Pilot privacy notice

1 Who is responsible

The controller is {{LEGAL_OPERATOR_NAME}}, a {{LEGAL_OPERATOR_FORM}}, trading as Platform Development, at {{GEOGRAPHICAL_BUSINESS_ADDRESS}}. {{REGISTRATION_DISCLOSURES}} Contact hello@platformdevelopment.co.uk for privacy enquiries, requests or complaints. We do not claim to have appointed a statutory data protection officer or hold an ICO registration unless verified.

2 What information we collect

For an application we collect first name, last name, email address, chosen project category, brief, UK and adult eligibility confirmations and terms acceptance. Business name and type, website, sector, business stage, town or region, intended audience, project objective, timescale, referral source and preferred contact method may be supplied where relevant. A mobile number is optional unless needed for a contact method you choose. We do not need your date of birth or private postal address to assess the application.

We record application status, correspondence, agreed scope, approvals, final-delivery records, rights documents and portfolio instructions. If you choose email marketing we record the choice, exact consent wording/version, timestamp and source, verification status where used, and later preference changes. We keep a minimal suppression record when you unsubscribe or object.

The service may process limited technical information to receive requests, prevent abuse and diagnose faults. Application rate-limit fingerprints are short-lived pseudonymous security identifiers; they are not anonymous and are not used to profile you. The provider log and storage inventory must be verified before release. Do not submit sensitive personal information or information about other people that is unnecessary for your design.

3 Purposes and lawful bases

We review applications and take requested steps towards an individual design agreement on the basis of contract where the applicant is the proposed individual contracting party. For a company representative’s contact details, we rely on legitimate interests in responding to the organisation’s request and administering its project. We assess necessity and impact and do not assume the representative is personally a party to the contract.

We use necessary information to deliver an accepted individual project under contract, or legitimate interests in managing a business client relationship for its representatives. Security, duplicate prevention, proportionate records of approvals and defence of genuine claims rely on legitimate interests, with safeguards and retention limits. We use legal obligation only where a specific applicable legal duty requires processing.

We send optional email marketing on consent. We use project category, stated business interests and broad sector to select relevant newsletter content only within the preferences explained when you subscribe. We do not infer health, ethnicity, religion or other sensitive traits, buy enrichment data, or make solely automated decisions with legal or similarly significant effects. Humans select pilot projects.

Public portfolio content is limited to the approved design and business material. A contractual intellectual-property licence does not itself provide a blanket lawful basis to publish personal information. If the proposed display includes identifiable personal details, we seek a separate optional specific publication choice and provide a redacted alternative. The relevant permission and withdrawal route are recorded with the approved display.

We may create genuinely anonymous totals, such as the number of enquiries by project category, to understand demand. We minimise small groups and remove identifiers so the results do not reveal applicants. We do not keep identifiable leads indefinitely by labelling them analytics.

4 Who receives information and international processing

Only authorised people working on the pilot may access application records. Relevant service suppliers may process data on our documented instructions for hosting, database storage, security and authorised email delivery. We do not sell applicant lists or give another business permission to market to you.

The planned arrangement uses Sites for the website and isolated pilot tables in an existing Supabase project whose database region is London. A London database region alone does not establish that all support, hosting, backups or subprocessors remain in the UK. MailerLite is a proposed marketing provider and is not connected; no campaign is active.

{{PROCESSOR_AND_TRANSFER_SCHEDULE}}

Before any restricted international transfer, we must verify an applicable UK adequacy route or appropriate safeguards and the required assessment. Where safeguards are used, you may ask us how to obtain a copy. We may disclose necessary information to professional advisers or authorities where lawfully required, or to protect legal rights with appropriate safeguards.

5 How long we keep information

Unsuccessful, withdrawn or inactive application records are deleted or anonymised twelve months after the application is closed, unless a documented complaint or legal hold requires a narrower relevant record to be kept longer. A new service request receives its own purpose and review; an old marketing interest is not a reason to keep the entire application.

For accepted projects, we retain the agreement, signed rights assignment, portfolio permission, essential approvals and necessary delivery/complaint evidence for six years after project completion or termination, with periodic minimisation. This is our proportionate recordkeeping policy, not a statement that every item must be kept for six years by law. If an approved portfolio display continues longer, we retain the minimum licence/approval evidence for its duration and review that evidence on removal.

Marketing subscriber records are reviewed at least every twenty-four months after subscription or the last meaningful interaction. We remove dormant records where continuing contact is no longer reasonably expected, and stop marketing immediately on withdrawal or objection. We do not use email-open pixels to infer activity. Evidence necessary to demonstrate a permission or resolve a complaint may be retained separately, with restricted access and a documented need.

A minimal suppression record is retained for as long as we operate the relevant marketing activity and need it to prevent accidental recontact. It contains only the necessary address or appropriately protected matching value, preference status and date. It is not used to send marketing. You may ask about this if requesting deletion.

Application rate-limit fingerprints expire and are deleted within twenty-four hours. Provider access/security logs follow {{SERVICE_LOG_RETENTION}}. Backup copies follow {{BACKUP_RETENTION_SCHEDULE}}. Deleted data must be put beyond routine use and deletion instructions re-applied before any restored backup is returned to service.

6 Your choices and rights

Email marketing is optional. You can decline without affecting your application, unsubscribe in any marketing email or contact hello@platformdevelopment.co.uk. Giving a phone number does not authorise promotional calls, texts or WhatsApp. We keep necessary project messages separate from marketing.

You can ask to access or correct your information, erase it where applicable, restrict processing, obtain portability where applicable, or object to processing based on legitimate interests. You have an absolute right to object to use of your personal information for direct marketing, including related profiling. We will stop that use when you object. Withdrawal of consent does not affect the lawfulness of prior processing.

We normally respond to rights requests without undue delay and within one month. Where law allows an extension for complexity or the number of requests, we explain it within the initial period. We may seek proportionate information to verify identity or clarify a request where the law permits, and will explain any effect on timing. We do not require an account or unnecessary identification documents.

Required application information allows us to assess eligibility and contact you. If you do not provide it we may be unable to process the application. Optional fields, marketing consent and permission to publish identifiable personal details are not conditions of applying.

7 Complaints

You can make a data-protection complaint by emailing hello@platformdevelopment.co.uk or writing to our stated business address. Please explain your concern and preferred outcome; no formal legal wording is needed. We will acknowledge receipt within thirty calendar days, investigate appropriately without undue delay, keep you informed where needed and tell you the outcome.

You can also complain to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/ or telephone 0303 123 1113. Our internal procedure does not prevent you exercising statutory rights or seeking independent advice.

8 Security and changes

We use safeguards appropriate to the information and risks, including restricted access, secure transmission, server-side validation, limited security retention and procedures for requests and incidents. No system can promise absolute security. We do not place database administration credentials in the public website or make applicant records publicly readable.

We will check this notice against the deployed service before release and keep it under review. Material new purposes or new optional permissions will be explained before they begin. A revised notice does not retrospectively create consent or remove existing rights.