taking steps before entering a contract;
- operating authentication, access control, fraud prevention and service security;
- providing support and service communications;
- keeping appropriate legal, accounting and business records;
- improving the service using proportionate operational information that does not require using customer project photographs or project records for unrelated model training; and
- using non-essential analytics only where the required cookie choice has been made.
Our lawful bases may include performance of a contract or steps requested before a contract, our legitimate interests in operating and securing a business software service, compliance with legal obligations, and consent where consent is specifically required (for example, certain non-essential cookies).
Where we act as processor for project content, the customer is responsible for determining the applicable purpose and lawful basis and we process that content under the customer agreement and documented instructions.
4. Project photographs and sensitive project evidence
Project photographs and evidence can be commercially sensitive and may also contain personal data. SnagSort therefore treats externally shared project content as confidential project evidence.
External contractor and subcontractor access is limited to the project content made available to that user or party. External users must comply with the SnagSort External User Terms, including restrictions on copying, downloading, screenshotting, forwarding, publishing or otherwise distributing project content outside SnagSort unless the customer has expressly authorised that activity or disclosure is required by law.
These contractual restrictions are an additional control. No browser-based service can technically prevent every photograph or screen from being captured by a determined authorised viewer.
5. Ownership of project content
GMBF Ventures Ltd does not claim ownership of customer project photographs, snag records or contractor evidence merely because they are stored in SnagSort.
Ownership and other intellectual-property rights remain with the customer, uploader or other rights-holder as determined by the underlying project arrangements. Customers grant GMBF Ventures Ltd only the rights reasonably necessary to host, process, reproduce, transmit, back up and otherwise handle content to provide and secure SnagSort, comply with documented instructions and meet legal obligations.
Contractor or subcontractor completion evidence uploaded to a customer project may form part of that project's quality, contract-administration and handover record. The applicable customer terms and project contract may give the customer rights to retain and use that evidence for those purposes.
6. AI-assisted drafting
When an authorised project user chooses SnagSort's AI-assisted drafting feature, SnagSort may send the user's rough note, relevant project headings/reference context and any photographs that user has selected for that draft to an AI service provider solely to generate the requested structured snag draft. The feature is optional; users can use manual entry instead.
The current implementation uses the OpenAI API and sends API requests with store: false. OpenAI states that API inputs and outputs are not used to train its models by default unless the API customer explicitly opts in, although API content may be retained for a limited period for service and abuse-monitoring purposes unless a qualifying Zero Data Retention arrangement applies.
As a SnagSort policy, GMBF Ventures Ltd will not intentionally opt customer project photographs or project records into third-party model-training/data-sharing programmes, or use them to train a general-purpose model, without the customer's explicit written authorisation.
7. Sharing and service providers
We may use specialist service providers to operate SnagSort, including cloud application hosting, database/authentication/storage, transactional email and, when an authorised user invokes AI-assisted drafting, an AI API provider. They are engaged under appropriate contractual arrangements and receive information only to the extent required for their services.
We may also disclose information where required by law, to protect legal rights or service security, or in connection with a legitimate corporate transaction subject to appropriate safeguards.
We do not sell customer project photographs or project records to advertisers.
8. International transfers
Where a service provider processes personal data outside the United Kingdom, we use the transfer mechanism and contractual safeguards required by applicable UK data-protection law where those safeguards are required. Enterprise customers can request current information about relevant subprocessors and transfer arrangements.
9. Retention
We retain controller data only for as long as reasonably required for the purpose for which it was collected, including customer administration, security, dispute, accounting and legal requirements.
Project-content retention is governed primarily by the customer agreement, project settings and documented customer instructions. Some operational logs, backups or records may have separate limited retention periods where necessary for service security, resilience, audit or legal requirements.
When a customer contract ends, return, export and deletion of processor data is handled in accordance with the customer agreement and applicable law.
10. Security
SnagSort uses access controls designed to restrict project information to authorised users and scoped external parties. Project photographs are stored in private storage rather than a public media bucket, and external photo access uses time-limited signed links. Access can be revoked at project/guest level.
No online service can guarantee absolute security. Users must keep access links and codes confidential and report suspected unauthorised access or disclosure promptly.
11. Your rights
Depending on the circumstances, UK data-protection law may give you rights including access, correction, deletion, restriction, objection, portability and rights relating to certain automated decisions. Some rights are subject to legal conditions and exemptions.
For data for which GMBF Ventures Ltd is controller, you can contact us through the SnagSort enquiry/contact route or at our registered office. For project content controlled by a SnagSort customer, contact that customer in the first instance; we will support the customer as required.
You may also complain to the UK Information Commissioner's Office if you believe your personal data has been handled unlawfully.
12. Changes
We may update this notice when the service, law or processing arrangements change. The version and publication date at the top identify the notice currently in force.