Version 1.2 · in force from 2026-09-06
Effective date: 1 September 2026
1. Who we are
CELCO GROUNDWORKS & CONSTRUCTION LIMITED, trading as CostTakeoff, is the data controller for the personal data described in this policy.
- Company number: 823396 (Ireland)
- Registered office: 40 Bay Meadows Avenue, Dublin 15, D15 Y66T, Ireland
- Contact for data protection: info@costtakeoff.com
We have not appointed a Data Protection Officer. We are not required to.
2. When we are a controller, and when we are a processor
This distinction matters, because the Service holds two different kinds of personal data.
We are the controller of the data we hold about you as our customer: your account details, your subscription, your correspondence with us, and how you use the Service. This policy describes that data.
We are a processor of the personal data you put into the Service about your own clients, projects and contacts — the names, addresses and contact details that appear on the quotations, invoices, applications and statements you produce. You are the controller of that data. We process it on your instructions, to provide the Service to you. If you need a data processing agreement covering that relationship, contact us.
3. What we collect, why, and on what legal basis
Account and identity data — name, email address, password credentials (held by our authentication provider, not by us in readable form), and the firm or team you belong to. Purpose: to create and operate your account. Legal basis: performance of our contract with you (Art 6(1)(b)).
Subscription and billing data — plan, seat count, subscription status, renewal dates, and the transaction references our payment provider gives us. We do not receive or store your card number. Purpose: to provide and administer your subscription. Legal basis: performance of our contract with you, and compliance with our legal obligations in relation to accounting and tax (Art 6(1)(b) and (c)).
Content you create — drawings you upload, measurements, figures, documents and settings, together with the personal data of your own clients that you choose to put into them. Purpose: to provide the Service. Legal basis: performance of our contract with you; and as processor, on your instructions in respect of your clients' data.
Correspondence — messages you send us through the support form or by email, our replies, and the record of the conversation. Purpose: to answer you and to keep a record of what was asked and answered. Legal basis: performance of our contract, and our legitimate interest in supporting and improving the Service (Art 6(1)(f)).
Technical and usage data — IP address, browser and device information, log records, error reports, and records of email we send you and what our email provider reports about its delivery. Purpose: to keep the Service running, to diagnose faults, to protect against abuse, and to know whether a message we sent you arrived. Legal basis: our legitimate interest in the security, integrity and reliability of the Service (Art 6(1)(f)).
Cookies and similar technology — see our Cookie Policy.
We do not collect special category data, and you should not put it into the Service.
4. Who we share it with
We do not sell personal data and we do not share it for advertising.
We use the following categories of service provider, each of which processes personal data on our behalf under contract:
- Payments — Paddle.com Market Limited, our Merchant of Record, who is a separate controller for the payment transaction and operates its own privacy policy.
- Authentication — our sign-in provider, which holds credentials.
- Hosting and storage — our infrastructure and object storage providers, located in the EU.
- Backup storage — an off-provider backup service.
- Email — our outbound email provider and our inbound mail provider.
A current list of our sub-processors is available on request from info@costtakeoff.com.
We may also disclose personal data where we are required to by law, or where it is necessary to establish, exercise or defend legal claims.
5. International transfers
Our infrastructure is located in the European Economic Area.
Some of our service providers are established outside the EEA or may process data outside it. Where that happens, the transfer is made under a transfer mechanism recognised by Chapter V of the GDPR, such as Standard Contractual Clauses or an adequacy decision. Details are available on request.
6. How long we keep it
Your account and content — for as long as your account is open.
After you delete your account — your content is removed from the live Service promptly, and from our backups in the ordinary course of their rotation, within thirty days.
Billing and accounting records — kept indefinitely, and not affected by account deletion. Irish tax and company law requires us to keep these for at least six years (Companies Act 2014 s.285; Value-Added Tax Consolidation Act 2010 s.84(3); Taxes Consolidation Act 1997 s.886(4)(a)(i)). We keep them for longer than that: no timetable removes them, and they are deliberately left in place when an account is deleted. We do that so that a record of what was invoiced, credited and paid still exists if it is ever needed — by you, by us, or by a tax authority. The six-year minimum is the law; keeping them beyond it is our own choice, not a legal requirement. We cannot delete them on request for as long as the statutory period runs, and we do not delete them after it.
Support correspondence — for as long as it is useful to answer follow-up questions, and then deleted.
Technical logs — for a limited period appropriate to diagnosis and security.
Deletion is permanent. We do not maintain a copy of your work after your account is deleted. If you are required by law, by a professional body, or by contract to keep records of the invoices, claims or statements you produced, keep your own copies. Export before you delete.
7. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- rectify it where it is inaccurate;
- erase it, subject to records we are legally required to keep;
- restrict or object to our processing, including any processing based on legitimate interests;
- portability — receive the data you gave us in a structured, commonly used, machine-readable form;
- withdraw consent, where we rely on consent.
The Service provides tools for exporting and for deleting your account. You may also write to info@costtakeoff.com. We will respond within one month.
Where you are asking about personal data of your own clients held inside your account, you are the controller of that data and the request should be directed to you; we will assist you as processor.
8. Complaints
If you are unhappy with how we handle your personal data, please tell us first at info@costtakeoff.com.
You also have the right to complain to the Irish Data Protection Commission:
Data Protection Commission 6 Pembroke Row, Dublin 2, D02 X963, Ireland dataprotection.ie
9. Security
We hold data on infrastructure in the EEA, encrypt data in transit, restrict administrative access, keep backups with immutability protection, and log administrative actions. No service is perfectly secure, and we do not represent that ours is.
If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Data Protection Commission within 72 hours where required, and notify you where the risk is high.
10. Children
The Service is not offered to anyone under 18 and we do not knowingly collect data from children.
11. Changes
We may update this policy. Where a change materially affects how we use your personal data, we will tell you before it takes effect. The effective date above shows when this version came into force.