Skylark Privacy Notice
Skylark Control Ltd | Date Created: 06-05-2026 | Last Updated: 22-05-2026
1. About This Notice
This Privacy Notice explains how Skylark Control Ltd collects, uses, stores, and shares your personal data. It covers two contexts:
- Website visitors — individuals browsing https://www.skylarkcontrol.com/ and related pages
- Platform users and customers — individuals who hold or use an account on the Skylark Platform
If you are a worker or contractor whose data has been submitted to the Skylark Platform by an organisation using our services, that organisation is the Data Controller for your data. The relevant Data Controller is the organisation that operates the site and uses the Skylark Platform to manage site access, which may be your direct employer or a site owner organisation that your employer works with. Please contact that organisation to exercise your rights in respect of that data. If you are unsure which organisation is responsible for your data on the Skylark Platform, or if you have been affected by an automated certificate or competency decision, see Section 11 for more information.
We reserve the right to update this Privacy Notice from time to time. Where changes are material, we will notify registered account holders by email before they take effect.
2. Who We Are
Data Controller: Skylark Control Ltd Registered Number: NI651111 Registered Office: C/O Dnt Chartered Accountants Ormeau House, 91-97 Ormeau Road, Belfast, County Antrim, Northern Ireland, BT7 1SH, Postal address: 51, 55 High St, Antrim BT41 4AY VAT Number: 297150090
ICO Registration: Skylark Control Ltd is registered with the Information Commissioner's Office as a data controller under registration number ZB346015.
Data Protection Officer / Privacy contact: [[email protected]]
If you have any questions about how we process your personal data, or wish to exercise your rights, please contact us at the address or email above.
3. Personal Data We Collect and Why
3.1 Website Visitors
When you visit our website we may collect the following data:
| Data | Purpose | Lawful Basis |
|---|---|---|
| IP address and technical browsing data | Security monitoring, fraud prevention, and website analytics | Legitimate interests (Art. 6(1)(f)) |
| Contact information submitted via enquiry forms (name, email, organisation) | Responding to your enquiry | Legitimate interests (Art. 6(1)(f)) or pre-contractual steps (Art. 6(1)(b)) |
| Cookie and behavioural data (pages visited, time on site, referral source) | Website analytics and improvement | Consent (Art. 6(1)(a)) for non-essential cookies; Legitimate interests for strictly necessary cookies |
| Email address for marketing communications | Sending information about our products and services | Consent (Art. 6(1)(a)) |
You can withdraw consent for marketing communications at any time by clicking the unsubscribe link in any email we send, or by contacting us at [[email protected]].
3.2 Platform Account Holders and Users
When you create or use an account on the Skylark Platform, we process the following data in our capacity as Data Controller:
| Data Category | Types of Personal Data | Purpose | Lawful Basis | Retention |
|---|---|---|---|---|
| Account and identity data | Name, email address, mobile number, organisation name, login credentials | Platform delivery, user authentication, and account administration | Performance of contract (Art. 6(1)(b)) | Duration of contract + 6 years |
| Usage and behavioural data | Work orders processed, session data, timestamps, audit trail entries generated by user actions | Service support, platform improvement, and security monitoring | Legitimate interests (Art. 6(1)(f)) | 12 months rolling |
| Technical data | IP addresses, device types, browser types, API keys, integration configuration data | Service security and fraud prevention | Legitimate interests (Art. 6(1)(f)) | 12 months rolling |
| Billing and commercial data | Subscription details, payment records, contract-related information | Contract management and legal obligation | Performance of contract (Art. 6(1)(b)); Legal obligation (Art. 6(1)(c)) | 6 years from date of transaction |
Legitimate interests balancing: Where we rely on legitimate interests, we have carried out a balancing assessment and are satisfied that our interests are not overridden by your rights and interests. You have the right to object to processing based on legitimate interests at any time — see Section 7.
Retention principles. Retention periods are determined by reference to the purpose for which the data was collected, the nature and sensitivity of the data, the risk of harm from unauthorised use or disclosure, and any applicable legal, regulatory or limitation periods. The specific periods applicable to each data category are set out in the table above.
Required data. Account and identity data, and billing and commercial data, are required for us to deliver the Platform and to meet our legal obligations. Where these categories are not provided, we may be unable to provide the relevant services.
Data minimisation. We only collect and process personal data that is adequate, relevant, and limited to what is necessary for the purposes described in this notice, in accordance with the data minimisation principle under UK GDPR Article 5(1)(c)
3.3 Location Data (Skylark Mobile App)
Where the Skylark mobile app is used to access a site, the app captures a snapshot of the device's last known location at the point of site check-in and at regular waypoint intervals during site activity. Location tracking is not continuous — it is limited to these specific check-in events.
The purpose of location capture is worker safety on hazardous sites. Workers check in at regular intervals so that the customer's operations control centre can confirm that no worker has been left without support and can take appropriate action, including emergency response, if a worker cannot be contacted. The check-in interval is configurable by the customer and defaults to 4 hours; workers may also send a check-in at any time. Where no check-in is received within the configured interval, an alert is sent to the customer's operations control centre. Skylark provides this functionality but does not itself monitor workers or direct any response.
The lawful bases for this processing are the customer's legitimate interest in the safety and welfare of workers on hazardous sites (Art. 6(1)(f)), and vital interests (Art. 6(1)(d)) where location data is accessed in connection with an emergency response. Location data is processed as Customer Data and is governed by the MDPA and the customer's own retention instructions.
4. Cookies
This section applies to visitors to our website. If you are a platform account holder, cookies are not used to track your activity within the Skylark Platform.
Cookies are small text files placed on your device when you visit our website. We use cookies to:
- Keep the website functioning correctly (strictly necessary cookies)
- Understand how visitors use our website (analytics cookies)
Strictly necessary cookies are set automatically as they are essential for the website to work. They do not require your consent.
Analytics cookies are only set with your consent, which you can give or withdraw at any time through our cookie preference tool on the website.
You can also manage or delete cookies through your browser settings:
Disabling cookies may affect the functionality of parts of our website.
5. Who We Share Your Data With
5.1 Sub-processors
We use a limited number of third-party service providers (sub-processors) to deliver the Skylark Platform and our website. Where these providers process personal data on our behalf, we have data processing agreements in place that require them to process data only on our instructions and to maintain appropriate security measures.
Our current sub-processors are listed in the Skylark Control Sub-processor Register, which is available to Skylark customers on request. We will provide advance notice of any changes to our sub-processors in accordance with our MDPA.
We do not sell your personal data to third parties.
5.2 Legal Obligations and Law Enforcement
We may disclose personal data where required to do so by law, by court order, or by a regulatory authority. We will cooperate fully with law enforcement authorities and courts in accordance with our legal obligations.
5.3 Business Transfers
In the event of a merger, acquisition, or sale of all or part of our business, personal data held by us may be transferred to the acquiring organisation. We will notify affected users before any such transfer takes effect.
6. International Transfers
Our policy is to minimise international transfers of personal data. Where a choice exists, we select sub-processors that process and store data within the United Kingdom or European Economic Area. Where a sub-processor outside the UK or EEA is used - for example, certain communications and productivity services that process data on infrastructure outside these regions - we ensure that an appropriate transfer mechanism is in place before any transfer takes place, such as a UK adequacy regulation, the EU-US Data Privacy Framework (DPF), the UK-US Data Bridge, an International Data Transfer Agreement (IDTA), or Standard Contractual Clauses (SCCs). Where the mechanism is an IDTA or SCCs, a Transfer Impact Assessment is completed before the transfer commences. The applicable transfer mechanism for each sub-processor is identified in the Sub-processor Register.
6.1 EU Representative (Article 27 EU GDPR)
Where we process the personal data of individuals located in the European Union, we have appointed a representative in the EU under Article 27 of the EU GDPR. EU-based individuals and EU supervisory authorities may contact our EU representative on all matters relating to the processing of personal data:
EU Representative: Data Protection Officer, Skylark Control Ltd
Email: [email protected]
The EU representative acts on Skylark Control's behalf in respect of EU GDPR obligations. The appointment of an EU representative does not affect Skylark Control's own responsibility or liability under EU GDPR.
7. Your Rights
The rights in this section apply to personal data we hold about you in our capacity as Data Controller. If your data was submitted to the Skylark Platform by another organisation (for example, your employer or contracting organisation), please direct your rights request to that organisation — see the note at the end of this section.
Under UK GDPR you have the following rights in respect of personal data we hold about you as Data Controller:
| Right | What it means |
|---|---|
| Access | You can request a copy of the personal data we hold about you |
| Rectification | You can ask us to correct inaccurate or incomplete data |
| Erasure | You can ask us to delete your personal data in certain circumstances |
| Restriction | You can ask us to restrict processing of your data in certain circumstances |
| Portability | You can ask us to provide your data in a structured, commonly used, machine-readable format |
| Object | You can object to processing based on legitimate interests or for direct marketing purposes |
| Withdraw consent | Where processing is based on consent, you can withdraw it at any time without affecting prior lawful processing |
| Automated decision-making | Where a decision that significantly affects you is made solely by automated means, you have the right to request human review, express your view, and contest the decision. On the Skylark Platform, automated certificate and competency checking is carried out by Skylark on behalf of, and under the instructions of, the organisation that submitted your data to the platform. That organisation is the Data Controller for this processing. Please contact them directly to exercise this right or to request human review of a decision. |
To exercise any of these rights, please contact us at [[email protected]]. We will respond within 30 days of receiving your request. Where the request is particularly complex, or where multiple requests have been made by the same data subject, we may extend the response period by up to a further two months. Where we extend the response period, we will notify you within 30 days of the original request and explain the reason for the delay.
Where you ask us to correct inaccurate or incomplete personal data, we will action the rectification within 30 days. Where the data has been disclosed to a third party, we will inform that third party of the rectification.
We may ask you to verify your identity before we action a request. All rights requests are provided free of charge.
Where it is not technically possible to delete personal data in full at the point an erasure right is exercised — for example where copies remain within an off-site backup pending its scheduled purge — appropriate access restrictions are applied to prevent further use of the data until deletion completes.
Note for workers and contractors: If your data has been submitted to the Skylark Platform by an organisation using our services, please direct your rights requests to that organisation. We will redirect any requests we receive and provide such assistance as is required under applicable data protection law.
8. How We Keep Your Data Secure
We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. The Skylark Platform operates under ISO 27001 certified information security management and holds Cyber Essentials Plus certification. Details of the scope and currency of these certifications are set out in the Security Policy published at https://admin.skylarkcontrol.com/legal/security-policy.html
For processing activities that present a high risk to individuals — including automated certificate checking and the processing of special category data — we have conducted Data Protection Impact Assessments in accordance with UK GDPR Article 35.
If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours and will notify affected individuals where required by law.
9. Links to Other Websites
Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of those websites. We recommend you read the privacy notices of any website you visit from a link on our site.
10. Contact Us and Complaints
If you have any questions, concerns, or complaints about how we handle your personal data, please contact our Data Protection Officer at:
Email: [[email protected]] Post: Data Protection Officer, Skylark Control Ltd, 51, 55 High St, Antrim BT41 4AY
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Website: https://ico.org.uk/make-a-complaint/ Telephone: 0303 123 1113 Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
If you are located in the European Economic Area, you may instead lodge a complaint with the supervisory authority in your country of residence. Contact details for EEA supervisory authorities are available at https://edpb.europa.eu/about-edpb/about-edpb/members_en.
We would ask that you contact us in the first instance so that we can address your concern directly.
11. The Skylark Platform and Customer Data
Where customers use the Skylark Platform to process personal data relating to their own workers and contractors, Skylark Control acts as a Data Processor on the customer's instructions. That processing is governed by the Skylark Control Master Data Processing Agreement (MDPA) published at https://admin.skylarkcontrol.com/legal/master-data-processing-agreement.pdf, not by this Privacy Notice.
The MDPA sets out the categories of data processed, the technical and organisational measures applied, sub-processor arrangements, breach notification obligations, data subject rights assistance, and retention and deletion procedures applicable to customer data.
Where that processing includes special category data, such as medical fitness certificates, the Company's obligations as Data Processor are additionally documented in the Skylark Control Appropriate Policy Document (APD1), maintained in accordance with DPA 2018 Schedule 1 Part 4 and published at https://admin.skylarkcontrol.com/legal/appropriate-policy.pdf.
Information for workers and contractors affected by automated processing
Where you have been notified that you cannot accept or start a work order, this is because an automated check has found that you do not hold a current approved certificate or competency required by the organisation managing that work. That organisation is the Data Controller for this processing, defines the certification requirements, and is responsible for informing you of automated decisions and providing access to human review.
Where your data includes medical fitness certificates, those certificates have been submitted to the platform at the request of that organisation, which determines whether such certificates are required and is responsible for the lawful basis for their processing. Skylark processes them solely as Data Processor on that organisation's instructions.
To contest a decision, request human review, or exercise any right in respect of data submitted to the platform by another organisation, please contact that organisation directly. Skylark will redirect any request we receive that falls within their responsibilities as Data Controller.
Document owner: Karol Harkin (Data Protection Officer)
Published at: https://admin.skylarkcontrol.com/legal/privacy-notice.html