Privacy notice

Effective 24 August 2026 · Privacy notice for DrainCode users, survey contacts and people incidentally captured in survey evidence.

Who we are

Utility Mapping Group (UK) Limited (company number 11134524), Fulford House, Newbold Terrace, Leamington Spa, Warwickshire CV32 4EA, operates DrainCode. Contact: info@u-map.co.uk. Depending on the engagement, Utility Mapping may act as controller or process survey data for a client under written instructions.

Data and purposes

• Staff identity, work email, role, organisation membership and account-security records to authenticate and administer access.
• Client, site, job, asset, manhole, pipe-run, coding, grade, remark and report data to perform and evidence drainage/utility survey services.
• CCTV video, still frames, documents and location context, which may incidentally show people, vehicles, addresses or other personal data.
• Review decisions, model suggestions, uploads, exports and audit events for quality, security, dispute handling and accountability.
• Technical logs, IP/device information and fault diagnostics to keep the service secure and available.

Lawful bases

Processing may be necessary for contract performance, legitimate interests in delivering and improving secure professional services, compliance with legal obligations, or establishment/exercise/defence of legal claims. Where a client is controller, its lawful basis and instructions also apply. We do not rely on consent where it would not be freely withdrawable; separate, recorded organisation opt-in controls cross-company AI training.

AI and meaningful human review

DrainCode may sample frames and propose defect classes, boxes, chainages or confidence scores. Suggestions can be wrong and are not issued automatically. A trained person must inspect the underlying evidence and may confirm, edit or reject the result. DrainCode is not intended to make solely automated decisions producing legal or similarly significant effects about individuals.

Organisation survey data remains tenant-isolated. Raw CCTV is not pooled across organisations by default. Only eligible labelled frames may enter a cross-company training view after recorded organisation opt-in; consent can be revoked prospectively, subject to lawful retention and already trained model governance.

Recipients and international access

Authorised Utility Mapping staff and approved client users receive role-limited access. Service providers include Supabase (database/authentication), Cloudflare (private R2 storage and security) and Vercel (application hosting). Additional AI providers must be approved, contractually controlled and disclosed before production use. We assess data location, subprocessors, security and appropriate UK transfer safeguards where data can be accessed outside the UK.

Retention and deletion

Retention is based on client instructions, contractual/professional-liability needs, legal holds and data minimisation. Current organisation defaults allow CCTV retention around 24 months after completion and evidence/report records up to approximately six years, but a project contract may require a different period. Soft-deleted records enter a controlled deletion process; backups and legal-hold copies expire under their own schedules. Account deletion does not automatically erase company survey evidence or audit records that the organisation must retain.

Security

Controls include private object storage, short-lived upload grants, encryption in transit and at rest, organisation row-level security, least-privilege roles, audit trails, restricted @u-map.co.uk access and recovery procedures. No system is risk-free. Suspected loss, wrong-recipient disclosure or unauthorised access must be reported immediately to the contact above.

Your rights

Subject to applicable exemptions, individuals may request access, correction, erasure, restriction, objection, portability and information about automated processing. We may need to verify identity and determine whether Utility Mapping or a client should answer. You may complain to the UK Information Commissioner’s Office at ico.org.uk.

Children and changes

DrainCode is a business service and is not directed to children. We will date material changes and provide additional notice where required.