Last updated: 23 July 2026
How Bullet Services Ltd collects and uses personal data, and your rights under UK data protection law (UK GDPR and the Data Protection Act 2018).
Bullet Services Ltd, 78 York Street, London W1H 1DP, United Kingdom. Company number 12474323. We are the data controller for the personal data described here. Privacy contact: office@bulletservices.co.uk.
Website visitors. Anonymous analytics events (a random
visitor ID in the _bullet_vid cookie, pages viewed, referring site, browser type) and, if you
use the contact form, your name, email and message. Lawful basis: legitimate interests — running and
improving our website and responding to enquiries. You can opt out of analytics at any time (see Cookies).
Leaseholders (WRS). Your name, email, your accept/decline decision, the date you accepted, and the IP address you submitted from (which we keep as evidence of your acceptance). On acceptance, your name, email and the property address are shared with our invoicing provider to raise your invoice. Lawful basis: performance of / steps prior to a contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) for invoicing and tax records. We keep the IP address as proof of acceptance on the basis of our legitimate interests (Art. 6(1)(f)).
Workforce (app users). Name, email, phone, profile photo, day/hourly rate, bank details (for payment), Construction Industry Scheme (CIS) status, work photos you upload, timesheets, and your location at the moment you check in or out of a site. We also store a push-notification token for your device. Lawful basis: performance of your contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) for payroll, tax and CIS records; legitimate interests (Art. 6(1)(f)) for operational management and verifying, via location, that check-ins happen at the correct site. We use location only at check-in/out, in the foreground, to confirm you are within range of the building — we do not track movement between those moments.
Client / agent contacts. Business contact details and project correspondence. Lawful basis: legitimate interests and contract.
We do not intentionally collect special-category data and we do not make solely-automated decisions producing legal effects. Our services are not directed at children under 18.
We use trusted providers who process data on our behalf under contract:
We can tell you the specific provider behind any of these categories on request.
Payments. Invoices are issued via FreshBooks. Where you pay by card, payment is processed on FreshBooks' secure hosted page by its payment partners (which may include Stripe). We never receive or store your card details.
We may also disclose data where required by law, or to establish, exercise or defend legal claims.
Our file storage and error-monitoring data are held in the EU/EEA, which the UK recognises as adequate. Some providers process personal data outside the UK — including FreshBooks (Canada) for invoicing, and our mapping, email and push-notification providers (which may process in the United States). These transfers are covered by UK adequacy regulations or appropriate safeguards (the UK International Data Transfer Agreement / Addendum, or the UK–US data bridge).
You have the right to access, rectify, erase, restrict or object to processing, and to data portability. Where we rely on legitimate interests you can object at any time. To exercise any right, email office@bulletservices.co.uk; we respond within one month. These rights are free to exercise.
Please contact us first at office@bulletservices.co.uk — we acknowledge and respond within 30 days. You also have the right to complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).
We may update this notice; the "Last updated" date above shows the latest version.