1. Who we are
Digimasters Ltd (“Digimasters”, “we”, “us” or “our”) runs the DBOT Estimator and is the data controller for the personal data described in this notice. This means we decide how and why that data is used.
- Registered in England and Wales, company number 10917139
- Registered office: Digimasters Ltd, Runway East, 279 Tottenham Ct Rd, London W1T 7RJ
- Registered with the Information Commissioner’s Office (ICO), registration number Z7482916
- Privacy contact: support@digimasters.co.uk
We process personal data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended by the Data (Use and Access) Act 2025. Section 13 has additional information for people in the United States.
2. What this notice covers
This notice covers the DBOT Estimator: the web app our clients and their staff use to estimate what a piece of work costs to design, build and operate. It applies to everyone who is given access to the app, and to anyone whose details are entered so that an estimate can be shared with them.
Our website, digimasters.co.uk, has its own privacy policy. Our employees and contractors receive a separate staff privacy notice.
Content that belongs to a client. The estimates and cost models in the app belong to the client they were made for. They can include the names of people assigned to a piece of work, their roles and the rates or pay bands used to cost those roles. Where we hold that content for a client, we process it on the client’s behalf under our contract with them: the client is the controller and we are their processor, and the client’s own privacy notice explains that processing. Information about Digimasters’ own staff in that content is covered by our staff privacy notice.
3. What personal data we collect
3.1 Your account
- Your name and work email address
- Which clients you can open, whether you are an administrator, and who gave you that access
- When your account was created and when you last signed in
3.2 Signing in
- If you sign in with Microsoft: the identifiers Microsoft gives us for your account and your organisation (an object id and a tenant id), your name and your email address. We never see your Microsoft password, and we do not keep any Microsoft access token.
- If you sign in with an emailed link: a record that a link was sent to you, when it expires, and when it was used. We keep only a one-way fingerprint of the link, never the link itself.
- A session cookie that keeps you signed in. It holds your email address and your level of access, and it is signed so that it cannot be altered. See our cookie notice.
3.3 Sharing and working together
- Who owns each estimate, who it is shared with and whether they can view or edit it, and who shared it
- Requests for edit rights, including any note you add, and the owner’s decision
- Anything you type into an estimate — names, descriptions and notes. Please do not enter personal data there that the estimate does not need.
3.4 The change history
Every change made in the app is recorded: who made it, when, and the record before and after the change. This includes changes to people’s access, so the history holds names and email addresses.
3.5 Emails
The app sends emails from support@digimasters.co.uk: sign-in links, invitations, notices that an estimate has been shared with you, requests for edit rights, and the outcome of those requests. They contain the names and email addresses of the people involved, the estimate and client names and, for a request for edit rights, the note written with it. We do not send marketing from the app.
3.6 Technical data
Our hosting provider records each request made to the app, including your IP address, the page asked for and your browser type, in short-lived logs used to run and secure the service. The app itself does not store IP addresses. The app uses no analytics or advertising tools, and its fonts are served from the app itself rather than from a third party.
4. Where we get your personal data from
- From you, when you sign in, use the app or contact us
- From a colleague or a Digimasters administrator, when they give you access to a client or share an estimate with you
- From Microsoft, when you choose to sign in with Microsoft
5. How we use your personal data and our lawful basis
UK GDPR requires us to have a lawful basis for each way we use your personal data. The table below sets out each purpose and the basis we rely on.
| Purpose | Personal data used | Lawful basis |
|---|---|---|
| Giving you access to the app and the clients and estimates you are allowed to see | Account details and access | Contract, where you or your employer is our client; otherwise legitimate interests in providing the service our clients have asked for |
| Signing you in and keeping the app secure | Sign-in records, Microsoft identifiers, session cookie, hosting logs | Legitimate interests in keeping the app and our clients' information secure |
| Sharing estimates and handling requests for edit rights | Names, email addresses, access levels and request notes | Legitimate interests in letting people work on estimates together |
| Sending service emails | Names, email addresses and the details in Section 3.5 | Legitimate interests in telling people about access they have been given or asked for |
| Keeping a record of every change | The change history in Section 3.4 | Legitimate interests in being able to show who changed a figure and when, and in resolving questions about it |
| Dealing with legal claims and complaints | Any relevant data | Legitimate interests in defending our legal position |
| Complying with the law and regulators | Any relevant data | Legal obligation |
Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms. You can ask us for more information about that balancing exercise, and you have the right to object (see Section 10).
We do not make decisions about you based solely on automated processing.
6. Who can see your personal data in the app
- The owner of an estimate, and anyone it is shared with, can see the owner’s name and email address.
- The owner of an estimate can see who it is shared with and any requests for edit rights.
- Digimasters administrators can see everyone with access, the clients and estimates each person can open, when they last signed in, and the change history.
7. Who we share your personal data with
We do not sell your personal data. We share it only with service providers who process it on our behalf under data processing agreements, and in the other cases listed below.
| Provider | What they do for us | Where |
|---|---|---|
| Vercel Inc. | Hosts the app and keeps its request logs | United States |
| Railway Corporation | Hosts the database that holds accounts, estimates and the change history | United States |
| Microsoft | Microsoft sign-in, if you choose it, and the mailbox the app's emails are sent from | Microsoft's cloud; see Section 8 |
- Professional advisers, including solicitors, accountants, auditors and insurers, who are bound by duties of confidentiality
- Regulators, law enforcement bodies and courts, where the law requires us to disclose information
- A buyer or investor, if we sell or restructure all or part of our business, under strict confidentiality
8. International transfers
The app and its database are hosted in the United States, so your personal data is stored and processed outside the UK. Microsoft may also process sign-in and email data outside the UK.
When personal data is transferred outside the UK, we make sure it is protected by one of the following:
- a UK adequacy decision (UK adequacy regulations), including the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”) where the US recipient is certified under it
- the International Data Transfer Agreement (IDTA) or the International Data Transfer Addendum to the EU Standard Contractual Clauses, both issued by the ICO
You can ask us for more information about the safeguards used for a particular transfer by emailing support@digimasters.co.uk.
9. How long we keep your personal data
| Type of data | How long we keep it |
|---|---|
| Your account | For as long as you have access to the app. When your access ends, or if you ask us, we delete it within one month - except that your name stays in the change history (below). |
| Sign-in links | A link works once and for 15 minutes. Our record of it is deleted within a day. |
| Session cookie | 12 hours, or until you sign out. See our cookie notice. |
| Estimates, shares and requests for edit rights | For as long as our contract with the client the estimate was made for, then deleted or returned to the client as that contract says. |
| Change history | For as long as our contract with the client, plus six years, for legal and accounting purposes. |
| Emails the app sends | A copy is kept in the mailbox they are sent from for up to two years. |
| Hosting request logs | A short period set by our hosting provider, measured in days. |
| Settings kept in your browser | On your device until you clear them. See our cookie notice. |
At the end of each period we securely delete your personal data or anonymise it so that it can no longer be linked to you. We review the data we hold regularly to make sure these periods are applied.
10. Your rights
Under UK GDPR you have the right to:
- Access a copy of the personal data we hold about you
- Rectification of inaccurate or incomplete data
- Erasure of your data, unless we have to keep it for legal reasons
- Restriction of how we use your data in certain circumstances
- Data portability, meaning you can receive data you gave us in a structured, machine-readable format
- Object to our use of your data where we rely on legitimate interests
To exercise any of your rights, email support@digimasters.co.uk. There is no charge. We will respond without undue delay and within one month. The month starts when we receive your request, or when we have confirmed your identity if we need to. If your request is complex or you make several requests, we may extend this by up to two further months and we will tell you why within the first month. If we need you to clarify what information you are asking for, we may pause the time limit until you reply.
If your request is about content we hold for a client (see Section 2), we will pass it to that client and help them respond, as our contract with them requires.
11. How to complain
If you are unhappy with how we have handled your personal data, please tell us first so that we can try to put things right. You can complain to us:
- by email: write to support@digimasters.co.uk with “Data protection complaint” in the subject line
- by writing to Data Protection, Digimasters Ltd, Runway East, 279 Tottenham Ct Rd, London W1T 7RJ
We will acknowledge your complaint within 30 days of receiving it. We will then investigate, keep you updated on our progress, and give you our response without undue delay.
You also have the right to complain to the Information Commissioner’s Office (ICO) at any time, at ico.org.uk/make-a-complaint or by calling 0303 123 1113. The ICO will usually expect you to have raised your complaint with us first.
12. How we protect your personal data
We use appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration or disclosure. In the app these include:
- encrypted connections (HTTPS) between your browser and the app
- access by invitation only: signing in gives no access by itself, and each estimate is visible only to its owner, the people it is shared with and, where its owner chooses, the client’s team
- a session cookie that scripts on the page cannot read, which is signed so that it cannot be altered and which expires after 12 hours
- sign-in links that work once, expire after 15 minutes and are stored only as a one-way fingerprint
- checks on the server, for every change, that the person making it is allowed to
- a record of every change, visible only to administrators
If a personal data breach is likely to result in a risk to your rights and freedoms, we will report it to the ICO within 72 hours of becoming aware of it. If the risk to you is high, we will tell you directly without undue delay. Where a breach affects people outside the UK, we will also meet the notification requirements of the laws that apply to them, including US state breach notification laws.
13. Information for people in the United States
- Effective date. This notice is effective from the “Last updated” date shown at the top of the page.
- Categories of information and who we share it with. These are described in Sections 3 and 7. We do not sell or share personal information for targeted advertising.
- Reviewing and correcting your information. You can ask to see or correct the personal information we hold about you by emailing support@digimasters.co.uk.
- Do Not Track. The app does not track you across websites and does not allow third parties to do so, so there is nothing for a Do Not Track signal to switch off.
- Data breaches. If a data breach affects your personal information, we will notify you and any relevant state authority as required by the breach notification law of the state where you live.
14. Cookies
The app uses one cookie to keep you signed in, one while you sign in with Microsoft, and storage in your browser to remember your settings. Our cookie notice lists them.
15. Changes to this notice
We may update this notice to reflect changes in the law, the app or our practices. The current version will always be on this page, with the date it was last updated. If we make significant changes, we will tell the people using the app directly where we can.
16. Contact us
If you have any questions about this notice or how we handle your personal data, please contact:
Data Protection, Digimasters Ltd
Runway East, 279 Tottenham Ct Rd, London W1T 7RJ
Email: support@digimasters.co.uk