Privacy notice
Effective date: 12 November 2026
BR Info Schedule ("the app"), its web page ("the page") and its server are made and run by KLO Technical Services Limited, trading as KLO Development Services, company number 16105032, registered office 23 Brook Road, Bomere Heath, Shrewsbury, Shropshire, SY4 3PU ("KLO", "we"). KLO is registered with the Information Commissioner's Office, reference ZC299134.
Your company uses BR Info Schedule to send Building Regulations information schedules to the parties on its projects, and to keep each project's Relevant Requirements Tracker. This notice explains what is kept, where, and for how long.
The short version
- Your company's library is kept on KLO's server, apart from every other company's. Only people in your company's account can see it.
- Schedules are emailed from your own mailbox, through your company's Microsoft 365. KLO doesn't see the emails.
- No advertising, no analytics, no tracking.
- Your company decides what goes in, and can delete it all (Settings › Privacy and your data).
Who is responsible for what
- Your company decides what goes into its library: its projects, the parties and their contact details, its directory, trackers and template. For that information your company is the controller, and KLO keeps it for your company as its processor. The data processing agreement (www.klodevelopmentservices.co.uk/br-info-schedule-dpa) sets out the terms.
- KLO is the controller for the few things it keeps to run the service and to licence it: who is in each account, and the licence records.
What is kept, and where
| What | Where it's kept |
|---|---|
| Your company's library: projects, parties (company, contact name, email, package), answers and tender returns, the directory, trackers, the template | On KLO's server, in your company's account only |
| The company profile: name, logo, postal address, email signature and wording | On KLO's server, in your company's account |
| Each person in the account: Microsoft sign-in name (or email address, for an email sign-in), role, "Issued by", who added them and when | On KLO's server, in your company's account |
| Who last changed each record, and when | On KLO's server, with the record |
| The project history: each change saved to a project, its parties or its tracker, with who made it, when, and what changed (which can include a party's name, email address and notes) | On KLO's server, in your company's account. It can't be changed from the app or the page |
| Competence profile. Your qualifications, memberships, project experience, training and the examples you give, if you fill them in. It is used to make your competence statement, and is seen by you and your company's admins. It is kept while your company's data is kept, and you can delete it at any time. | On KLO's server, in your company's account |
| Licences: company name, number of people, dates, reference | On KLO's server, as KLO's business records |
| A record of recent sign-ins (a one-way scrambled form of the sign-in token, the name and company), so Microsoft or the KLO account isn't asked on every request | On KLO's server, for up to one hour (ten minutes for an email sign-in) |
| For an email sign-in: your email address, the one-time codes sent to it and your sessions | On the KLO account server (Cloudflare), which KLO runs for all its apps |
| A copy of the library, so the app works with no signal, and a daily backup kept for 30 days | On each device, in the app's own folders |
| Your Microsoft or email sign-in | On a device: in its keychain (Apple's encrypted store). On the page: in that browser tab only, until you close the tab or sign out |
| The company profile and your Issued by, so the page can show them straight away | On the page: in that browser. The company profile until you sign out; Issued by until that browser's site data is cleared |
| A copy of the library and any changes not yet sent, so the page works with no signal and shows your projects before you sign in | On the page: in that browser, until someone signs out there, leaves the account or deletes the company's data. If changes not yet sent are still there when you sign out, are removed from the account, or the account you work in changes, those changes, and only those, are saved as a file in your browser's downloads first. The file is yours: pass it to the company's admin, or delete it. |
KLO's server is Cloudflare (Workers and D1), with the database in Western Europe. Cloudflare handles it under its own terms as KLO's sub-processor.
Signing in with your email instead
If your company has no Microsoft 365, you can sign in with your email address: KLO's account server emails you a 6-digit code, and BR Info Schedule's server asks it whose sign-in it is. With an email sign-in, schedules aren't emailed from your mailbox and Document Control isn't available. Someone with no account of their own can start one, as its administrator: when they first sign in, or from Settings › Company account if a client has already added them to theirs.
What the app and the page ask Microsoft for
| Permission | Why |
|---|---|
| Sign you in and read your profile (User.Read, offline_access) | To know your name, sign-in name and company, so the server can put you in your company's account, and to keep you signed in |
| Send mail as you (Mail.Send) | To email a schedule to a party from your own mailbox. It lands in your Sent Items |
| Read and write files and SharePoint sites you can reach (Files.ReadWrite.All, Sites.ReadWrite.All); SharePoint's AllSites.FullControl, approved once by your IT administrator | Document Control: to make each project's evidence site or folders in your company's SharePoint, and to put each party's request and returned files there |
| Invite guests (User.Invite.All), administrators only, approved by your IT administrator | Document Control: to invite a party's contacts into your company's Microsoft 365 as guests, so they can hand in evidence. Microsoft sends them the invitation email |
Your company's IT administrator may need to agree to BR Info Schedule once, for everyone, before anyone can send mail with it or use Document Control.
With Document Control, the sites, folders, files and guests are made in your company's own Microsoft 365, not on KLO's server. They stay there until your company removes them, including after your company's data is deleted from BR Info Schedule.
How long things are kept
- While your company has a trial or licence, its library is kept until someone changes or deletes it.
- Something deleted can be brought back from Recently Deleted for 30 days. After that its copy is wiped from the server. A marker that it was deleted stays, so devices know to remove it.
- When a trial or licence ends without renewal, the account becomes read-only. Its data is kept for 12 months so that your company can renew or take a copy. Your company's administrators are emailed at 11 months. At 12 months the data is deleted from the server.
- An administrator can delete the company's data at any time, in Settings › Privacy and your data. The library, the project history, the company profile, the members and their competence profiles are deleted from the server straight away.
- The project history is kept for as long as the company's data is kept, including after the person who made a change leaves the account, because it is the company's record of its projects. It is deleted with the company's data. "Download my data" lists the changes you made. When a deleted party's copy is wiped after 30 days, its email address, phone number and notes are also removed from the project history. Its name and what changed are kept. Names of people typed on a project or its tracker, such as dutyholders and the designated individual, stay in the history for as long as the company's data is kept.
- Kept after either kind of deletion: the licence records (company name, dates, number of people), as KLO's business records for as long as UK law requires.
- Copies on people's devices (the app's copy and its daily backups) stay on those devices until the app is removed. Backups are kept for 30 days. The page's copy in a browser stays until someone signs out there.
The page
- Where it is:
apps.klodevelopmentservices.co.uk/br-info-schedule/. - Hosting: Cloudflare. Like any web host, Cloudflare handles your IP address and browser details to deliver the page, under its own privacy policy.
- Who it talks to: once loaded, the page talks only to Microsoft, to KLO's server and, for an email sign-in, to KLO's account server. KLO adds no analytics or tracking.
Information about other people
The parties' names and email addresses are put in by your company, and schedules are emailed to them from your company's mailboxes. Your company is responsible for that information and for who it emails.
Your rights
- Your own data: Settings › Privacy and your data › Download my data gives you what the server holds about you: your sign-in name, role, Issued by, which records you last changed, the changes you made in the project history, and your competence profile. It comes as a PDF to read, or as a JSON file for another program.
- Leaving: Leave this account removes you from that company's account and deletes your competence profile there. It signs you out, or, if you're in another company's account too, moves you to it. If an administrator removes you, your competence profile is deleted in the same way. Your name stays on records you changed, as the record of who changed them. A short note that you left or were removed (your sign-in name, who removed you and when) stays with your company's account, so that you don't rejoin it unasked. It is deleted with the company's data, or when you join or start another account.
- Anything else in your company's library is your company's. Ask your company's administrator. You can also write to us, and we'll help your company answer.
- Support emails: if you email [email protected], we use your email only to answer you, and delete it when it's dealt with, unless it leads to work for you.
You can complain to the Information Commissioner's Office (ico.org.uk) if you think your information has been handled wrongly. We'd be grateful for the chance to put it right first.
Children
BR Info Schedule is for companies and their staff. It isn't meant for children.
Changes
If this notice changes, the new version is put on this page with its date.
Contact
KLO Development Services, 23 Brook Road, Bomere Heath, Shrewsbury, Shropshire, SY4 3PU. Email: [email protected].