Privacy notice.

The short version

We hold what we need to run a subscription and a piece of software, and not much else. We do not sell anything to anybody. There is no advertising on this site and nothing here is tracking you around the internet. One feature sends a photograph to an AI company outside the UK when you ask it to, and that is the only place your work leaves us for a reason other than doing the job you asked for.

The rest of this page is the detail, because the short version is not a legal notice and this needs to be one.

Who we are

Pascal is a product of Pascal Software Ltd. Where this notice says we are the controller, it means that company decides what happens to the information and answers for it.

Data protection questions, requests and complaints go to admin@pascalsoftware.co.uk.

We are registered with the Information Commissioner's Office under number CSN2021824.

We are not required to appoint a data protection officer and we have not appointed one. The address above reaches the people who would be doing that job.

Two kinds of data, and which hat we wear

Everything below turns on this distinction, so it comes first.

Information about you. Your name, your email, your phone number, your company's details, your billing record, what you do inside the product. You are our customer and we decide what happens to this, so for it we are the controller and this notice is our notice to you.

Information about your clients. The people you work for and the properties you work on: names, addresses, phone numbers, job records, certificates, photographs. You decide what goes in and why. You are the controller for all of it and we are your processor, which means we hold it on your instructions and do nothing else with it. The data processing agreement is the contract that governs it, and it is worth reading if you are the person who answers to your own clients.

Two narrow exceptions are called out further down, where we are the controller for something you might reasonably assume we were only holding for you: a small number of board photographs kept to measure how accurate that feature is, and the list of email addresses that have bounced or complained.

What we hold about you

• Your account. Name, email address, phone number, job title, the company you belong to, your role in it, and the signature image you upload to put on certificates.
• Your company. Trading name, address, phone, company and VAT registration numbers, competent person scheme and scheme number, logo, and the settings and terms you have saved.
• Your subscription. Which plan you are on, how many users, what you have been charged, when, whether it was paid, discount codes you used, and the identifiers Stripe gives us so we can match one to the other. We never see your card number, and we could not tell you what it is.
• How you sign in. A hashed password, your two factor secret and recovery codes if you use them, any passkeys you have enrolled, and a record of the devices currently signed in.
• Technical records. IP address, browser and device information, session records, and the error reports the application produces when something breaks.
• What you send us. Support emails, enquiries from the contact form, and anything you tell us in them.
• Your work. The records you create in Pascal. You are the controller for these, as above, but we hold them and it would be strange not to mention them here.

Nearly all of it comes from you. The rest comes from Stripe when a payment succeeds or fails, from Xero if you connect it, and from our email provider when a message bounces.

You have to give us your name, email and company details to have an account. Without them there is nothing to bill and nobody to put on a certificate, so we could not provide the service at all.

Why we use it, and what allows us to

UK data protection law says we need a lawful basis for each purpose. Ours are these.

To perform our contract with you. Setting up and running your account, holding your work, taking payment and sending receipts, emailing quotes and certificates on your behalf, answering your support questions, and telling you about your subscription when a payment fails or a price changes.

Because the law requires it. Keeping records of what we invoiced and collected for tax purposes, and responding to a lawful request from an authority that is entitled to make one.

Because we have a legitimate interest. We have weighed each of these against your interests, and we think they are the sort of thing anybody would expect a software company to do:

• keeping the service secure, spotting abuse, and stopping people getting into accounts that are not theirs;
• keeping it working, which means error reports, logs and enough diagnostic detail to fix what broke;
• understanding which parts of the product are used, so we build the right things next;
• counting visits to the public pages and seeing which of them get read, so we know which guides and calculators are worth writing more of;
• measuring how accurate the board reading feature is, which is the exception described below;
• taking backups, and testing that they restore;
• chasing money we are owed, and defending ourselves if a claim is made.

You can object to any of these. Email the address above, tell us which one, and we will either stop or explain why we think we still have grounds. The one you can switch off yourself, without asking us, is the visit counting. The cookies section below says how.

What we do not do

• We do not sell your data. Not to anybody, at any price.
• We do not share it with advertisers and there is no advertising on this site. We do count visits to the public pages using Google Analytics, described below, and we have turned off the settings that would let Google use any of it to advertise to you.
• We do not use your work, your clients or your certificates to train machine learning models, and neither may the companies we send data to.
• We do not make automated decisions about you that have a legal or similarly significant effect. Nothing in Pascal scores you, ranks you or decides anything about you without a person involved.
• We do not want special category data. Health, ethnicity, religion, politics, trade union membership, biometrics or criminal records have no place in a job record, and the terms ask you not to put them in.

When you photograph a board

Pascal can read a distribution board off a photograph and fill in the circuit schedule for you to check. It is the one feature that sends your work to a company outside the UK, so here is exactly what happens.

• What is sent. Four things and no more: the photograph, the names of the circuit templates saved in your own settings, which end of the board to start counting from, and whether you have recorded the board as three-phase. Your client's name does not go. Nor does the address, the certificate, or your name.
• Who reads it. An AI provider we name in the list of who touches your data. Their computers are in the United States. We have data protection terms with each of them and they are not permitted to use what we send to train their models or for any purpose other than answering our request.
• What comes back. A proposal, not an entry. It waits until somebody in your company reviews it and approves it. No decision about anybody is made by the model.
• And then the photograph goes. Normally it is deleted as soon as the read is resolved.

It is worth being clear about which photograph this section is talking about, because it is not one you would recognise. A photograph sent for reading is working material. It is never added to the job, never attached to the certificate, and never appears in any gallery you can browse. It exists to be read and then it is thrown away. Photographs you upload deliberately, to an observation or a job or a quote, are a different thing entirely: nothing in this section applies to them, and they stay on your account for as long as it does.

Now the exception. We keep a small number of those working photographs, together with the corrections engineers made to what was read, so we can measure how accurate the feature is. The corrections are the valuable half of that: a reading nobody checked tells us nothing. It is capped at sixty examples across every customer put together, so most companies never have one in it, and once there are sixty no further photograph is kept.

A photograph of a consumer unit rarely says anything about a person, but it came from a job that does, so we treat it as personal data and keep it apart from the client record it came from. For this narrow purpose we are the controller and we rely on our legitimate interest in making a feature you depend on more accurate.

We will hold those sixty until the accuracy work is finished and delete them then, and in any event no later than 31 December 2027. Tell us at any point that you would rather not take part and we will delete the ones from your company inside a month and leave you out of it from then on. Nothing else about your account changes.

Who else touches it

Only the companies needed to run Pascal, each under a written data protection agreement, each allowed to use the data only to do the job we are paying them for. We keep the full list, with what each one does and where it does it, on the who touches your data page, which is also where we announce a change before we make it.

In outline, they cover hosting, file storage, backups, payments, email, error monitoring, and reading board photographs.

Beyond that we share information only where we have to: with Xero, if you connect it, and then only what you send there; with our accountants and advisers; where the law requires it or a court orders it; and to a buyer if the business is ever sold, in which case we would tell you before anything moved.

Where it lives, and what protects it there

Your records stay in Europe. The application and the database are in London; the files you upload, and the backups, are held in the European Union. Transfers to the European Economic Area are covered by the UK's adequacy regulations, which is the government saying the protection there is equivalent.

Two things go further afield, and both are named on the sub-processor page with the safeguard that applies. Payments involve Stripe, which operates internationally. Board photographs go to an AI provider in the United States. For transfers to countries the UK has not found adequate, we rely on the ICO's international data transfer agreement or the UK addendum to the standard contractual clauses, and we assess the risks of the transfer before we make it.

You can ask us for a copy of the safeguards that apply to any particular transfer and we will send them to you.

How long we keep it

• Your account and your work. While you have a subscription, and for twelve months after it ends so you can come back to it. We email the admins on the account at least 30 days before we delete anything. Ask us to delete it sooner and we will.
• Billing records. Six years from the end of the financial year they fall in, because HMRC requires it. This is the one thing a deletion request cannot reach.
• Support and enquiry emails. Up to three years, so we can remember what we told you. Ask us to clear a thread out sooner and we will.
• Error reports and diagnostic logs. Ninety days at most, usually much less.
• Sign-in sessions. They expire on their own after a period of inactivity, and signing out ends them immediately.
• Board photographs sent to be read. Deleted when the read is resolved. The sixty held back for the accuracy work go when it finishes, and by 31 December 2027 whether it has finished or not. This covers only the photograph sent for reading, which is never part of your records. Photographs on a certificate, a job or a quote are covered by the first line of this list, along with everything else on your account.
• Bounced and complained-about email addresses. Kept for as long as we send email. Remembering not to write to an address is the entire purpose of that record, so deleting it would defeat it. This is the second place we are the controller rather than your processor: the list is one list for the whole service, because an address that rejected one company's mail will reject everybody's, and protecting delivery for all our customers is our own interest as much as yours.
• Backups. Daily backups are kept for 30 days and hourly ones for two, then they delete themselves. So a deletion catches up with the backups within a month rather than instantly. Seven days of daily backups are also locked against being altered by anybody, including us, which is what stops an intruder destroying them, and it means a deletion request has to wait those days out.

How we keep it safe

Traffic is encrypted in transit. Passwords are hashed and cannot be read back, by us or anybody else. Every query the application makes is filtered to your company automatically by the framework, so nobody has to remember to do it. Files you upload are stored privately and served only through checks that confirm the person asking is entitled to see them.

There is one deliberate exception to that last point, and it is a feature rather than a hole. When you send a client a quote, the link you send them shows your logo and the photographs you attached, to somebody who is not in your company and has no account. Those links are signed, they only ever reach the one quote, and they stop working when the quote does.

Access to production systems is limited to those who need it and protected by keys, not passwords. Backups are encrypted and held on separate credentials from the live system, and a restore has been tested rather than assumed. Two factor authentication and passkeys are available on every account, and we would rather you used one.

If a breach ever puts your data at risk we will tell the ICO within 72 hours where the law requires it, and tell you without undue delay where it is likely to be a high risk to you. What we tell you will be what actually happened.

What we email you

Messages about your account: failed payments, receipts, price changes, security notices, certificate renewals you asked to be reminded about, and anything else the service needs to tell you. These are part of the service and you cannot unsubscribe from them while you have an account, though you can turn off the optional reminders in your notification settings.

If we ever start sending marketing, it will be to customers about things related to what they already bought, every message will have an unsubscribe link that works, and one click will be the end of it.

Cookies and the like

Here is everything Pascal puts in your browser. It is a short list and we have counted it rather than estimated it.

• A session cookie, which is how the site knows you are signed in.
• A security token cookie called XSRF-TOKEN, which stops other websites submitting forms as you.
• An appearance cookie, remembering whether you chose light or dark. The same choice is also kept in your browser's local storage, so the page can be the right colour before it has finished loading.
• A sidebar_state cookie, remembering whether you had the sidebar open or collapsed.
• One key in session storage, which remembers where you had got to in the guided tour. It is gone when you close the tab.
• Two Google Analytics cookies, _ga and one starting _ga_. They are what lets us count you as one person reading four pages rather than as four separate visitors, and recognise you as a returning one rather than a new one. They are set on the public pages only.

The first two are strictly necessary and the next three only remember how you like the place to look. The Google Analytics pair are there so we can see how many people visit and which pages they read, which is how we decide what to write next. They stop at the front door. Nothing is measured once you have signed in, so which jobs you opened and which certificates you issued are not counted anywhere and never leave our servers, and nothing is measured on the quote or invoice page your electrician sent you either. Google Analytics is the only thing on this site loaded from somebody else's servers. The fonts and everything else are still our own.

Block or clear the preference ones in your browser if you would rather not have them, and Pascal carries on working having forgotten how you had it set. Blocking the first two stops you signing in, because signing in is what they are for. If you would rather not be counted at all, any browser will block the analytics cookies and most ad blockers already do it for you. Nothing on the site behaves differently for it.

What you can ask us for

Under UK data protection law you can ask us to:

• give you a copy of what we hold about you;
• correct it if it is wrong;
• delete it, where we have no reason to keep it;
• stop or limit what we are doing with it while something is being sorted out;
• hand it over in a portable format, or send it to somebody else;
• stop relying on legitimate interests for a particular purpose.

Email admin@pascalsoftware.co.uk. It is free, we will answer within one month, and we will tell you at the outset if a request is complicated enough to need longer. We may ask you to confirm who you are first. That is there to stop somebody else asking for your information.

If your request is about information your electrician or builder holds about you rather than about our own customer, read the section at the end of this page instead. We will pass it on, but they are the ones who can act on it.

Complaining about how we handled your data

You can complain directly to us, by any route you like, and the easiest is admin@pascalsoftware.co.uk. You do not have to use a form and you do not have to use the word complaint.

We will acknowledge it within 30 days of receiving it, investigate it properly, and tell you what we found and what we are doing about it. If it is going to take a while we will say so and keep you posted.

You can also complain to the Information Commissioner's Office at any point, at ico.org.uk or on 0303 123 1113. We would rather you came to us first so we get the chance to fix it, but it is your call and going to them does not require our permission.

If your electrician uses Pascal

You might be reading this because a trade business quoted you, did work at your property, or sent you a certificate that came out of Pascal. In that case the information about you belongs to them, not to us. They decided to collect it and they decide what happens to it. We only hold it because they pay us to run their software.

So a request to see, correct or delete your information should go to them, and they can act on it the same day. If you cannot reach them, or you do not know who they are, write to admin@pascalsoftware.co.uk and we will pass it on and tell you we have. We are not allowed to hand over or delete their records on your say-so. The same rule is what stops a stranger asking us for yours.

One thing we do hold in our own right, and you would have no way of knowing about it otherwise. If your electrician photographed your consumer unit so Pascal could read the circuits off it, that photograph may be one of the sixty we have kept to check how accurate the feature is. It is held apart from your name and your address, we have no way of contacting you about it, and it is described in full in the board photograph section above. Ask your electrician to tell us and we will take it out.

Children

Pascal is business software and is not for anybody under 18. We do not knowingly collect information about children. If you think a child's information has ended up in the system, tell us and we will take it out.

Changes to this notice

The date at the top says when this last changed. If we change something that matters, such as adding a new purpose or a new company that handles your data, we will email you before it takes effect. We will not quietly edit the page.