1. Who We Are
PF & Co Holdings Ltd is a technology and engineering holding company. We trade under the name Site Intelligence for our planning intelligence and engineering report products.
Engineering services are delivered through our operating company, PF & Co Construction Ltd (Company No. 12463571). PF & Co Holdings Ltd is the data controller for all personal data we collect and process. This means we decide how and why your personal data is used.
| Detail | Information |
|---|---|
| Registered company name | PF & Co Holdings Ltd |
| Company number | 16649319 |
| Registered in | England and Wales |
| Registered office | 2 Queens Drive, Guildford, GU2 9PP |
| Operating company | PF & Co Construction Ltd (12463571) |
| Telephone | +44 (0)1483 363020 |
| info@pfandco.co.uk | |
| Website | www.pfandco.co.uk |
| ICO registration | C1899309 |
We are registered with the Information Commissioner's Office (ICO) under registration number C1899309, as required by the Data Protection Act 2018.
2. About This Policy
This Privacy Policy explains what personal data we collect, how we use it, who we share it with, how long we keep it, and what rights you have. It applies to:
- Clients and prospective clients
- Website visitors
- People whose data we obtain from publicly available sources as part of our engineering and planning work
- Third parties who correspond with us
We have written this policy in plain English so that it is easy to understand. If you have any questions, please contact us using the details in Section 1.
3. What Personal Data We Collect
We collect different types of personal data depending on how you interact with us.
3.1 Client Contact Data
Your name, postal address, email address, telephone number, and any other contact details you provide when you instruct us or make an enquiry.
3.2 Project and Site Data
The address and location of the property or site you ask us to assess, including postcode, grid references, What3Words references, and any other site identification details. This may also include property ownership details, planning history, and building characteristics.
3.3 Site Photographs and Imagery
Photographs taken during site visits, which may include images of the property, its surroundings, and occasionally people present on or near the site. We may also obtain street-level imagery from Google Street View and Mapillary, and satellite imagery from Copernicus, to supplement our assessments.
3.4 Financial and Payment Data
Bank details, invoicing information, and payment records necessary to process fees for our services. Payment card data is collected and processed by our payment service provider (Stripe) and is never stored on our systems. See Section 10 for details.
3.5 Website Usage Data
Information about how you use our website, including pages visited, time spent on pages, and how you arrived at our site. This data is collected through cookies and similar technologies. See our Cookie Policy (GDPR-09) for details.
3.6 Marketing Consent Data
Records of any consent you have given or withdrawn for us to send you marketing communications.
3.7 Correspondence Data
Emails, letters, WhatsApp messages, and other communications between you and us relating to our services or your project.
3.8 Website Comment Data
If you ask us to publish a comment about our free Site Check, we collect the comment, any first name you choose to be identified by, and your email address. The email address is required if you want the comment published, because CAP Code rule 3.47 requires a marketer using a testimonial to hold contact details for the person who gave it. We cannot publish a comment without one. We do not publish your email address and we do not use it to market anything to you.
Publishing means publishing publicly on our website, where the comment may be seen by anyone, indexed by search engines, cached, copied or reshared by other people.
If you do not ask us to publish, we do not retain your comment, name or email address. If you want to tell us something privately, or report a problem with the check, the separate feedback form on the same page is for that. Note that we briefly record the IP address of any submission to our forms to prevent abuse, whether or not you ask for publication — see Sections 5 and 7.
We do not ask for the site you checked, its location or the council area, and the form is built to reject them. Please do not put that information, or anyone else's personal information, in your comment. If you do, we will not publish it, and we will delete or redact it when we review the comment.
If you ask us to publish your comment, we place a random withdrawal key in the local storage of that browser profile, so that you can withdraw in one click without having to identify yourself to us again. We rely on the “strictly necessary” exemption in PECR regulation 6(4)(b) for this, because it delivers a facility you have asked for. It is not used for advertising, analytics or tracking across websites. It remains until you withdraw the comment or clear your browser storage, and it stops working once the comment is gone. The one-click route works only from that device and browser profile; you can always withdraw by emailing us instead.
3.9 Free Site Check: Emailed Reports and Site Watches
The free Site Check runs without an account and without asking who you are. If you ask us to email you the result, we collect your email address and the location you checked (the co-ordinates, and a drawn outline if you drew one), because both are needed to build and send the report.
A copy of that email goes to us only if you ask. The form offers a separate, unticked box: "You may contact me once about this site". If you tick it, the same message is sent to our own inbox and we may contact you once about the site you checked; that contact is the only use we make of it, and you can tell us to stop at any time. If you do not tick it, no copy is sent to us and nobody at PF & Co sees your address. We do not add you to a marketing list either way. The email is sent for us by Resend, our email service provider, which processes it on our instructions (see Section 11); we do not sell your address or share it for anyone else's marketing.
If you ask for a site watch, we hold the request, which contains the email address given, the location or outline, and a record of what the check found, and we email that address a confirmation link. We hold the request for up to 48 hours so that it survives until you decide; if you do not confirm, we delete it and no watch starts. Nothing is checked and no alert is sent from an unconfirmed request. Once you confirm, we keep the same information as a live watch so that a weekly re-check can tell you if anything recorded has changed. Every alert carries a link to delete the watch; that link shows you a confirmation page and deletes the watch only when you confirm, so a link scanner in your mail client cannot delete it for you. A watch removes itself after 12 months.
To prevent abuse, we briefly hold a count of how many reports and watch confirmation emails have been sent to each address. Those counts are keyed on a one-way hash of the address, not the address itself, and expire within the hour or the day depending on the limit.
A location you check is not linked to you unless you ask for an email or a watch; where it is, we treat it as your personal data. We do not sell, rent or share any of the above for anyone else's purposes. We keep the copy of an emailed report you asked us to receive for up to 12 months, and a watch for 12 months from when it was set up.
4. How We Collect Your Data
We collect personal data in the following ways:
4.1 Directly From You
When you contact us by telephone, email, WhatsApp, or through our website contact form; when you instruct us to carry out engineering or consultancy services; and when you visit our offices.
4.2 From Our Website
When you browse our website, submit a form, or interact with our online content. See our Cookie Policy (GDPR-09) for details of the cookies we use.
4.3 From Site Visits
When we visit a property or site to carry out surveys, inspections, or observations as part of our engineering services.
4.4 From Publicly Available Sources
As part of our engineering and planning intelligence work, we routinely obtain data from publicly available sources. Our automated enrichment pipeline gathers data from the following sources to inform our assessments and reports:
| Data Source | Data Obtained | Licence / Basis |
|---|---|---|
| Local authority planning portals | Planning application history, officer reports, decision notices | Public register (open data) |
| EPC Register | Energy Performance Certificate data | Open Government Licence |
| British Geological Survey (BGS) | Geological data, borehole records, bedrock and superficial geology | Open Government Licence |
| Environment Agency (EA) | Flood risk zones, surface water risk, historic flooding, LIDAR data | Open Government Licence |
| Historic England | National Heritage List for England (listed buildings, scheduled monuments, conservation areas) | Open Government Licence |
| Natural England | Ecological designations, SSSIs, Living England habitat data, agricultural land classification | Open Government Licence |
| HM Land Registry | Title and ownership information (where commissioned by you), sold price data | Open Government Licence / commissioned |
| Ordnance Survey (OS Data Hub) | Mapping data, basemaps for site location and constraint maps | OS OpenData Licence / OS Data Hub API |
| National Biodiversity Network (NBN) Atlas | Species records and ecological data | Open data (various licences) |
| PropertyData | Sold property comparables, market intelligence, area statistics | Commercial licence |
| MapTiler | Mapping tiles for report visualisations | Commercial licence |
| Copernicus / Sentinel | Satellite imagery for site context and environmental analysis | EU Copernicus Open Licence |
| What3Words | Three-word address references for site identification | Commercial API licence |
| NOMIS (ONS) | Census demographics, housing data, affordability ratios, employment data | Open Government Licence |
| Department for Transport (DfT) | Road traffic count data (AADT, count points) | Open Government Licence |
| DEFRA | Air quality background concentrations, MAGIC environmental data | Open Government Licence |
| Coal Authority | Coal mining risk data and past mining activity | Open Government Licence |
| Postcodes.io | Postcode lookups, ward, parish, constituency data | Open data |
| Google Street View | Street-level imagery for site context | Google Maps Platform licence |
| Mapillary | Street-level imagery (crowdsourced) | CC BY-SA licence |
This data is used to inform our engineering assessments and reports. Where this data relates to your property or site, it forms part of the project record.
4.5 From Third-Party Referrals
When an architect, builder, planning consultant, or other professional refers you to us, they may provide us with your name, contact details, and basic project information.
5. Why We Use Your Data and Our Legal Basis
Under the UK General Data Protection Regulation (UK GDPR), we must have a lawful basis for processing your personal data. The table below sets out each purpose for which we process data and the corresponding lawful basis.
| Purpose | Lawful Basis | Explanation |
|---|---|---|
| Providing engineering services — carrying out site feasibility assessments, planning intelligence reports, flood risk assessments, desk studies, structural design, and other services you commission | Contractual necessity Art. 6(1)(b) | We need to process your data to perform the contract we have with you, or to take steps at your request before entering into a contract |
| AI-assisted report preparation — using artificial intelligence tools to research publicly available data, draft report content, and format documents (see Section 6) | Contractual necessity Art. 6(1)(b) and Legitimate interests Art. 6(1)(f) | AI processing is integral to delivering the services you have commissioned. It is also in our legitimate interest to use efficient tools to deliver high-quality reports. This does not override your rights |
| Business administration — managing our files, scheduling, internal records, quality assurance, and project management | Legitimate interests Art. 6(1)(f) | It is in our legitimate interest to run our business efficiently. This does not override your rights |
| Publishing a comment you have given us permission to publish — showing it on our website, identified in the way you chose | Consent Art. 6(1)(a) | We publish it only if you tick the box, only as you chose to be identified, and only after a person has read it and decided it is suitable. You can withdraw at any time and we stop using it and take it down |
| Retaining evidence relating to a published comment — the comment as submitted, the permission given, the relevant dates, and contact details for its author | Legitimate interests Art. 6(1)(f) | CAP Code rule 3.47, which applies to our marketing, requires a marketer using a testimonial to hold documentary evidence supporting its genuineness and contact details for the person who gave it. Our legitimate interests are advertising responsibly, being able to demonstrate compliance with that Code, and responding to any Advertising Standards Authority complaint about a comment we published. Publication itself is based on your consent; retaining this limited evidence after publication ends is a separate purpose with its own basis, so withdrawing consent stops the publication but does not by itself end this retention. We keep only what is reasonably needed, and we have weighed that interest against the effect on the person who gave the comment. It is never published and never used to market anything to you. You can object to this processing at any time under Article 21 — see Section 13.6 |
| Preventing abuse of our web forms — recording the IP address a submission came from, for a short period | Legitimate interests Art. 6(1)(f) | It is in our legitimate interest to stop one sender flooding a public form. The record is a count against an address for a limited period, and is not used to identify or profile anyone |
| Financial and tax records — invoicing, payment processing, corporation tax records, and financial reporting | Legal obligation Art. 6(1)(c) | We are required by law to keep financial records under the Companies Act 2006 and HMRC requirements |
| CDM and building safety records — records required under the Construction (Design and Management) Regulations 2015 and the Building Safety Act 2022 | Legal obligation Art. 6(1)(c) | We are required by law to create and retain certain health and safety records |
| Marketing communications — sending you information about our services, blog posts, or project updates | Consent Art. 6(1)(a) or Legitimate interests Art. 6(1)(f) | Where you have given consent, we rely on that consent. For existing clients, we may rely on legitimate interests to send relevant service information, with an easy opt-out in every communication |
| Website analytics — understanding how visitors use our website to improve our content and user experience | Legitimate interests Art. 6(1)(f) | It is in our legitimate interest to understand how our website is used so we can improve it. This does not override your rights |
| Responding to enquiries — replying to your questions, requests, or complaints | Legitimate interests Art. 6(1)(f) or Contractual necessity Art. 6(1)(b) | Depending on the nature of your enquiry, we process your data either to perform a contract or because it is in our legitimate interest to respond to communications |
| Professional indemnity insurance — providing information to our insurers in the event of a claim or potential claim | Legitimate interests Art. 6(1)(f) | It is in our legitimate interest to maintain insurance and defend claims. This does not override your rights |
| Legal claims — establishing, exercising, or defending legal claims | Legitimate interests Art. 6(1)(f) | It is in our legitimate interest to protect our legal rights |
6. Use of Artificial Intelligence
This section explains how we use artificial intelligence (AI) tools in our work and what that means for your personal data.
6.1 How We Use AI
PF & Co Holdings Ltd uses AI tools to assist in the preparation of planning intelligence reports, site feasibility assessments, and other technical documents. Our system uses a suite of specialised AI agents, each focused on a specific domain such as flood risk, heritage, ecology, transport, or market analysis. These agents research publicly available data, draft report content, and format documents to produce comprehensive assessments.
AI is used at every stage of report production, from initial data gathering through to quality assurance. This enables us to deliver thorough, multi-disciplinary assessments that would otherwise require large teams of specialists.
6.2 What Data May Be Processed by AI
When we prepare reports and assessments for your project, the following types of data may be processed through AI systems:
- Your name and contact details (as they appear in the report)
- The property or site address, postcode, and geographic coordinates
- Site characteristics and project details (proposal description, dwelling count, floor areas)
- Data obtained from publicly available sources (planning history, geological data, flood risk data, heritage records, ecology, census demographics, market data)
- Site photographs and street-level imagery (for analysis and description)
6.3 Human Oversight
All AI outputs are reviewed, verified, and approved by qualified professionals before any report is issued. AI tools do not make autonomous decisions about your project. Every assessment, conclusion, and recommendation in our reports reflects the professional judgment of the engineer or consultant responsible for your project.
Our reports pass through a multi-layer quality assurance pipeline before issue, including automated compliance checks, cross-domain consistency validation, and human review.
PF & Co Holdings Ltd retains full professional responsibility for all deliverables, regardless of the tools used in their preparation.
6.4 Our AI Service Provider
Our primary AI service provider is Anthropic Inc., based in San Francisco, United States. The classification of AI service providers under UK GDPR (whether they act as a "data processor" or a "joint controller") is an evolving area of law. The Information Commissioner's Office (ICO) has indicated that where an AI provider exercises a degree of independent determination over how data is processed, a joint controller relationship may exist under Article 26 of UK GDPR.
We have taken the following steps to protect your data regardless of the precise legal classification:
- We have a Data Processing Addendum in place with Anthropic Inc. that includes the UK GDPR Approved Addendum for UK data transfers
- Anthropic Inc. is contractually required to implement appropriate security measures
- Anthropic Inc. has committed not to use your data for its own purposes, including training AI models
- Data submitted via the API is automatically deleted by Anthropic within 7 days
We keep this position under review and will update our arrangements if the ICO issues definitive guidance or if our legal classification of Anthropic's role changes.
6.5 Data Protection Impact Assessment
We have conducted a Data Protection Impact Assessment (DPIA) for our use of AI tools in the preparation of engineering and planning intelligence reports, as required by Article 35 of UK GDPR where processing is likely to result in a high risk to individuals' rights and freedoms. The DPIA is documented internally as GDPR-11 and is reviewed annually. A summary of this assessment is available on request.
6.6 Your Rights Regarding AI Processing
You have the right to:
- Be informed that AI tools are used in our work (which this section provides)
- Request information about how AI was used in your specific project
- Object to the use of AI in your project, though this may affect our ability to deliver services within quoted timescales and fees
- Request human review of any AI-assisted output (which is already our standard practice)
7. How Long We Keep Your Data
We keep your personal data only for as long as we need it. The retention periods below are based on legal requirements, professional obligations, and industry best practice. Full details are set out in our Data Retention Policy (GDPR-01), which is available on request.
| Data Category | Retention Period | Reason |
|---|---|---|
| A website comment awaiting review | 30 days after submission | If it has not been reviewed by then, it is deleted unreviewed rather than held indefinitely |
| A website comment we have published | 730 days after approval | Before that period ends we may ask whether you still agree to publication. If we do not get fresh consent, the comment comes down when the 730 days end — we do not assume a permission still stands |
| Evidence relating to a published comment | 365 days after the comment is taken down | A complaint to the Advertising Standards Authority can be made after publication has ended. 365 days is our assessed proportionate period for keeping the supporting evidence; it is not a statutory retention period. CAP Code rule 3.47 |
| Engineering reports and calculations | 15 years from project completion | Limitation Act 1980, Latent Damage Act 1986 (15-year longstop), and Building Safety Act 2022 |
| Structural drawings | 15 years from project completion | As above |
| Client contact details | Duration of engagement plus 6 years | Contractual limitation period |
| Site photographs | 15 years from project completion | May be relevant to latent damage claims |
| Enrichment data (flood risk, geology, heritage, ecology, demographics, market data) | 15 years from project completion | Forms part of the engineering record; supports report conclusions |
| Financial records (invoices, receipts) | 6 years from end of financial year | Companies Act 2006 and HMRC requirements |
| CDM health and safety records | Life of the building, or 15 years if demolished | CDM 2015 Regulation 12 |
| Building Safety Act records | 30 years from project completion | Building Safety Act 2022 retrospective limitation provisions |
| Marketing consent records | Duration of consent plus 2 years | Evidence of PECR compliance |
| Website analytics data | 26 months | ICO guidance on proportionate retention |
| AI processing logs | 6 years (our records); 7 days (at Anthropic) | Professional indemnity insurance claims period |
| General correspondence | 6 years from last communication | Contractual limitation period |
| Abandoned/cancelled projects (no report issued) | 2 years from last client contact | Limited ongoing legitimate interest in potential reactivation |
| Demo/test projects (internal only) | 30 days from creation | No ongoing purpose; data minimisation |
When a retention period expires, we will securely delete or anonymise your data. Where data is held in both electronic and paper format, both copies will be dealt with.
7.1 Why We May Need to Keep Some Data Longer
Engineering records may need to be retained beyond the standard period if:
- A claim or dispute is ongoing or anticipated
- We are required to do so by a court order or regulatory body
- The records relate to a building that is still standing and subject to Building Safety Act provisions
- Our professional indemnity insurer requires retention for the duration of the policy
8. Who We Share Your Data With
We do not sell your personal data. We share your data only where necessary and only with the recipients described below. A full, maintained register of our sub-processors is held internally as the Sub-Processor Register (GDPR-04) and is available on request.
8.1 Technology Service Providers
| Provider | Location | Purpose | Safeguard |
|---|---|---|---|
| Anthropic Inc. | United States | AI-assisted report preparation (see Section 6) | DPA with UK Addendum; data auto-deleted within 7 days |
| Stripe | United States | Payment processing (see Section 10) | UK-US Data Bridge; PCI DSS Level 1 certified |
| Resend | United States | Transactional email delivery (see Section 11) | DPA in place; UK-US Data Bridge |
| Formspree | United States | Contact and enquiry form processing | DPA in place; UK-US Data Bridge |
| Vercel | United States | Website hosting and analytics | DPA in place; UK-US Data Bridge |
| ElevenLabs | United States | Voice AI for audio content (blog narration only; no client data processed) | DPA in place |
8.2 Mapping and Imagery Providers
| Provider | Location | Purpose | Safeguard |
|---|---|---|---|
| Ordnance Survey (OS Data Hub) | United Kingdom | Mapping basemaps for site location and constraint maps | UK-based; OS OpenData Licence |
| MapTiler | Luxembourg (EU) | Mapping tiles for report visualisations | EU-based; UK adequacy decision applies |
| Google Street View | United States | Street-level imagery for site context photographs | Google Maps Platform Terms; UK-US Data Bridge |
| Mapillary (Meta) | United States | Street-level imagery (crowdsourced) | DPA in place |
| Copernicus / Sentinel | European Union | Satellite imagery for site context and environmental analysis | EU-based; UK adequacy decision applies |
8.3 Professional and Regulatory Recipients
| Recipient | Purpose | Basis |
|---|---|---|
| Building Control bodies | Where we submit structural calculations or reports on your behalf | Legal obligation / contractual necessity |
| Local planning authorities | Where we submit planning documents on your behalf | Legal obligation / contractual necessity |
| Professional indemnity insurers | In the event of a claim or potential claim against us | Legitimate interests (defending legal claims) |
| Your other appointed professionals | Sharing project information with your architect, builder, or other consultants at your instruction | Contractual necessity |
| Legal and professional advisers | Where we need legal or professional advice | Legitimate interests |
| Law enforcement or regulators | Where we are required to do so by law | Legal obligation |
9. International Data Transfers
Some of our service providers are based outside the United Kingdom. This means your personal data may be transferred internationally. The following providers involve transfers to countries outside the UK:
| Provider | Country | Transfer Safeguard |
|---|---|---|
| Anthropic Inc. (AI processing) | United States | UK Extension to the EU-US Data Privacy Framework ("UK-US Data Bridge") and/or Standard Contractual Clauses with UK Addendum; DPA in place |
| Stripe (payments) | United States | UK-US Data Bridge; Standard Contractual Clauses; PCI DSS Level 1 |
| Resend (email) | United States | UK-US Data Bridge; DPA in place |
| Vercel (hosting) | United States | UK-US Data Bridge; DPA in place |
| Google (Street View) | United States | UK-US Data Bridge; Google Data Processing Terms |
| Mapillary / Meta (imagery) | United States | UK-US Data Bridge; DPA in place |
| ElevenLabs (voice AI) | United States | DPA in place (no client personal data processed) |
| MapTiler (mapping) | Luxembourg (EU) | UK adequacy decision for the EU (effective since 28 June 2021) |
| Copernicus (satellite) | European Union | UK adequacy decision for the EU |
Where we transfer data to the United States, we rely on one or more of the following safeguards:
- UK Extension to the EU-US Data Privacy Framework (the "UK-US Data Bridge") — where the US provider is certified under the Data Privacy Framework, the UK Secretary of State has made a data bridge finding permitting these transfers
- Standard Contractual Clauses (International Data Transfer Agreement or UK Addendum to EU SCCs) — approved contractual terms that provide appropriate safeguards under Article 46(2)(c) of UK GDPR
- Data Processing Agreements — binding agreements that require the recipient to protect your data to UK GDPR standards
Where we transfer data to the European Union, the UK government has made an adequacy decision under Section 17A of the Data Protection Act 2018, meaning no additional safeguards are required.
We have conducted a Transfer Impact Assessment (documented internally as GDPR-07) for all international transfers. A copy of the safeguards we have in place is available on request by contacting us at the details set out in Section 1.
10. Payment Processing
We use third-party payment processors to handle payments for our services. We do not store your payment card details on our systems.
10.1 Stripe
Stripe, Inc. (United States) processes card payments on our behalf. When you pay by credit or debit card, your card details are submitted directly to Stripe's secure payment infrastructure. Stripe is certified to PCI DSS Level 1, the highest level of payment card industry security. We receive only a confirmation of payment and a truncated card reference (last four digits) — we never see or store your full card number.
Stripe's privacy policy: stripe.com/gb/privacy
10.2 What Payment Data We Hold
We retain the following payment-related data for our own records:
- Your name and email address (for invoicing)
- Invoice amounts and dates
- Payment confirmation references
- Truncated card reference (last four digits) or direct debit mandate reference
This data is retained for 6 years from the end of the financial year in which the transaction occurred, in accordance with our obligations under the Companies Act 2006 and HMRC requirements. See Section 7 and our Data Retention Policy (GDPR-01) for full details.
11. Email Service
We use Resend (United States) to send transactional emails, including:
- Order confirmations and payment receipts
- Report delivery notifications
- Project status updates
- Responses to enquiries submitted through our website
When we send you an email via Resend, your email address and the message content are processed by Resend's infrastructure. Resend acts as a data processor on our behalf under a Data Processing Agreement. Resend does not use your data for its own marketing purposes.
We do not use Resend for marketing emails. Marketing communications (where you have opted in) are sent separately and always include an unsubscribe link.
Resend's privacy policy: resend.com/legal/privacy-policy
12. Site Photography
When we visit a site, we may take photographs for the purpose of our engineering assessment.
How We Handle Site Photographs
- We photograph the property, its structure, and its surroundings for engineering purposes
- We avoid photographing identifiable individuals where possible
- Where people are visible in photographs, we will blur faces before the photographs are included in reports or shared externally, unless we have consent to include them
- We strip GPS metadata from photographs before they are shared externally, unless location data is necessary for the engineering assessment
- Vehicle registration plates visible in photographs will be obscured where reasonably practicable
- Site photographs are retained for the periods set out in Section 7
Photographs Used for Marketing
We may use anonymised site photographs (showing completed work, structural details, or construction processes, with no identifiable individuals) for our portfolio, website, or social media. We will always seek your permission before using photographs of your property for marketing purposes.
13. Your Rights
Under UK GDPR, you have the following rights in relation to your personal data:
13.1 Right of Access Art. 15
You have the right to request a copy of the personal data we hold about you. This is commonly known as a "Subject Access Request" (SAR). We will respond within one calendar month.
13.2 Right to Rectification Art. 16
You have the right to ask us to correct any personal data that is inaccurate or to complete any data that is incomplete.
13.3 Right to Erasure Art. 17
You have the right to ask us to delete your personal data. However, this right is not absolute. Please see Section 14 below for important information about how this right interacts with our professional record-keeping obligations.
13.4 Right to Restriction of Processing Art. 18
You have the right to ask us to limit how we use your data in certain circumstances, for example while we are considering a request for rectification or an objection you have raised.
13.5 Right to Data Portability Art. 20
Where we process your data on the basis of consent or contractual necessity, and the processing is carried out by automated means, you have the right to receive your data in a structured, commonly used, and machine-readable format.
13.6 Right to Object Art. 21
You have the right to object to our processing of your personal data where we rely on legitimate interests as the lawful basis. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where the processing is necessary for legal claims.
You have an absolute right to object to the use of your data for direct marketing at any time.
13.7 Right to Withdraw Consent
Where we process your data on the basis of your consent (for example, marketing communications), you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
Website comments. If you gave us permission to publish a comment, you can withdraw it in one click from the same browser profile you sent it from, for as long as the withdrawal key remains in that browser, or by emailing us from the address you gave.
A valid one-click withdrawal stops publication on our website immediately. If you withdraw by email we will act without undue delay, and remove the comment from the public parts of the services under our control. We cannot guarantee that independent third parties will delete copies they made while the comment was public, or that search-engine caches and web archives outside our control will update straight away; where Article 17 requires it and it is reasonably practicable, we will take reasonable steps to inform other controllers that erasure has been requested.
If we had already published the comment, we keep a minimised record of what you wrote, the permission you gave and the relevant dates for 365 days after it comes down, so that we can provide supporting evidence and contact details if the Advertising Standards Authority needs to assess whether the published comment was genuine. That record is never published, and you can object to it under Article 21 — see Section 13.6 and the legitimate interests entry in Section 5.
13.8 Rights Related to Automated Decision-Making
We do not make decisions based solely on automated processing that produce legal effects or similarly significantly affect you. Our AI-assisted report preparation always involves human review and oversight (see Section 6.3). You have the right to request human intervention in any assessment.
13.9 How to Exercise Your Rights
To exercise any of these rights, please contact us:
- Email: info@pfandco.co.uk
- Telephone: +44 (0)1483 363020
- Post: PF & Co Holdings Ltd, 2 Queens Drive, Guildford, GU2 9PP
We will respond to your request within one calendar month. In exceptional circumstances, we may extend this by a further two months, but we will let you know within the first month if this is necessary and explain why.
We will not charge a fee for responding to your request unless the request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse the request.
14. Right to Erasure and Professional Record-Keeping
Engineering records serve an important public safety function. We want to be transparent about situations where we may need to retain project data even after you request its deletion.
Under Article 17(3) of the UK GDPR, the right to erasure does not apply where processing is necessary for:
- The establishment, exercise, or defence of legal claims (Article 17(3)(e)) — Engineering defects can emerge years or even decades after construction. We retain project records for the limitation periods set out in Section 7 so that we can respond to any claims or enquiries about our work.
- Compliance with a legal obligation (Article 17(3)(b)) — Certain records must be kept under the Construction (Design and Management) Regulations 2015, the Building Safety Act 2022, and tax legislation.
What Happens If You Request Erasure
If you ask us to delete your personal data, we will:
- Delete any marketing and contact data that we do not need for ongoing legal or professional purposes
- Restrict processing of project data that we are required to retain — this means we will store it securely but will not actively use it
- Inform you in writing which data has been deleted and which data we are retaining, together with the reasons and the date on which we expect to be able to delete it
- Set a review date and delete the retained data as soon as the retention period expires
Full details of our erasure procedure are documented in our Erasure SOP (GDPR-02), which is available on request.
15. Children's Data
Our services are directed at adults. We do not knowingly collect personal data from children under the age of 13. If you believe we have inadvertently collected data from a child under 13, please contact us and we will delete it promptly.
16. Cookies
Our website uses cookies and similar technologies. For full details of the cookies we use, their purposes, and how to manage your cookie preferences, please see our Cookie Policy (GDPR-09), available on our website.
17. How to Complain
If you are unhappy with how we have handled your personal data, you have the right to complain to the Information Commissioner's Office (ICO):
- Website: ico.org.uk
- Helpline: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
We would appreciate the opportunity to address your concerns before you contact the ICO. Please contact us first using the details in Section 1, and we will do our best to resolve the matter.
18. Changes to This Policy
We review this Privacy Policy at least once a year to ensure it remains accurate and up to date. If we make significant changes, we will update the "Last updated" date at the top of this page.
Where changes are material (for example, a new category of data sharing or a change to our lawful basis for processing), we will take reasonable steps to notify affected individuals, such as posting a notice on our website or, where appropriate, contacting you directly.
19. Contact Us
For any questions about this Privacy Policy or how we handle your personal data, please contact:
Data Protection Enquiries
PF & Co Holdings Ltd
2 Queens Drive, Guildford, GU2 9PP
Email: info@pfandco.co.uk
Telephone: +44 (0)1483 363020
Website: www.pfandco.co.uk
This Privacy Policy applies to PF & Co Holdings Ltd (trading as Site Intelligence), with engineering services delivered through PF & Co Construction Ltd (Company No. 12463571). It does not cover third-party websites linked from our site — please refer to their own privacy policies.