Legal

Privacy Policy

Last updated: 27 September 2026

1. Who we are

GroundMatch is an online marketplace that connects UK construction and groundworks businesses to buy, sell and exchange surplus and wanted materials. The service is currently in an external business trial phase.

GroundMatch is operated by Stephenson Engineering Solutions Ltd, a company registered in England and Wales (company number 16696208). Our registered office is Windsor House, Troon Way Business Centre, Humberstone Lane, Leicester, England, LE4 9HA.

We are the controller of the personal data described in this policy. We are registered with the Information Commissioner's Office (ICO) under registration number ZC257113.

For any privacy question or request, contact support@groundmatch.co.uk.

2. The information we collect

GroundMatch is a business-to-business service. Most information we hold relates to companies, but some of it identifies individuals, such as a named contact or a work email address.

Account details: company name, contact name, email address, phone number and password. Your password is stored only in hashed form and we cannot read it.
Company profile (optional): trading and legal name, tagline, description, services, projects, areas covered, website, phone, address, operating postcode and radius, industry, company size, year founded, contact details, business type, Companies House number, waste carrier licence, insurance details, materials, sustainability figures and verification status.
Logo and gallery: if you upload a company logo, it is stored with your company profile. Gallery images are not uploaded. You give us the web address of an image hosted elsewhere, plus an optional caption, and we store only that address and caption.
Marketplace activity: listings, material requirements, enquiries between companies, completed exchanges (including material, quantity, distance and estimated cost and carbon savings) and changes you make to your listings.
Security records: whether your email address has been verified, and password-reset records (a hashed version of the reset link, its expiry time, whether it has been used, your account reference and the IP address the request came from).

We do not collect special category data. The service is not intended for children. We do not obtain your data from other sources.

3. Why we use it and our lawful bases

To provide the service (your account, profile, listings, matching, enquiries and exchanges). Lawful basis: performance of a contract.
To keep the service secure (email verification, password resets, preventing misuse). Lawful basis: legitimate interests.
To send essential service emails (see section 8). Lawful basis: performance of a contract and legitimate interests.
To meet legal obligations where they apply. Lawful basis: legal obligation.

We do not use your data for marketing, advertising, profiling or automated decision-making.

4. Who can see your information and who we share it with

Other GroundMatch members can see your company profile (including your logo and gallery), your active listings and requirements, and the postcode, map location and volume of your active listings. Your password is never visible to anyone. Enquiries and exchanges are visible only to the two companies involved.

Gallery images are loaded by the viewer's browser from the website where you host them. That website may see the viewer's IP address.

Service providers that process data on our behalf:

Render, which hosts our main application and account database.
Lovable, which provides website hosting (through Cloudflare), a marketplace database and email delivery (through Mailgun) from noreply@notify.groundmatch.co.uk.
postcodes.io, which converts postcodes into map locations. Only the postcode is sent.
unpkg.com, which delivers the map software (Leaflet) to your browser. No account data is sent.
OpenStreetMap, which supplies the map images (tiles) directly to your browser. No account data is sent.

When your browser contacts unpkg.com or OpenStreetMap, they can see your IP address, as happens with any website.

We do not sell your data. We may disclose information where required by law.

5. International processing

Some of our service providers may process personal data outside the UK. Where UK data-protection law requires safeguards for an international transfer, we require an appropriate legally recognised safeguard, such as an adequacy regulation, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, as applicable.

6. Cookies and browser storage

GroundMatch does not set cookies. It does not use advertising, analytics or tracking cookies.

We use your browser's storage as follows:

Session storage: your sign-in token, account reference, company name and a copy of your profile, so that you stay signed in while you use the site. This is cleared when you close the browser tab or sign out.
Local storage: your cost and commercial settings, used for the savings calculations. These stay on your device until you clear them or delete your account.

Our hosting and infrastructure providers may set strictly necessary technical cookies for security or delivery. They do not track you for marketing.

7. Location and postcode data

We check postcodes on your device, then send them to postcodes.io to work out map coordinates. The coordinates are stored with your listing or requirement. The postcode, map location and volume of your active listings are shown to other members so that they can find materials near them.

8. Emails

We send only essential service emails:

email address verification when you register;
password-reset emails when you ask for one.

Links in these emails are single-use and time-limited, and we store them only in hashed form. We do not send marketing emails. Copies of emails you have received, and our email provider's delivery logs, may remain until they are deleted in line with that provider's own schedule.

9. Analytics and tracking

GroundMatch does not use analytics, tracking pixels or advertising tools.

10. Security

Security measures we use:

passwords stored only in hashed form, with a minimum length of 10 characters;
short-lived sign-in tokens;
email verification;
single-use, time-limited password-reset links that are stored hashed;
encrypted connections (HTTPS);
protection against the site being embedded in other websites (clickjacking).

No online service can be completely secure.

11. How long we keep information

We keep your personal data while your account is active. When you delete your account, personal data associated solely with your account is deleted. Where marketplace records are shared with another company, such as enquiries and completed exchanges, we anonymise your identity and retain the non-identifying transaction record. We may retain information for longer where this is necessary to comply with a legal obligation, establish or defend legal claims, prevent fraud or misuse, or maintain the security and integrity of the service.

12. Your rights

You have the right to access, correct, erase, restrict or object to the processing of your personal data, and to data portability. To exercise these rights, contact support@groundmatch.co.uk. We will respond within one month, and we may need to confirm your identity first.

Deleting your account: you can permanently delete your account under Company Settings, after confirming your password. When you do:

your account, profile, listings, requirements, listing changes and security records are deleted;
on enquiries and exchanges shared with another company, your details are replaced with "Deleted company", so that the other company's records stay accurate. The non-identifying transaction details are kept (material, quantity, distance, date and estimated savings).

13. Complaints

Please contact us first at support@groundmatch.co.uk. You also have the right to complain to the Information Commissioner's Office: ico.org.uk, telephone 0303 123 1113.

14. Changes to this policy

We may update this Privacy Policy from time to time. The current version will always be published on this page, and the "Last updated" date will show when it was last revised. Where a change is significant, we may also notify registered users by email or through a prominent notice on GroundMatch.