Privacy notice

Last updated 15 October 2026

Keystone NEC is a contract management service for NEC construction contracts, provided by [Company name] (“we”), [registered in England and Wales, company number [number], registered office [address]]. This notice explains what personal information Keystone holds, why, and your rights. Questions: privacy@keystonenec.co.uk.

Who is responsible for your information

Each organisation that uses Keystone (our customer, for example a client or employer running construction contracts) decides what contract information goes into it and who is invited. For that information, the customer is the controller and we act as their processor under a written agreement. For account and sign-in information, and for running and securing the service, we are the controller.

What we hold

Your name and work email address, and the organisation and roles you have on contracts.
If you sign in with Microsoft or Google: the name and verified email address they share with us. We don’t receive your password.
What you do in Keystone: the notices, replies, documents and other contract records you create, with who did what and when. These form a permanent contract record.
Files you or others upload, such as programmes, drawings, photos and documents.
Your email preferences, and a log of emails we send you.
Technical information needed to run and secure the service, such as sign-in sessions and server logs.

Why we use it, and our legal basis

To provide Keystone to you and your organisation, and to keep contract records: to perform our contract with our customer, and our and their legitimate interests in administering contracts accurately.
To send emails about actions waiting for you and contract deadlines: as part of providing the service. You can change the digest frequency or switch it off in Settings.
To keep the service secure and working, and to prevent misuse: our legitimate interests.
To meet legal obligations, such as keeping records or responding to lawful requests.

We don’t sell personal information, use it for advertising, or send marketing through Keystone.

Who we share it with

People on the same contract see information according to their role; for example, a Supervisor doesn’t see commercial figures. We use these service providers, each under contract with appropriate safeguards:

Supabase: database, file storage and sign-in, hosted in London (UK).
Vercel: hosting the application, running in London (UK).
Postmark (ActiveCampaign): sending Keystone’s emails.
Microsoft and Google: only if you choose to sign in with them.

Some of these providers are based in the United States, so limited information (for example your email address when we send you an email) may be processed there. Where that happens we rely on the UK’s adequacy arrangements or approved contractual safeguards.

How long we keep it

Contract records are kept for the life of the contract and then for [12] years, unless our customer’s agreement with us says otherwise, because they may be needed to resolve disputes. Account details are removed when an account is closed, except where they form part of a contract record. Email logs are kept for [2] years.

Cookies

Keystone only uses cookies that are needed to keep you signed in and secure. We don’t use advertising or tracking cookies.

Your rights

You can ask for a copy of your personal information, ask us to correct it, and in some cases to delete or restrict it or to object to how we use it. Because contract records are part of a legal record kept for our customer, some requests may need to go to your organisation. Contact privacy@keystonenec.co.uk. If you’re unhappy with how we handle your information, you can complain to the Information Commissioner’s Office (ico.org.uk).

Changes

We’ll update this notice when what we do changes, and show the date at the top.