UMAPPlatform← Platform homePlatform privacy notice
UMAP Platform · subsurfaceintelligence.com · Updated 14 October 2026
This notice concerns the UMAP Platform at subsurfaceintelligence.com. It applies to employees and invited users, administrators, and client contacts if the client portal is enabled. Employment records outside the platform and the separate u-map.co.uk website need their own notices.
Who is responsible?
Utility Mapping Group operates the platform. The precise legal controller name, postal address and privacy email are to be confirmed. Until a dedicated privacy contact is published, users can raise a request with their UMAP administrator or project lead. These interim routes do not replace the controller details required in a final notice.
Information used by the platform
| Category | Examples and source |
|---|---|
| Account and access | Work email, name, account ID, invitation, approval status, role, module permissions and sign-in events. Some details are supplied by your administrator; others come from you when registering or updating your profile. |
| Company project work | Projects, client and site details, trial pit observations, reports, images, 3D packages, survey files, schedules, comments and attachments entered or uploaded by authorised users. Records can include names or other personal information contained in field material. |
| Security and audit | Action history such as access changes, uploads, report and project changes, actor identifiers and timestamps. Hosting and authentication providers may also process request, device, IP and diagnostic information. |
| Workspace activity | Approximate foreground use, current workspace, last contact and daily totals for signed-in employees. This is not a timesheet or a record of all work completed. |
| Client portal, if used | Client organisation, contact name and email, access status and the projects and released reports shared with that client. |
| Device storage | Authentication cookies, appearance preferences and local report drafts. See Cookies & browser storage. |
Why data is used
- Provide invited accounts, authentication, role-based access and account recovery.
- Create, review, share and preserve company project and survey records.
- Protect confidential work, investigate access issues and maintain an audit trail.
- Show team availability and approximate use to Management for workspace coordination.
- Deliver client access to assigned projects and released reports, where enabled.
Lawful bases require formal approval. Depending on the purpose and individual, the likely bases to assess are performance of a contract, legitimate interests in operating a secure company workspace, and compliance with legal obligations. Utility Mapping must document the basis for each purpose and any legitimate-interest assessment before this notice is final. Employee consent is not assumed for activity monitoring.
Employee activity and visibility
The signed-in workspace sends activity updates while it is visible and in use. Hidden or idle tabs stop continuous counting. Management can see whether a member is online or away, their last contact, current workspace and approximate totals for today, seven days and 30 days. Daily activity records are kept for up to 90 days; they are also removed for a person when platform access is offboarded. Activity should not be treated as a complete measure of working time or performance. Utility Mapping must complete a proportionality and DPIA assessment before using this feature for employment decisions.
Who can access data?
Access is limited by role and project assignment. Authorised employees, Management and Super Admins can access information needed for their responsibilities. An invited client contact, if enabled, can see assigned project information and released reports. Supabase provides authentication and database services; Vercel hosts the application; Cloudflare R2 holds private uploaded assets when configured. The actual transactional email provider must be confirmed. These providers may process data under their service arrangements. Utility Mapping must verify contracts, subprocessors, hosting locations and any UK international-transfer safeguards.
How long is it kept?
| Record | Current position |
|---|---|
| Daily workspace activity | Up to 90 days through scheduled deletion; removed on employee offboarding. |
| Account and profile | Access is revoked and the optional profile name cleared when offboarded. The technical account, work email and relevant audit identifiers can remain. A deletion period has not yet been approved. |
| Project evidence and reports | Belong to the company and remain after a contributor leaves. The business retention period and deletion criteria still need approval. |
| Audit, email and backup records | Retention periods and backup purge time still need confirmation with the business and providers. |
Do not assume that removing a profile deletes all personal data. A request to erase data is assessed against the organisation's legal and business record-keeping duties.
Your data protection rights
You may ask for access, correction, erasure, restriction, or transfer of applicable personal data, and you may object to processing that relies on legitimate interests. You can object to legitimate-interest processing at any time. Rights depend on the purpose and lawful basis and may have exceptions. Raise a request with your administrator or project lead until the privacy contact is confirmed. You may also complain to the UK Information Commissioner's Office at ico.org.uk.
There is no automated decision-making in the platform that determines employment or client eligibility. Access is granted and removed by authorised people. Providing an invited work email and authentication details is necessary to use the private platform; optional profile information can be changed.
Security and updates
The platform uses authenticated access, role checks and private file storage controls. No online service can guarantee absolute security. Report suspected loss, unauthorised access or a wrong recipient promptly to your administrator. This notice will be updated when the controller details, retention schedule or platform processing changes materially.