Pilot privacy notice

1 Who is responsible

Mr Serhat Dereli, trading as PlatformDevelopment, is the controller responsible for personal information collected through this pilot. Our geographical business address is 54 Blyth Road, Bromley, BR1 3RU, United Kingdom. Contact hello@platformdevelopment.co.uk for privacy enquiries, requests or complaints, or call +44 7387 819501.

2 What information we collect

For an application we collect first name, last name, email address, chosen project category, brief, UK and adult eligibility confirmations and terms acceptance. Business name and type, website, sector, business stage, town or region, intended audience, project objective, timescale, referral source and preferred contact method may be supplied where relevant. A mobile number is optional unless needed for a contact method you choose. We do not need your date of birth or private postal address to assess the application.

We record application status, correspondence, agreed scope, approvals, final-delivery records, rights documents and portfolio instructions. If you choose email marketing we record the choice, exact consent wording/version, timestamp and source, verification status where used, and later preference changes. We keep a minimal suppression record when you unsubscribe or object.

The service processes limited technical information to receive requests, prevent abuse and diagnose faults. Application rate-limit fingerprints are short-lived pseudonymous security identifiers; they are not anonymous and are not used to profile you. Do not submit sensitive personal information or unnecessary information about other people in your design brief.

You may attach one UTF-8 plain-text brief (.txt), up to 8 KB. We store its filename and text privately with the application, under the same access and retention rules. We do not accept executable files, PDFs, Word files, archives or images through this form. Do not attach sensitive information, identity documents or confidential third-party data.

3 Purposes and lawful bases

We review applications and take requested steps towards an individual design agreement on the basis of contract where the applicant is the proposed individual contracting party. For a company representative’s contact details, we rely on legitimate interests in responding to the organisation’s request and administering its project. We assess necessity and impact and do not assume the representative is personally a party to the contract. An automatic service email acknowledges a saved application; it is separate from promotional email and does not require a marketing subscription.

We use necessary information to deliver an accepted individual project under contract, or legitimate interests in managing a business client relationship for its representatives. Security, duplicate prevention, proportionate records of approvals and defence of genuine claims rely on legitimate interests, with safeguards and retention limits. We use legal obligation only where a specific applicable legal duty requires processing.

We send optional email marketing on consent. We use project category, stated business interests and broad sector to select relevant newsletter content only within the preferences explained when you subscribe. We do not infer health, ethnicity, religion or other sensitive traits, buy enrichment data, or make solely automated decisions with legal or similarly significant effects. Humans select pilot projects.

Public portfolio content is limited to the approved design and business material. A contractual intellectual-property licence does not itself provide a blanket lawful basis to publish personal information. If the proposed display includes identifiable personal details, we seek a separate optional specific publication choice and provide a redacted alternative. The relevant permission and withdrawal route are recorded with the approved display.

We may create genuinely anonymous totals, such as the number of enquiries by project category, to understand demand. We minimise small groups and remove identifiers so the results do not reveal applicants. We do not keep identifiable leads indefinitely by labelling them analytics.

After you confirm an optional subscription using the email link and confirmation button, we schedule three introductory emails approximately 4, 10 and 21 days later. We check your current subscription before each send, pause the sequence during an active project or sales conversation and stop it after unsubscribe, complaint or bounce. A pause, temporary service failure or sending limit may move a date later. Your project category selects relevant social, print or digital advice. We do not use individual open or click tracking. No email subscription is created from opening a link alone.

4 Who receives information and international processing

Only authorised people working on the pilot may access application records. Relevant service suppliers may process data on our documented instructions for hosting, database storage, security and authorised email delivery. We do not sell applicant lists or give another business permission to market to you.

The campaign website runs on OpenAI Sites. Form records are stored in isolated tables in the existing PlatformDevelopment Supabase project, whose database region is London (eu-west-2). Cloudflare provides website delivery and security services. The London database location does not mean all hosting, support, service logs or subprocessors remain in the UK.

Only the authorised studio owner can use the management area to view contact details and project answers. Requested marketing subscriptions are recorded separately and remain pending until email ownership is confirmed. We do not automatically enrol applicants in a promotional sequence.

Application confirmations, requested subscription verification and optional marketing emails are sent through Resend (Plus Five Five, Inc.). The message contains your first name, email address, application reference and chosen design category; it does not include your detailed brief or attachment. The sending region is Ireland. Resend also processes data in the United States and uses subprocessors; its data-processing addendum incorporates the UK Addendum to the EU Standard Contractual Clauses where applicable. Information about these safeguards is available at https://resend.com/legal/dpa or from us. Click and open tracking are not enabled. Marketing messages use your email address, first name where supplied and broad project category; your detailed brief and attachments are excluded.

Before any restricted international transfer, we must verify an applicable UK adequacy route or appropriate safeguards and the required assessment. Where safeguards are used, you may ask us how to obtain a copy. We may disclose necessary information to professional advisers or authorities where lawfully required, or to protect legal rights with appropriate safeguards.

5 How long we keep information

Unsuccessful, withdrawn or inactive application records are deleted twelve months after the later of pilot closure and the individual application closing. Records supporting an ongoing project, active sales discussion, signed agreement, documented complaint or legal hold receive a separate, documented retention review; only necessary evidence is kept. A new service request receives its own purpose and review; an old marketing interest is not a reason to keep the entire application.

For accepted projects, we retain the agreement, signed rights assignment, portfolio permission, essential approvals and necessary delivery/complaint evidence for six years after project completion or termination, with periodic minimisation. This is our proportionate recordkeeping policy, not a statement that every item must be kept for six years by law. If an approved portfolio display continues longer, we retain the minimum licence/approval evidence for its duration and review that evidence on removal.

Marketing subscriber records are reviewed at least every twenty-four months after subscription or the last meaningful interaction. We remove dormant records where continuing contact is no longer reasonably expected, and stop marketing immediately on withdrawal or objection. We do not use email-open pixels to infer activity. Evidence necessary to demonstrate a permission or resolve a complaint may be retained separately, with restricted access and a documented need.

A minimal suppression record is retained for as long as we operate the relevant marketing activity and need it to prevent accidental recontact. It contains only the necessary address or appropriately protected matching value, preference status and date. It is not used to send marketing. You may ask about this if requesting deletion.

Application rate-limit fingerprints expire and are deleted within twenty-four hours. Service-provider access and security logs are distinct from application records and are handled under the providers’ retention arrangements. Automated off-site application backups are not currently enabled. Deletion instructions and marketing suppression must be re-applied before any restored or exported copy is brought back into routine use. Contact us for information about a particular record or provider.

The email provider retains message and delivery data under its current Free-plan 30-day retention. Our application record keeps only the necessary confirmation status and provider reference with the application. Provider acceptance does not prove that a message reached an inbox. Failed confirmations may be retried automatically, with limits to avoid duplicates.

The marketing schedule retains the subscriber reference, campaign step, status, timing, delivery reference and a fixed copy of the email address, first name and project category used to render that message. This limited copy allows safe, consistent retries; it does not contain your detailed brief or attachment. These operational records follow the subscriber review policy and are deleted when no longer needed. We keep minimal consent and suppression evidence separately. A message already in transmission when a preference changes may still arrive; future scheduled messages are stopped.

Unconfirmed subscription records are removed after thirty days without a renewed request. After twenty-four months without affirmative engagement, we end an inactive marketing subscription and retain only the necessary permission and suppression evidence. Scheduled-message records are deleted within twenty-four months; saved rendering details are cleared after unsubscribe, bounce or complaint during the daily cleanup.

6 Your choices and rights

Email marketing is optional. You can decline without affecting your application, unsubscribe in any marketing email or contact hello@platformdevelopment.co.uk. Giving a phone number does not authorise promotional calls, texts or WhatsApp. We keep necessary project messages separate from marketing.

You can ask to access or correct your information, erase it where applicable, restrict processing, obtain portability where applicable, or object to processing based on legitimate interests. You have an absolute right to object to use of your personal information for direct marketing, including related profiling. We will stop that use when you object. Withdrawal of consent does not affect the lawfulness of prior processing.

We normally respond to rights requests without undue delay and within one month. Where law allows an extension for complexity or the number of requests, we explain it within the initial period. We may seek proportionate information to verify identity or clarify a request where the law permits, and will explain any effect on timing. We do not require an account or unnecessary identification documents.

Required application information allows us to assess eligibility and contact you. If you do not provide it we may be unable to process the application. Optional fields, marketing consent and permission to publish identifiable personal details are not conditions of applying.

7 Complaints

You can make a data-protection complaint by emailing hello@platformdevelopment.co.uk. Please explain your concern and preferred outcome; no formal legal wording is needed. We will acknowledge receipt within thirty calendar days, investigate without undue delay, keep you informed where needed and tell you the outcome.

You can also complain to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/ or telephone 0303 123 1113. Our internal procedure does not prevent you exercising statutory rights or seeking independent advice.

8 Security and changes

We use safeguards appropriate to the information and risks, including restricted access, secure transmission, server-side validation, limited security retention and procedures for requests and incidents. No system can promise absolute security. We do not place database administration credentials in the public website or make applicant records publicly readable.

We keep this notice under review. Material new purposes or new optional permissions will be explained before they begin. A revised notice does not retrospectively create consent or remove existing rights.