Data protection
Data protection and UK GDPR
How personal data is handled across Project Passport accounts and project records.
Roles
For account information, Project Passport acts as controller. For project content uploaded by a business customer, for example a builder recording a client's project, Project Passport generally acts as processor on that customer's instructions. The applicable role is set out in the contract with each customer.
Lawful bases
Account and service delivery is provided on the basis of contract. Security, fraud prevention and product improvement rely on legitimate interests. Optional analytics and marketing rely on consent, which can be withdrawn at any time.
Categories of data
Account and contact details, property and project information, uploaded documents and photographs, team membership and permissions, sharing records, and activity logs recording actions taken within a Passport.
Data subject rights
Access, rectification, erasure, restriction, objection and portability. Requests are handled within the statutory timeframe. Where Project Passport acts as processor, requests are passed to the relevant customer as controller.
Retention
Records are retained while the account is active and in line with the retention settings applicable to the Passport. Following handover, the homeowner is the primary custodian and the builder retains an appropriate historical project record. Deleted content is removed from live systems and then from backups in the ordinary backup cycle.
Sub-processors
Hosting, database, storage, authentication, email and payment providers are engaged as sub-processors under written terms. A current list is provided to business customers on request.
International transfers
Where data is processed outside the UK, appropriate safeguards such as the UK International Data Transfer Agreement or Addendum are used.
Security
Technical and organisational measures are described on the security page. We describe only measures the platform actually implements.
Contact
Data protection enquiries: privacy@projectpassport.co.uk. You also have the right to complain to the Information Commissioner's Office.
See also the privacy policy, cookie policy and security page.