Privacy Notice

Last updated: 16 October 2026

This notice explains what personal data {{COMPANY_LEGAL_NAME}} collects through the OZ Project Portal, why we collect it, how long we keep it, and what rights you have over it. It applies to everyone whose data passes through the Portal — people with an account, people named in a project directory, and people who open a shared link.

Contents

1. Who we are

The OZ Project Portal ("the Portal") is a private document and drawing management system for construction and engineering projects. Access is by invitation only.

{{COMPANY_LEGAL_NAME}} is the data controller for the personal data described in this notice. That means we decide what data is collected and why, and we are accountable for it under the UK GDPR and the Data Protection Act 2018.

Registered name	{{COMPANY_LEGAL_NAME}}
Company number	{{COMPANY_NUMBER}} (registered in England & Wales)
Registered address	{{REGISTERED_ADDRESS}}
Data protection contact	{{DP_EMAIL}}
ICO registration	{{ICO_REG_NUMBER}}

We are not required to appoint a statutory Data Protection Officer, and we have not appointed one. Responsibility for data protection sits with the contact named above.

2. Who this notice covers

The Portal handles personal data about four different groups, and not everyone in them has an account:

Group	How your data reaches us
Portal users	You were invited, you created an account, and you sign in. Most of your data comes from you.
Project directory contacts	Someone working on a project added your name and contact details so that project participants can be identified. Your data came from them, not from you. See section 5.
Shared link recipients	Someone sent you a link to project material. We record the email address the link was sent to, and technical details of the visits made to it.

3. What personal data we hold

Account and profile

Your email address and a one-way cryptographic hash of your password — never the password itself.
Your name, and if you choose to provide them, your job title, location, phone number and profile photograph.
A free-text role label shown next to your name, and the set of permissions granted to your account.
Which spaces and projects you have been given access to.

Use of the Portal

The IP address of your most recent sign-in, and the date and time of it.
An activity record of actions taken in the Portal — sign-ins, uploads, edits, moves, archiving, deletions, permission changes and comments — showing who did what and when.
Comments and replies you write on drawings, documents and Project Board rows, and any files or images you attach to them. Location and camera details embedded in images attached to Project Board comments are removed when they are uploaded.
Time recorded in a Time Tracker column against Project Board rows or Folder System files — whose time it is, the start and end date and time, and a description of the work. Anyone who can edit a row or file can record time for any person on the project, including on your behalf, and you are notified in the Portal when they do. Your entries stay after you leave the project. Shared links show only the total time, never who recorded it or when.
What you put on a project whiteboard — sticky notes, text, shapes, arrows, drawings and images, and any web link you attach to an image — and which person added each item. Everyone who can open that project's whiteboards can see them. While you have a whiteboard open, the other people who have it open see your name and where your pointer is on it. Location and camera details embedded in images are removed when they are uploaded.
What you write in a project document — its text, tables, pictures, page layout and earlier versions of it — and the comments and replies you add to it, including the people you tag. Everyone who can open that project's documents can read them. While you have a document open, the other people who have it open see your name and where your cursor is. Location and camera details embedded in pictures are removed when they are uploaded.
What you put on a project timeline — tasks, dates, progress, notes and dependencies — and the people assigned to each task. Everyone who can open that project's timelines can see them, and a person you assign to a task is notified. When a timeline is created it can be linked to one of the project's boards, and the link cannot be changed later. A timeline linked to a board shows that board's items and keeps them up to date: their names, dates, progress and assigned people are copied onto it, a task added on the timeline is added to the board as an item (with its name only), and renaming or deleting a task there renames or deletes the board item too. People copied over from the board are not notified again (they were told when they were assigned on the board).
Messages you send in the Portal's chat — direct messages, group conversations and project channels — together with any files you attach, the people you tag, and the projects, files or Project Board rows you attach to a message. We also record who is in each conversation and how far each person has read.
Bug reports you submit, including anything you type into them and any screenshots or files you paste or attach.

Nobody reads your conversations. Chat messages are visible only to the people in that conversation. Administrators and the account owner cannot open a conversation they are not part of, and chat messages are deliberately left out of the activity record for the same reason. A project channel is an exception only in the sense that everyone with access to that project is a member of it. If you need a conversation or a message removed, contact us using the details in section 2 — we remove it directly from the database rather than reading it.

Project content

The files you upload and the information you record against them, such as drawing numbers, revisions, status and dates.
Personal data inside those files. Drawings, schedules and reports often contain names, signatures, phone numbers and similar details. We hold that content on behalf of the project; we do not separately index or analyse it.

Project directory

Name, and where provided email address, phone number, profession and photograph of people involved in a project — including people who do not have a Portal account.

Shared links

The email address a link was sent to, who created it, what it points to, and when it expires.
For each visit to a shared link: the IP address, the browser user-agent string, and the time.

We do not collect special category data. The Portal is not designed to hold information about health, ethnicity, religion, political opinions, trade union membership, sex life, sexual orientation, genetics or biometrics, and users are instructed not to upload it. If such information reaches us inside a project file, we treat it under the same safeguards and remove it when it is identified.

4. Why we use it, and our lawful basis

Under the UK GDPR we must have a lawful basis for each use of personal data. Ours are set out below. Where we rely on legitimate interests, we have weighed our interest against your rights and concluded that our use is reasonable, expected, and not overridden by the impact on you.

What we do	Data used	Lawful basis
Create and run your account; let you sign in	Email, password hash, profile, permissions	Legitimate interests — operating a system our staff and project partners need in order to work. Where you are engaged under a contract with us, performance of that contract.
Control who can see which projects, folders and files	Permissions, space and project assignments	Legitimate interests — keeping confidential project material away from people who should not see it.
Keep a record of what was done in the Portal	Activity records, sign-in IP	Legitimate interests — accountability on projects, investigating errors and security incidents, and being able to show a document's history. On construction projects this record can also be needed to meet statutory duties.
Protect the Portal from attack and misuse	IP addresses, rate-limit counters, failed sign-in counts	Legitimate interests — security. The Portal is publicly reachable and is scanned continuously by automated tools.
Send service emails — invitations, password resets, shared links, security notices	Email address, message content	Legitimate interests / performance of a contract. These are not marketing; you cannot opt out of them while you hold an account.
Identify who is involved in a project	Project directory entries	Legitimate interests — project participants need to know who the other parties are and how to reach them.
Share project material with people outside the Portal	Recipient email, link access records	Legitimate interests — delivering the project. See section 8.
Keep you signed in if you tick "remember me"	A sign-in cookie and its server-side record	Consent — you choose it, and it stops when you sign out.
Keep project records for as long as the law requires	Project files and their history	Legal obligation and legitimate interests — defending claims within statutory limitation periods and, where applicable, building safety record-keeping duties.

You can object to any processing based on legitimate interests — see section 11. We will stop unless we have compelling grounds to continue.

5. Where your data comes from

Most of the data we hold about Portal users comes from you or is generated as you use the Portal. There is one important exception.

If you are in a project directory but do not have an account, your details came from someone else. A project participant added your name and contact details so that the people working on that project can identify and reach you. We hold this under legitimate interests. You have the right to object, to ask for a copy, to have it corrected, or to have it removed — write to {{DP_EMAIL}} and we will deal with it.

The categories we hold in that case are: name; and where the person who added you provided them, email address, phone number, profession and a photograph. We do not obtain these details from public sources or data brokers.

We do not sell personal data, and we do not use it for advertising or profiling. We share it only as follows.

Other people using the Portal

Your name, role label, profile photograph and your activity on a project are visible to other people with access to that project. That is the point of a shared project environment: colleagues need to see who uploaded a drawing and when it changed.

Service providers

These organisations process personal data on our instructions, under a written contract that meets Article 28 of the UK GDPR. They may not use it for their own purposes.

Provider	What it does	What it receives	Where
DigitalOcean	Hosts the server the Portal runs on	All Portal data, at rest on the server	United Kingdom (London)
Resend	Delivers our service emails	Recipient address and message content, including the link contained in a shared-link email	United States
Let's Encrypt	Issues the certificate that encrypts your connection	No personal data — the domain name only	United States

This list is kept current; ask us if you need it confirmed in writing for a supplier assessment. Beyond these providers, the Portal loads no third-party scripts, fonts, analytics or advertising — everything a page needs is served from our own server, so simply opening the Portal does not disclose your IP address to anyone else.

Others

Clients and project partners, where material is shared with them for the project — see section 8.
Professional advisers (lawyers, insurers, auditors) where we need advice or must defend a claim.
Authorities, where we are legally required to disclose information.

7. Where your data is stored

The Portal and its database are hosted in the United Kingdom, in a London data centre operated by DigitalOcean. Uploaded files, the database and the server logs all stay there.

DigitalOcean is a US-headquartered company, and our email provider Resend is based in the United States. Where personal data is transferred outside the UK, or is accessible from outside the UK, we rely on the safeguards permitted by Article 46 of the UK GDPR — the International Data Transfer Agreement, or the UK Addendum to the European Commission's Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework where the provider is certified under it. You can ask us for details of the safeguard that applies to a particular provider.

8. Sharing project material outside the Portal

The Portal can create a link that lets someone see specific project content without signing in. This is how drawings reach clients, consultants and subcontractors.

You should understand how these links behave:

The link is the key. Anyone holding a valid link can open the content it points to, whether or not it was sent to them.
Every link expires. It cannot be set to last longer than twelve months, and the person who created it can revoke it at any time.
A link can never show more than the person who created it could see themselves, and it stops working if their own access is withdrawn.
Visits to a link are recorded, including the IP address of the visitor.
Once a file has been downloaded, it is outside the Portal. Revoking a link does not recall a downloaded copy.

If you receive one of these links, the Shared Link Terms explain what you may and may not do with the material — including that you must not forward the link.

9. How long we keep it

Some of these periods are enforced automatically by the Portal. Others depend on the life of the project.

Data	Kept for	Why
Account and profile	While your account is open, then removed or anonymised after closure	No longer needed once access ends
Activity records	12 months, then deleted automatically	Long enough to investigate an incident or reconstruct a document's recent history
Chat messages and their attachments	12 months, then deleted automatically along with any attached files	Long enough to go back over a decision taken in conversation, without keeping working chatter indefinitely
Shared link visit records (IP, browser)	90 days, then deleted automatically	Security monitoring only
Shared links	Until they expire or are revoked — never more than 12 months	Enforced by the Portal; links cannot be made permanent
Invitation links	48 hours, single use	Security
Password reset links	Short-lived, single use	Security
Earlier versions of a project document	The latest 100 automatic versions (one is kept about every 20 minutes while people edit); versions someone saved with a name are kept until someone deletes them, or the document is deleted	So that text changed or deleted by mistake can be restored
Who has a document or a whiteboard open, and their cursor or pointer position	Shown while it is open; the record is removed after one day	Working on the same document or whiteboard together
Items deleted from a whiteboard or a timeline, and project tabs that are deleted (a board, calendar, whiteboard, document or timeline together with everything on it)	30 days, then deleted automatically, including any images	So that something deleted by mistake can still be restored
Project directory entries	Life of the project, then the project's retention period	Part of the project record
Bug reports	24 months	Diagnosing recurring faults
Server logs	90 days	Security and fault diagnosis
Project files and their records	12 years after project completion as a minimum; 15 years for residential work; for higher-risk buildings, for as long as the law requires the building's information to be kept	Claims can be brought against construction work long after it finishes. Limitation Act 1980, Defective Premises Act 1972 as amended by the Building Safety Act 2022, and building safety record-keeping duties

Why project records are kept for so long. This is not us holding on to data for its own sake. Liability for construction work runs for many years after practical completion, and being unable to produce the drawing history would leave everyone involved — including you — unable to show what was designed, approved and built.

10. How we protect it

Access to the Portal requires an invitation and a password, and permissions are set per person, per project and down to individual folders. Connections are encrypted. Passwords are stored only as a slow one-way hash. Uploaded files cannot be reached directly from the web — every download passes a permission check first. Sessions end after 30 minutes of inactivity, and changing a password or a person's permissions signs them out everywhere.

Our Information Security Statement sets out the controls in more detail.

No system is completely secure. If a breach of your personal data is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours, and we will tell you directly if the risk to you is high.

11. Your rights

You have the following rights over your personal data. They are free to exercise.

Right	What it means here
Access	Ask for a copy of the personal data we hold about you.
Rectification	Have inaccurate details corrected. You can edit most of your own profile in the Portal at any time.
Erasure	Ask us to delete your data. See the limits below.
Restriction	Ask us to pause our use of your data while a dispute about it is resolved.
Objection	Object to processing we base on legitimate interests. We must stop unless we can show compelling grounds to continue.
Portability	Receive the data you gave us in a machine-readable form, where we rely on consent or a contract.
Withdraw consent	Where we rely on consent — the "remember me" cookie — you can withdraw it by signing out.

What we can and cannot delete

If you ask us to erase your data, this is what happens:

We delete or anonymise	We keep — and why
Your profile: name, phone number, location, photograph	The activity record of what was done, with your identity detached from it. The record of a drawing being superseded has to survive; the name attached to it does not.
Your email address and sign-in details	Files uploaded to a project. They belong to the project record and are subject to the retention periods in section 9.
Your sign-in cookies and active sessions	Comments you wrote, where other people have replied to them and removing them would break the record of a decision.
Your project directory entry	Anything we must keep to establish, exercise or defend a legal claim.

We will always tell you in writing what we deleted and what we kept, and why.

How to make a request

Write to {{DP_EMAIL}}. We may ask you to confirm your identity so that we do not disclose someone else's data to the wrong person. We will respond within one month. If your request is complex we may extend that by up to two further months, and we will tell you within the first month if we do.

12. Automated decision-making

We do not make decisions about you by automated means alone, and we do not profile you. The Portal applies the permissions a person has configured; it does not evaluate you or make judgements about you.

13. Cookies

The Portal uses two cookies, both strictly necessary to sign you in and keep you signed in. There are no analytics, advertising or tracking cookies, which is why you are not asked to accept them. The Cookie Policy lists them in full.

14. Complaints

If you are unhappy with how we have handled your personal data, please tell us first at {{DP_EMAIL}} so we can put it right.

You also have the right to complain to the UK's data protection regulator:

Regulator	Information Commissioner's Office (ICO)
Website	ico.org.uk/make-a-complaint
Helpline	0303 123 1113
Post	Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

You do not have to complain to us first, though it usually resolves things faster.

15. Changes to this notice

We review this notice at least once a year, and whenever we change how the Portal handles personal data. The date at the top shows when it was last changed. If a change materially affects you we will tell account holders directly rather than relying on you to check.

16. Contact

For anything in this notice, including a request about your data, contact {{DP_EMAIL}}, or write to {{COMPANY_LEGAL_NAME}} at {{REGISTERED_ADDRESS}}.