Privacy Policy

1. Who we are

This service is operated by Northstone. We are the data controller for the personal data described in this policy. Our data-protection contact is [TODO: DPO / data-protection contact, or 'Not applicable — no DPO required']. We are registered with the UK Information Commissioner's Office under registration [TODO: ICO registration number, e.g. ZA123456]. If you have any questions, contact us using the details in your account.

2. The data we hold

We process personal data about three groups of people:

• Staff & users — name, email, phone, job title, role and login credentials, so you can access and use the platform.
• Contractors & suppliers — contact name, company, email and phone, to coordinate work and orders on a development.
• Homebuyers — name and contact details, and the progress of the plot linked to you, so you can follow your home being built.

We also process operational build data (programmes, orders, inspections, photos, notes) which may incidentally contain personal data.

3. How and why we use it

We use this data to provide the construction-management service: running site programmes, coordinating contractors and orders, tracking quality and inspections, and keeping homebuyers informed. Our lawful bases are legitimate interests (operating the service for our customers) and contract (where we have an agreement with you). We do not sell your data or use it for advertising.

4. Who we share it with

We share data only where needed to run the service: with the housebuilder operating your development, and with our infrastructure providers who host and process data on our behalf (cloud hosting, database, email and error monitoring), all under appropriate data-processing terms. We may disclose data where required by law.

5. How long we keep it

We keep personal data only for as long as needed for the purposes above and to meet legal and warranty obligations relating to a build. [TODO: confirm retention periods per data category, e.g. account data for the life of the account; build records for N years after handover]. Some records — including audit logs and build history — are kept for their full retention period for legal, warranty and safety reasons, and are not routinely deleted.

6. Your rights

Under UK data-protection law you have the right to access, correct, or restrict the use of your personal data, to object to processing, and to data portability. The right to erasure also applies, but many of our records must be retained for legal, warranty and audit reasons and so cannot always be erased on request; where we are able to act on an erasure request we will. To exercise any of these rights, contact us using the details in your account. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

7. Cookies

We use a small number of strictly necessary cookies to keep you signed in and secure your session. These are essential to the service and do not require consent under UK law. We do not use advertising or third-party tracking cookies.

8. Keeping your data secure

Access is protected by authentication and per-role permissions, data is encrypted in transit, and we monitor for errors and unauthorised access. Only people who need it to do their job can see your data.

9. Changes to this policy

We may update this policy from time to time. The “last reviewed” date above shows when it last changed.

10. Contact

Questions about this policy or your data? Contact Northstone using the details in your account.