Privacy

Privacy Policy

Website, enquiries, client acceptance and RBI records · Last updated: [date to be confirmed on publication]

Draft — not yet a final policy. This page is awaiting legal review. Items marked [to be confirmed] must be verified and approved by Concept Construction Consultancy Ltd before it is published as a final statement.

Who we are

Concept Building Control is a trading name of Concept Construction Consultancy Ltd (“we”, “us”). This policy explains how we use personal information collected through this website and its secure online forms. Concept Construction Consultancy Ltd is the controller of that information.

Registered company: Concept Construction Consultancy Ltd, trading as Concept Building Control
Company number: 11700850
Registered office: Wellesly House, 1st Floor, Cranbrook Road, Ilford, Essex, IG1 4NH [confirm spelling “Wellesly” against Companies House; the office address below uses “Wellesley”]
Office address: Wellesley House, 98–102 Cranbrook Road, Ilford, Essex IG1 4NH
Privacy contact: info@conceptbc.uk · Telephone: 0203 971 4999
ICO registration: not currently registered. [Assessment of whether ICO registration and the data protection fee are required to be completed.]

What we collect

Website enquiries (“Request a quote”). Your first name, surname, email address and telephone number; the site address; your description of the proposed works and any optional message; any drawings or supporting documents you upload (PDF, JPG or PNG, up to 20 MB in total), which may themselves contain personal information; and the date and time of your enquiry with your confirmation that you have read this policy.

Client Acceptance forms (completed through a secure, quotation-specific link we send you). The project address, description of works and building height; estimated start and commencement dates and a description of the commencement works; the client’s name, correspondence address, telephone number and email address; the name, address, telephone number and email address of the Principal Designer and Principal Contractor (or your explanation if they are not yet appointed); the invoice recipient and any purchase order number; your confirmation of each declaration on the form; and the signatory’s name, duty-holder position and typed-name signature, with the date and time of submission. If you correct any details we showed you, we record both the original and the corrected values.

RBI checklists and declarations (completed by Registered Building Inspectors and Concept staff, internally or through a secure link). The checklist answers for the project; for each declaration, the name, class, registration number and date entered, and whether it was confirmed; the exact declaration wording shown at submission; and the name and email address of the person submitting through a secure link, or the staff account that submitted internally.

Quotations. When we prepare a quotation, we use the client name, company, email address, telephone number, site address and description of works already held for your project, together with the quoted fee, VAT, validity period and any scope notes and payment terms. We also record when and to which email address the quotation was sent.

Records we generate. A PDF of each quotation, and a PDF record of each submitted Client Acceptance form and RBI declaration, created from the details submitted.

Security. To protect our forms from abuse, our systems process your IP address to limit how often forms can be used. It is stored only as a one-way hashed value for rate limiting and is not stored with your submission.

Please do not include sensitive information (for example, health information) in messages or uploaded documents.

How we use it

• To review your enquiry, contact you and prepare a quote for building control services.
• To prepare your quotation and send it to you by email with our Terms & Conditions.
• To record your acceptance of a quotation and your instruction for us to submit the Initial Notice, and to set up and manage your project.
• To complete the RBI checklist and declarations required for the project and to keep a record of them.
• To notify our team by email when an enquiry, acceptance or RBI form is received.
• To keep internal notes about our contact with you, visible only to authorised Concept staff.
• To keep our website and forms secure and prevent spam.

We do not sell your information or use it for unrelated marketing. Submitting an enquiry does not automatically create a project, quote or contract.

Electronic signatures

Client Acceptance forms are signed by typing your full name, which must match the signatory’s name. We record the typed name, the signatory’s name and position, each declaration you confirmed and the date and time of submission. This is a typed-name electronic signature; it is not a handwritten signature or a certified electronic signature service. RBI declarations are confirmed by ticking a box for each declaration and are not signed. [Suitability of the signature method to be confirmed.]

Our lawful basis

We use your information to take steps at your request before entering into a contract with you and to perform that contract (UK GDPR Article 6(1)(b)); to keep the records building control regulations require (Article 6(1)(c)); and for our legitimate interests in responding to enquiries, notifying our team and protecting our website from misuse (Article 6(1)(f)). Where you give us details of other people, such as a Principal Designer or Principal Contractor, we use them for the same purposes. [Lawful bases require approval.]

Where your information is stored

This website and its forms run on Google Firebase, provided by Google. Submitted details are stored in Google Cloud Firestore, uploaded documents, our Terms & Conditions documents and generated PDF records (quotations, Client Acceptance records and RBI declarations) are stored in Google Cloud Storage, and both, together with our Cloud Functions, are located in the London (europe-west2) region. Uploaded documents and PDFs are private: they have no public links and can only be downloaded by authorised Concept staff signed in to our admin portal. Website files are delivered through Google’s global content delivery network, and the site loads fonts from Google Fonts, which means your browser’s IP address is sent to Google when you view a page.

Google may process data outside the UK; where it does, it relies on safeguards set out in its data processing terms. [International transfer arrangements and acceptance of the Google Cloud/Firebase data processing terms to be confirmed.]

Email notifications

When an enquiry, Client Acceptance or RBI form is submitted, an email is sent to our team through Resend (Resend, Inc.), a transactional email provider acting on our behalf. Enquiry emails contain your name, contact details, site address, description of works, message and the names of any uploaded documents. Client Acceptance and RBI emails contain a summary (references, names, dates and route of submission). Documents and PDFs are never attached; staff open them in the admin portal. Resend is based in the United States and may process this information outside the UK. [Resend data processing agreement, sending region and UK transfer safeguards to be confirmed.]

Quotation emails to customers. When we send you a quotation, we email you through Resend. The email contains your name, the quotation reference, the site address, the total and validity of the quotation, and a personal secure link. Through that link you can view the quotation and our Terms & Conditions and accept online; the documents are not attached to the email. We store only a one-way hashed form of the link, and if we resend the email, the earlier link stops working. Apart from quotation emails, we do not send emails to customers through this website system. [Customer quotation emails will be switched on only after this policy is approved.]

How long we keep it

Current position. Our website system does not delete enquiries, quotations, Client Acceptance records, RBI records, uploaded documents or PDF records automatically, and our staff portal does not currently provide a delete function. Removal is carried out manually by our system administrator, for example when you ask us to delete your information or when a retention period ends. The only automatic deletion is of temporary upload copies: documents you start uploading but do not submit are deleted automatically, normally within a day.

Proposed retention periods. [Final retention policy to be approved.]

• Enquiries that do not lead to a quote or project: six months from your enquiry. [Proposed period, pending clarification.]
• Quotes that are not accepted: three months. [Proposed period; confirm whether this runs from the date the quote is issued.]
• Projects: when your project goes ahead, its details are entered into AIP, the system we use to manage building control projects. We intend to remove project data from this website’s system once that transfer is complete. Information held in AIP is kept in line with our professional and legal record-keeping obligations. [Proposed workflow; AIP retention period and record-keeping obligations to be confirmed.]

Who we share it with

We share information only with our service providers (Google and Resend, as described above), where required by law, or where needed to provide the building control services you ask us for, for example including the required details in the Initial Notice submitted to the local authority. If your project goes ahead, its details are entered into AIP, the system we use to manage building control projects. [Data-sharing details to be confirmed: AIP provider and agreement, local authority and regulator submissions, and any other recipients such as partner Registered Building Control Approvers.]

Your rights

Under UK data protection law you have the right to ask for a copy of your information, to have it corrected or deleted, to restrict or object to how we use it, and to ask for it to be transferred. To make a request, email info@conceptbc.uk. We will respond within one month. Some building control records may need to be kept to meet our legal obligations even if you ask us to delete them; if so, we will tell you.

If you are unhappy with how we have handled your information, please contact us first. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.

Changes to this policy

We may update this policy. The date at the top of this page shows when it was last changed.