Privacy notice

In short

• We only keep what we need to share your project documents with you.
• Your documents are stored privately in the UK, and only you, anyone else on your project, and SSK Architects can see them.
• We don't use advertising, analytics or tracking cookies, and we never sell your information.
• When your project finishes, or whenever you ask us to, we delete it from the portal, along with your login.

Who we are

The portal is run by SSK Architects Ltd, registered in England and Wales (company number 03899628), 43 Buckland Rise, Pinner, HA5 3QS. We are the “controller” of the personal information in the portal, which means we decide how it is used and are responsible for looking after it.

Questions about your information: email sandeep@sskarchitects.co.uk or write to us at the address above.

What information we keep

• Your name and email address, so you can sign in and so we can email you when there's something new.
• Your project details: the project name, the site address and our reference.
• Documents we share with you, such as drawings, contracts, fee proposals, planning and building control documents, and photographs. These may contain personal information, for example names and addresses.
• A record of activity, such as when you signed in, when a document was added, and when you first opened each document. This helps us know you've received what we sent, and keeps the portal secure.
• Security information: to stop people repeatedly trying to break in, we briefly count sign-in attempts. We store these counts in a scrambled form, not as your email or internet address, and clear them within a day. Our hosting providers also keep short-term technical logs, which include internet addresses.

We don't ask for, or want, payment details or sensitive information through the portal.

Why we use it (our legal basis)

• To provide the service we've agreed with you: sharing your project documents with you is part of our work for you (the legal basis is “contract”).
• To keep the portal secure and keep a record of what was shared and when: this is in our legitimate interests, and in yours.
• If you're on a project but aren't our client yourself (for example, your partner signed our appointment), we rely on legitimate interests: you've been added so you can see the project documents too.

Who else handles it

We use a small number of trusted services to run the portal. They only use your information to provide their service to us:

• Supabase stores the portal's information and your documents, in London (UK), and handles sign-in. Its support team works around the world, so if we ask them for help, staff outside the UK may be able to see information while they help us.
• Vercel runs the portal website. Its servers for the portal are in London; as a US company it may also process technical information, such as internet addresses, outside the UK.
• Resend sends the portal's emails (sign-in links and “new documents” emails). It stores email records in the United States and keeps them for 30 days.

Each of these companies has a data processing agreement with us, which requires them to keep your information safe and only use it to provide their service. Where information goes outside the UK, it is protected by UK-approved safeguards: the UK International Data Transfer Addendum, and the UK Extension to the EU-US Data Privacy Framework.

We don't share your information with anyone else, unless the law requires it. We never sell it or use it for marketing.

How long we keep it

• Your project, its documents and your login are kept while we're providing our services to you. We delete them from the portal when our services end, or sooner if you ask us to.
• Deleted information can stay in our storage provider's backups for up to 7 days before it's gone for good.
• Email records held by Resend are deleted after 30 days.
• The portal is a convenient way to share documents; it isn't our archive. We keep our own business records of your project separately, as our professional obligations require.

Cookies

The portal uses only essential cookies that keep you signed in. Without them, you couldn't use the portal, so we don't need to ask for your consent. We don't use any analytics, advertising or tracking cookies, and the portal doesn't load anything from Google or social media sites.

Keeping it safe

Documents are stored privately and are never public. Each time you open one, the portal checks you're allowed to see it and then gives you a link that only works for a few minutes. These rules are built into the database itself, not just into the pages you see. Sign-in is by a one-time link or code sent to your email, so there are no passwords to steal.

Your rights

You have the right to:

• ask for a copy of the information we hold about you;
• ask us to correct anything that's wrong;
• ask us to delete your information, or to stop or limit how we use it;
• object to how we use it, where we rely on legitimate interests;
• ask for your information in a format you can take elsewhere.

To use any of these rights, contact us (details above). We'll reply within one month. Some rights have limits; for example, we may need to keep some records for legal reasons, and we'll explain if so.

Concerns and complaints

If you're unhappy with how we've handled your information, please tell us first, using the contact details above. We'll acknowledge your complaint, look into it, and let you know the outcome.

You can also complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.

Changes to this notice

If we change this notice, we'll update the date at the top. If a change is significant, we'll let you know by email.