Data protection notice: signing in to BCOS
This notice explains what information MC Plan & Site Services Ltd (“we”) collects when you sign in to the BCOS system, why we collect it and how long we keep it. We are the data controller for this information under the UK General Data Protection Regulation and the Data Protection Act 2018.
What we collect
- Your account details: your name, email address and access level, as set up by your BCOS administrator.
- Your password: stored only as a one-way encrypted value (Argon2id). Nobody, including our staff, can read it.
- Sign-in records: the date and time of each sign-in, sign-out, failed attempt and password change, with the IP address it came from.
- Password reset requests: when a reset link was requested and used. The link itself is stored only in a one-way encrypted form and stops working after 60 minutes or once it has been used.
Signing in with Google or Microsoft
If you choose “Sign in with Google” or “Sign in with Microsoft”, you sign in on Google's or Microsoft's own page. They then send us your email address, whether that address is verified, and a unique identifier for your account. We use these only to match you to your existing BCOS account and to recognise you next time. We do not receive your Google or Microsoft password and we cannot access your email, files, contacts or any other data in those accounts. Google and Microsoft process your sign-in under their own privacy policies: Google Privacy Policy and Microsoft Privacy Statement.
Cookies
We use only cookies that are strictly necessary to keep you signed in and to protect the forms: a signed session cookie that expires after 8 hours, and short-lived security cookies used while a form or a Google/Microsoft sign-in is in progress. We do not use these cookies for advertising or tracking.
Why we use this information
We use it to give authorised users access to BCOS, to keep the system and the personal data in it secure, to detect and investigate misuse, and to keep an audit trail. Our lawful basis is our legitimate interest in operating and securing our business systems, and, for staff and contractors, the performance of your employment or service contract.
How long we keep it
Account details are kept while you have access to BCOS. Sign-in records are kept in the system audit log for as long as they are needed for security and audit purposes.
Your rights
You have the right to ask for a copy of your information, to have it corrected, and in some circumstances to have it deleted or to object to how it is used. To make a request, contact your BCOS administrator at MC Plan & Site Services Ltd. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.