Managing multiple sites, multiple contractors, and a mountain of health and safety paperwork shouldn't take up half your day.
Site Safety Compliance puts every Risk Assessment, Method Statement, F10 form, and sign-off in one place — accessible by every contractor, on every site, from their phone. Upload once, allocate to your team, and know instantly that every document has been read and accepted.
Whether you're running a construction project, a TV shoot, a catering operation, or a live event — stay compliant, stay protected, and get hours of your week back.
LEGWORX - Site safety - without the legwork
Last updated: 11 Sept 2026
This Privacy Policy explains how personal information is collected, used and protected when using Legworx, including the Legworx web-based administration platform, mobile application and associated services.
Legworx is operated by BG Retrofit.
For privacy enquiries, please contact:
Email: legworx@bgretrofit.co.uk
This policy should be read alongside the Legworx Terms & Conditions.
1. Who We Are and Our Data Protection Roles
Legworx provides organisations with a platform for managing sites, contractors, documents and document acknowledgements.
Depending on the information concerned, BG Retrofit may act either as a data controller or as a data processor.
Where BG Retrofit is the controller
BG Retrofit is generally the data controller for personal information that we collect for our own purposes, including:
- customer and prospective customer contact information;
- Legworx account and administrator information;
- subscription and billing information;
- customer support communications;
- security and technical information necessary to operate Legworx; and
- information required to administer our contractual relationship with customers.
Where BG Retrofit is the processor
Where an organisation uses Legworx to manage its own employees, contractors, subcontractors, clients, sites, RAMS or other project information, that organisation will generally determine why that information is being processed.
In those circumstances, the subscribing organisation will normally be the data controller and BG Retrofit will process the information on its behalf as a data processor in order to provide the Legworx service.
Customers are responsible for ensuring that they have an appropriate lawful basis for information they enter into Legworx and for providing any privacy information required to their employees, contractors and other individuals.
2. What Personal Information We Process
The information processed through Legworx depends on the individual's role and how the subscribing organisation uses the service.
It may include:
Contractors and other site users
- full name;
- email address;
- account information;
- sites to which the individual has been assigned;
- documents allocated to the individual;
- records of document acknowledgements;
- dates and times of acknowledgements; and
- personal information contained within documents uploaded by a customer.
Clients and site contacts
Where applicable, this may include:
- full name;
- email address;
- site or property address;
- project information; and
- records associated with the relevant site.
Administrators
This may include:
- full name;
- email address;
- organisation;
- account and access information;
- subscription information; and
- records of administrative activity where necessary for security, audit or operation of the service.
Passwords are not stored in readable plain text.
Site and operational information
Legworx may process:
- site names and addresses;
- contractor-to-site assignments;
- RAMS and other documents uploaded by customers;
- document allocation records;
- document acknowledgement records;
- dates and times associated with those records; and
- other information required to maintain the site's compliance record.
Documents uploaded by customers may themselves contain personal information.
3. How We Obtain Personal Information
Personal information may be provided:
- directly by you, for example when creating or using an account;
- by your employer, contractor or another organisation, where they create or administer your Legworx account;
- through use of Legworx, for example when a document is allocated or acknowledged;
- by a subscribing customer, where project or site information is uploaded to the service; or
- through our website or subscription process, where an organisation contacts us, starts a trial or purchases a Legworx subscription.
4. Why We Process Personal Information
Where BG Retrofit acts as data controller, we process personal information only where we have an appropriate lawful basis.
This may include:
| Purpose | Typical lawful basis |
|---|---|
| Creating and administering customer accounts | Performance of a contract / legitimate interests |
| Providing and supporting Legworx | Performance of a contract / legitimate interests |
| Managing subscriptions and payments | Performance of a contract / legal obligation |
| Communicating about an account or service | Performance of a contract / legitimate interests |
| Maintaining security and preventing misuse | Legitimate interests / legal obligation |
| Maintaining appropriate business and financial records | Legal obligation / legitimate interests |
| Improving and troubleshooting Legworx | Legitimate interests |
Where BG Retrofit processes personal information on behalf of a Legworx customer, the customer is responsible for determining the appropriate lawful basis for that processing.
5. Document Acknowledgement Records
A core function of Legworx is maintaining records showing that particular documents have been allocated to and acknowledged by particular users.
These records may include:
- the identity of the user;
- the relevant organisation;
- the relevant jobsite;
- the document concerned;
- the acknowledgement made;
- the date and time of acknowledgement; and
- associated technical or audit information where necessary to maintain the integrity and security of the record.
These records may form part of a customer's health and safety, project-management or compliance records.
6. Subscription and Payment Information
Legworx subscriptions are processed using Stripe.
When a customer starts a trial or purchases a subscription, Stripe may collect information including:
- name;
- business name;
- email address;
- billing address;
- payment information;
- payment method; and
- transaction and subscription information.
BG Retrofit does not ordinarily receive or store complete payment-card details.
Stripe processes payment information in accordance with its own privacy and data protection arrangements.
7. How Personal Information Is Shared
We do not sell personal information.
Information may be disclosed where necessary to:
- authorised users of the subscribing organisation according to their role and site assignments;
- service providers used to operate, host, secure, communicate through or support Legworx;
- payment providers such as Stripe;
- professional advisers where reasonably necessary; or
- regulators, law enforcement agencies, courts or other authorities where required by law.
Access within Legworx is controlled according to user roles and assignments.
Contractors should only be able to access the sites and documents allocated to them and should not have access to unrelated customer projects or documents.
8. Service Providers and International Transfers
BG Retrofit may use specialist third-party providers for services including hosting, payment processing, email delivery, software infrastructure and mobile application distribution.
Some service providers may process information outside the United Kingdom.
Where personal information is transferred internationally and UK data protection law requires safeguards, we will take reasonable steps to ensure an appropriate lawful transfer mechanism is in place.
We periodically review the service providers used to operate Legworx and will update this Privacy Policy where material changes affect how personal information is processed.
9. How Long We Keep Information
We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including contractual, legal, regulatory, security and legitimate record-keeping requirements.
Generally:
- information relating to active accounts is retained while the account or subscription remains active;
- following account closure, personal information may be retained for up to 12 months before deletion or anonymisation, unless a longer period is reasonably necessary or legally required;
- financial and transaction records may be retained for applicable accounting and tax requirements; and
- site, document and acknowledgement records may need to be retained for longer where they form part of project, contractual, health and safety or compliance records.
Customers should export records they are required to retain before closing their Legworx account.
10. Data Security
We use appropriate technical and organisational measures designed to protect personal information.
These include measures such as:
- secure password hashing;
- role-based access controls;
- organisation and site access controls;
- encrypted transmission using HTTPS/TLS;
- access restrictions;
- security monitoring and maintenance; and
- measures designed to prevent unauthorised access between customer organisations.
No electronic service can guarantee absolute security.
Where a personal data breach occurs, we will assess the circumstances and comply with applicable notification requirements, including notifying the Information Commissioner's Office where required and informing affected individuals where legally required.
11. Your Data Protection Rights
Depending on the circumstances, individuals may have rights including:
- the right to access their personal information;
- the right to have inaccurate information corrected;
- the right to request deletion in certain circumstances;
- the right to restrict processing in certain circumstances;
- the right to data portability where applicable;
- the right to object to certain processing; and
- rights relating to automated decision-making.
Legworx does not currently use solely automated decision-making to make decisions producing legal or similarly significant effects about individuals.
Where BG Retrofit is the controller, requests can be made to:
Where BG Retrofit processes information on behalf of your employer, contractor or another subscribing organisation, we may need to refer the request to that organisation because it is the relevant data controller.
Valid requests will normally be responded to within one month, subject to the provisions of applicable data protection law.
12. Cookies, Website and Technical Information
The Legworx service includes both a web-based administration platform and a mobile application.
The web service may use cookies or similar technologies where technically necessary for functions such as:
- authentication;
- maintaining secure user sessions;
- security; and
- remembering appropriate settings.
Where non-essential analytics or tracking technologies are introduced, appropriate information and consent controls will be provided where required.
Our public website may have separate cookie controls relating to technologies used by the BG Retrofit website.
13. Children's Privacy
Legworx is intended for professional and business use and is not directed at children.
We do not knowingly provide Legworx accounts to children.
If we become aware that personal information relating to a child has been collected inappropriately, we will take appropriate steps to address it.
14. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes to Legworx, our service providers, our processing activities or applicable law.
Where a change materially affects how personal information is processed, we will take reasonable steps to notify affected customers or users.
The Last updated date at the top of this policy identifies the current version.
15. How to Complain
If you have concerns about how BG Retrofit handles your personal information, please contact us first at:
You also have the right to complain to the UK's data protection regulator:
Information Commissioner's Office (ICO)
Website: ico.org.uk
Telephone: 0303 123 1113
Further information about your data protection rights is available from the ICO.
This Privacy Policy applies to the Legworx web platform, mobile application and associated services operated by BG Retrofit.