Privacy Policy — SCI Verification

Last updated: 29 April 2026

This privacy policy describes how the SCI Verification mobile application ("the App", "we", "us") collects, uses, stores, and protects personal data. The App is operated by Supply Chain In-Sites Ltd ("SCI"), 2 Station Avenue, Bridlington, East Yorkshire, UK, YO16 4LZ (Company No. 13150053).

The App is a field data-collection tool used by approved field workers ("you", "the user") to perform verification audits — for example, deer-stalker compliance under the British Quality Wild Venison (BQWV) scheme, or low-carbon agricultural audits.

1. Data Controller

Supply Chain In-Sites Ltd is the data controller for personal data processed through the App. For any privacy-related questions, contact us at info@scinsites.com.

2. What we collect

Category	Examples	Why we collect it
Identity & contact	Full name, address, postcode, mobile phone number	To register you, identify your audit submissions, and contact you about approval status
Authentication	One-time SMS code (OTP), biometric authorization (Face ID / Touch ID / fingerprint)	To verify your identity and unlock the App. Biometric data never leaves your device.
Profile / professional	Selfie photo, certifications (e.g. DSC Level 2), insurance certificates, policy documents, estate name and address	To verify your eligibility under the relevant verification scheme
Audit content	Photographs of evidence (carcass tags, vehicles, storage, products), GPS coordinates, timestamps, free-text answers to scheme-specific questions, temperatures, weights, ammunition details	To produce the audit submission required by the scheme
Device & technical	Device model, OS version, app version, anonymized crash reports	To diagnose problems and improve the App
Location	GPS coordinates captured during active audit sessions	To geotag the audit and verify it was performed on the correct site

3. Lawful basis for processing

We process your data on the following bases under the UK GDPR / EU GDPR:

Contract performance — most data is collected because you are participating in a verification scheme that requires this evidence.
Legitimate interests — diagnostics, security, fraud prevention.
Consent — biometric login, optional photo uploads from your device's photo library, push notifications. You can withdraw consent at any time.

4. Who we share your data with

We share data only with the third-party processors needed to operate the App:

Twilio (USA) — sends the SMS one-time code to your phone. Twilio receives your phone number only.
Cloudinary (USA) — stores the photographs you submit. Cloudinary receives only the image bytes and a generated ID.
Amazon Web Services (AWS) (UK / EU regions) — hosts the database and backend servers.
Scheme operator — the scheme that you registered under (e.g. Grown in Britain for BQWV) receives your full audit submission so they can issue verification.
Authorised regulators or auditors where required by law or scheme rules.

We do not sell your data and we do not share it with advertisers.

5. International transfers

Some of our processors (Twilio, Cloudinary) are based outside the UK / EEA. Where data is transferred outside the UK / EEA we rely on the European Commission's Standard Contractual Clauses (or equivalent UK clauses) to ensure adequate protection.

6. How long we keep your data

Audit submissions — for the period required by the relevant verification scheme (typically up to 7 years for food-chain traceability).
Account data — until you request deletion, plus any retention required by law.
Authentication tokens — short-lived (15 minutes for active session, 4 hours for admin sessions); deleted on logout.
Diagnostic / crash data — 90 days.

7. Security

All network traffic is encrypted in transit using TLS 1.2+.
Sensitive items on your device (phone tokens, cached profile) are stored in the secure system keychain (iOS Keychain / Android Keystore).
The local database is encrypted at rest using SQLCipher (AES-256).
Server databases use AWS-managed encryption at rest.
Photographs are checksummed at capture (SHA-256) so any later tampering is detectable.
Access to back-end systems is restricted to a small number of authorised personnel with multi-factor authentication.

8. Your rights

Under UK / EU GDPR you have the right to:

Access a copy of the personal data we hold about you.
Rectify data that is incorrect.
Erase your account and associated personal data ("right to be forgotten"). The App provides an in-built "Delete my account" option in Settings; you can also email info@scinsites.com.
Restrict or object to processing.
Portability — receive a structured export of your data.
Withdraw consent for biometric login, photo-library access, or notifications at any time via the device's system settings or the App's Settings screen.
Lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.

9. Children

The App is intended for adult professionals working in regulated supply chains. We do not knowingly collect data from anyone under 18.

10. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of this page reflects the latest revision. Material changes will be communicated through the App.

11. Contact

Supply Chain In-Sites Ltd
2 Station Avenue, Bridlington
East Yorkshire, UK, YO16 4LZ
Email: info@scinsites.com