PF & CO HOLDINGS LTD | Site Intelligence
Privacy Policy
GDPR-08 | Public-Facing Privacy Policy for Website Deployment
Document Reference
GDPR-08-PP-2026-v1.0
Data Controller
PF & Co Holdings Ltd (16649319)
ICO Registration
C1899309
Classification
Public — Approved
Author
Chris Preston, Director
Last Updated
31 March 2026
Next Review
31 March 2027
Related Documents
GDPR-01 (Retention), GDPR-02 (Erasure SOP), GDPR-04 (Sub-Processors), GDPR-06 (ROPA), GDPR-07 (Transfers), GDPR-09 (Cookies)

1. Who We Are

PF & Co Holdings Ltd is a technology and engineering holding company. We trade under the name Site Intelligence for our planning intelligence and engineering report products.

Engineering services are delivered through our operating company, PF & Co Construction Ltd (Company No. 12463571). PF & Co Holdings Ltd is the data controller for all personal data we collect and process. This means we decide how and why your personal data is used.

Detail Information
Registered company name PF & Co Holdings Ltd
Company number 16649319
Registered in England and Wales
Registered office 2 Queens Drive, Guildford, GU2 9PP
Operating company PF & Co Construction Ltd (12463571)
Telephone +44 (0)1483 363020
Email info@pfandco.co.uk
Website www.pfandco.co.uk
ICO registration C1899309

We are registered with the Information Commissioner's Office (ICO) under registration number C1899309, as required by the Data Protection Act 2018.

2. About This Policy

This Privacy Policy explains what personal data we collect, how we use it, who we share it with, how long we keep it, and what rights you have. It applies to:

We have written this policy in plain English so that it is easy to understand. If you have any questions, please contact us using the details in Section 1.

3. What Personal Data We Collect

We collect different types of personal data depending on how you interact with us.

3.1 Client Contact Data

Your name, postal address, email address, telephone number, and any other contact details you provide when you instruct us or make an enquiry.

3.2 Project and Site Data

The address and location of the property or site you ask us to assess, including postcode, grid references, What3Words references, and any other site identification details. This may also include property ownership details, planning history, and building characteristics.

3.3 Site Photographs and Imagery

Photographs taken during site visits, which may include images of the property, its surroundings, and occasionally people present on or near the site. We may also obtain street-level imagery from Google Street View and Mapillary, and satellite imagery from Copernicus, to supplement our assessments.

3.4 Financial and Payment Data

Bank details, invoicing information, and payment records necessary to process fees for our services. Payment card data is collected and processed by our payment service providers (Stripe and GoCardless) and is never stored on our systems. See Section 10 for details.

3.5 Website Usage Data

Information about how you use our website, including pages visited, time spent on pages, and how you arrived at our site. This data is collected through cookies and similar technologies. See our Cookie Policy (GDPR-09) for details.

3.6 Marketing Consent Data

Records of any consent you have given or withdrawn for us to send you marketing communications.

3.7 Correspondence Data

Emails, letters, WhatsApp messages, and other communications between you and us relating to our services or your project.

4. How We Collect Your Data

We collect personal data in the following ways:

4.1 Directly From You

When you contact us by telephone, email, WhatsApp, or through our website contact form; when you instruct us to carry out engineering or consultancy services; and when you visit our offices.

4.2 From Our Website

When you browse our website, submit a form, or interact with our online content. See our Cookie Policy (GDPR-09) for details of the cookies we use.

4.3 From Site Visits

When we visit a property or site to carry out surveys, inspections, or observations as part of our engineering services.

4.4 From Publicly Available Sources

As part of our engineering and planning intelligence work, we routinely obtain data from publicly available sources. Our automated enrichment pipeline gathers data from the following sources to inform our assessments and reports:

Data Source Data Obtained Licence / Basis
Local authority planning portals Planning application history, officer reports, decision notices Public register (open data)
EPC Register Energy Performance Certificate data Open Government Licence
British Geological Survey (BGS) Geological data, borehole records, bedrock and superficial geology Open Government Licence
Environment Agency (EA) Flood risk zones, surface water risk, historic flooding, LIDAR data Open Government Licence
Historic England National Heritage List for England (listed buildings, scheduled monuments, conservation areas) Open Government Licence
Natural England Ecological designations, SSSIs, Living England habitat data, agricultural land classification Open Government Licence
HM Land Registry Title and ownership information (where commissioned by you), sold price data Open Government Licence / commissioned
Ordnance Survey (OS Data Hub) Mapping data, basemaps for site location and constraint maps OS OpenData Licence / OS Data Hub API
National Biodiversity Network (NBN) Atlas Species records and ecological data Open data (various licences)
PropertyData Sold property comparables, market intelligence, area statistics Commercial licence
MapTiler Mapping tiles for report visualisations Commercial licence
Copernicus / Sentinel Satellite imagery for site context and environmental analysis EU Copernicus Open Licence
What3Words Three-word address references for site identification Commercial API licence
NOMIS (ONS) Census demographics, housing data, affordability ratios, employment data Open Government Licence
Department for Transport (DfT) Road traffic count data (AADT, count points) Open Government Licence
DEFRA Air quality background concentrations, MAGIC environmental data Open Government Licence
Coal Authority Coal mining risk data and past mining activity Open Government Licence
Postcodes.io Postcode lookups, ward, parish, constituency data Open data
Google Street View Street-level imagery for site context Google Maps Platform licence
Mapillary Street-level imagery (crowdsourced) CC BY-SA licence

This data is used to inform our engineering assessments and reports. Where this data relates to your property or site, it forms part of the project record.

4.5 From Third-Party Referrals

When an architect, builder, planning consultant, or other professional refers you to us, they may provide us with your name, contact details, and basic project information.

5. Why We Use Your Data and Our Legal Basis

Under the UK General Data Protection Regulation (UK GDPR), we must have a lawful basis for processing your personal data. The table below sets out each purpose for which we process data and the corresponding lawful basis.

Purpose Lawful Basis Explanation
Providing engineering services — carrying out site feasibility assessments, planning intelligence reports, flood risk assessments, desk studies, structural design, and other services you commission Contractual necessity Art. 6(1)(b) We need to process your data to perform the contract we have with you, or to take steps at your request before entering into a contract
AI-assisted report preparation — using artificial intelligence tools to research publicly available data, draft report content, and format documents (see Section 6) Contractual necessity Art. 6(1)(b) and Legitimate interests Art. 6(1)(f) AI processing is integral to delivering the services you have commissioned. It is also in our legitimate interest to use efficient tools to deliver high-quality reports. This does not override your rights
Business administration — managing our files, scheduling, internal records, quality assurance, and project management Legitimate interests Art. 6(1)(f) It is in our legitimate interest to run our business efficiently. This does not override your rights
Financial and tax records — invoicing, payment processing, corporation tax records, and financial reporting Legal obligation Art. 6(1)(c) We are required by law to keep financial records under the Companies Act 2006 and HMRC requirements
CDM and building safety records — records required under the Construction (Design and Management) Regulations 2015 and the Building Safety Act 2022 Legal obligation Art. 6(1)(c) We are required by law to create and retain certain health and safety records
Marketing communications — sending you information about our services, blog posts, or project updates Consent Art. 6(1)(a) or Legitimate interests Art. 6(1)(f) Where you have given consent, we rely on that consent. For existing clients, we may rely on legitimate interests to send relevant service information, with an easy opt-out in every communication
Website analytics — understanding how visitors use our website to improve our content and user experience Legitimate interests Art. 6(1)(f) It is in our legitimate interest to understand how our website is used so we can improve it. This does not override your rights
Responding to enquiries — replying to your questions, requests, or complaints Legitimate interests Art. 6(1)(f) or Contractual necessity Art. 6(1)(b) Depending on the nature of your enquiry, we process your data either to perform a contract or because it is in our legitimate interest to respond to communications
Professional indemnity insurance — providing information to our insurers in the event of a claim or potential claim Legitimate interests Art. 6(1)(f) It is in our legitimate interest to maintain insurance and defend claims. This does not override your rights
Legal claims — establishing, exercising, or defending legal claims Legitimate interests Art. 6(1)(f) It is in our legitimate interest to protect our legal rights

6. Use of Artificial Intelligence

This section explains how we use artificial intelligence (AI) tools in our work and what that means for your personal data.

6.1 How We Use AI

PF & Co Holdings Ltd uses AI tools to assist in the preparation of planning intelligence reports, site feasibility assessments, and other technical documents. Our system operates 68 specialised AI agents, each focused on a specific domain such as flood risk, heritage, ecology, transport, or market analysis. These agents research publicly available data, draft report content, and format documents to produce comprehensive assessments.

AI is used at every stage of report production, from initial data gathering through to quality assurance. This enables us to deliver thorough, multi-disciplinary assessments that would otherwise require large teams of specialists.

6.2 What Data May Be Processed by AI

When we prepare reports and assessments for your project, the following types of data may be processed through AI systems:

6.3 Human Oversight

All AI outputs are reviewed, verified, and approved by qualified professionals before any report is issued. AI tools do not make autonomous decisions about your project. Every assessment, conclusion, and recommendation in our reports reflects the professional judgment of the engineer or consultant responsible for your project.

Our reports pass through a multi-layer quality assurance pipeline before issue, including automated compliance checks, cross-domain consistency validation, and human review.

PF & Co Holdings Ltd retains full professional responsibility for all deliverables, regardless of the tools used in their preparation.

6.4 Our AI Service Provider

Our primary AI service provider is Anthropic Inc., based in San Francisco, United States. The classification of AI service providers under UK GDPR (whether they act as a "data processor" or a "joint controller") is an evolving area of law. The Information Commissioner's Office (ICO) has indicated that where an AI provider exercises a degree of independent determination over how data is processed, a joint controller relationship may exist under Article 26 of UK GDPR.

We have taken the following steps to protect your data regardless of the precise legal classification:

We keep this position under review and will update our arrangements if the ICO issues definitive guidance or if our legal classification of Anthropic's role changes.

6.5 Data Protection Impact Assessment

We have conducted a Data Protection Impact Assessment (DPIA) for our use of AI tools in the preparation of engineering and planning intelligence reports, as required by Article 35 of UK GDPR where processing is likely to result in a high risk to individuals' rights and freedoms. The DPIA is documented internally as GDPR-11 and is reviewed annually. A summary of this assessment is available on request.

6.6 Your Rights Regarding AI Processing

You have the right to:

7. How Long We Keep Your Data

We keep your personal data only for as long as we need it. The retention periods below are based on legal requirements, professional obligations, and industry best practice. Full details are set out in our Data Retention Policy (GDPR-01), which is available on request.

Data Category Retention Period Reason
Engineering reports and calculations 15 years from project completion Limitation Act 1980, Latent Damage Act 1986 (15-year longstop), and Building Safety Act 2022
Structural drawings 15 years from project completion As above
Client contact details Duration of engagement plus 6 years Contractual limitation period
Site photographs 15 years from project completion May be relevant to latent damage claims
Enrichment data (flood risk, geology, heritage, ecology, demographics, market data) 15 years from project completion Forms part of the engineering record; supports report conclusions
Financial records (invoices, receipts) 6 years from end of financial year Companies Act 2006 and HMRC requirements
CDM health and safety records Life of the building, or 15 years if demolished CDM 2015 Regulation 12
Building Safety Act records 30 years from project completion Building Safety Act 2022 retrospective limitation provisions
Marketing consent records Duration of consent plus 2 years Evidence of PECR compliance
Website analytics data 26 months ICO guidance on proportionate retention
AI processing logs 6 years (our records); 7 days (at Anthropic) Professional indemnity insurance claims period
General correspondence 6 years from last communication Contractual limitation period
Abandoned/cancelled projects (no report issued) 2 years from last client contact Limited ongoing legitimate interest in potential reactivation
Demo/test projects (internal only) 30 days from creation No ongoing purpose; data minimisation

When a retention period expires, we will securely delete or anonymise your data. Where data is held in both electronic and paper format, both copies will be dealt with.

7.1 Why We May Need to Keep Some Data Longer

Engineering records may need to be retained beyond the standard period if:

8. Who We Share Your Data With

We do not sell your personal data. We share your data only where necessary and only with the recipients described below. A full, maintained register of our sub-processors is held internally as the Sub-Processor Register (GDPR-04) and is available on request.

8.1 Technology Service Providers

Provider Location Purpose Safeguard
Anthropic Inc. United States AI-assisted report preparation (see Section 6) DPA with UK Addendum; data auto-deleted within 7 days
Stripe United States Payment processing (see Section 10) UK-US Data Bridge; PCI DSS Level 1 certified
GoCardless United Kingdom Direct debit payment processing (see Section 10) UK-based; FCA authorised
Resend United States Transactional email delivery (see Section 11) DPA in place; UK-US Data Bridge
Vercel United States Website hosting and analytics DPA in place; UK-US Data Bridge
ElevenLabs United States Voice AI for audio content (blog narration only; no client data processed) DPA in place

8.2 Mapping and Imagery Providers

Provider Location Purpose Safeguard
Ordnance Survey (OS Data Hub) United Kingdom Mapping basemaps for site location and constraint maps UK-based; OS OpenData Licence
MapTiler Luxembourg (EU) Mapping tiles for report visualisations EU-based; UK adequacy decision applies
Google Street View United States Street-level imagery for site context photographs Google Maps Platform Terms; UK-US Data Bridge
Mapillary (Meta) United States Street-level imagery (crowdsourced) DPA in place
Copernicus / Sentinel European Union Satellite imagery for site context and environmental analysis EU-based; UK adequacy decision applies

8.3 Professional and Regulatory Recipients

Recipient Purpose Basis
Building Control bodies Where we submit structural calculations or reports on your behalf Legal obligation / contractual necessity
Local planning authorities Where we submit planning documents on your behalf Legal obligation / contractual necessity
Professional indemnity insurers In the event of a claim or potential claim against us Legitimate interests (defending legal claims)
Your other appointed professionals Sharing project information with your architect, builder, or other consultants at your instruction Contractual necessity
Legal and professional advisers Where we need legal or professional advice Legitimate interests
Law enforcement or regulators Where we are required to do so by law Legal obligation

9. International Data Transfers

Some of our service providers are based outside the United Kingdom. This means your personal data may be transferred internationally. The following providers involve transfers to countries outside the UK:

Provider Country Transfer Safeguard
Anthropic Inc. (AI processing) United States UK Extension to the EU-US Data Privacy Framework ("UK-US Data Bridge") and/or Standard Contractual Clauses with UK Addendum; DPA in place
Stripe (payments) United States UK-US Data Bridge; Standard Contractual Clauses; PCI DSS Level 1
Resend (email) United States UK-US Data Bridge; DPA in place
Vercel (hosting) United States UK-US Data Bridge; DPA in place
Google (Street View) United States UK-US Data Bridge; Google Data Processing Terms
Mapillary / Meta (imagery) United States UK-US Data Bridge; DPA in place
ElevenLabs (voice AI) United States DPA in place (no client personal data processed)
MapTiler (mapping) Luxembourg (EU) UK adequacy decision for the EU (effective since 28 June 2021)
Copernicus (satellite) European Union UK adequacy decision for the EU

Where we transfer data to the United States, we rely on one or more of the following safeguards:

Where we transfer data to the European Union, the UK government has made an adequacy decision under Section 17A of the Data Protection Act 2018, meaning no additional safeguards are required.

We have conducted a Transfer Impact Assessment (documented internally as GDPR-07) for all international transfers. A copy of the safeguards we have in place is available on request by contacting us at the details set out in Section 1.

10. Payment Processing

We use third-party payment processors to handle payments for our services. We do not store your payment card details on our systems.

10.1 Stripe

Stripe, Inc. (United States) processes card payments on our behalf. When you pay by credit or debit card, your card details are submitted directly to Stripe's secure payment infrastructure. Stripe is certified to PCI DSS Level 1, the highest level of payment card industry security. We receive only a confirmation of payment and a truncated card reference (last four digits) — we never see or store your full card number.

Stripe's privacy policy: stripe.com/gb/privacy

10.2 GoCardless

GoCardless Ltd (United Kingdom) processes direct debit payments on our behalf. When you set up a direct debit, GoCardless collects your bank account details (sort code and account number) directly. GoCardless is authorised by the Financial Conduct Authority (FCA) under the Payment Services Regulations 2017. We receive confirmation of payment status but do not store your full bank account details.

GoCardless's privacy policy: gocardless.com/privacy

10.3 What Payment Data We Hold

We retain the following payment-related data for our own records:

This data is retained for 6 years from the end of the financial year in which the transaction occurred, in accordance with our obligations under the Companies Act 2006 and HMRC requirements. See Section 7 and our Data Retention Policy (GDPR-01) for full details.

11. Email Service

We use Resend (United States) to send transactional emails, including:

When we send you an email via Resend, your email address and the message content are processed by Resend's infrastructure. Resend acts as a data processor on our behalf under a Data Processing Agreement. Resend does not use your data for its own marketing purposes.

We do not use Resend for marketing emails. Marketing communications (where you have opted in) are sent separately and always include an unsubscribe link.

Resend's privacy policy: resend.com/legal/privacy-policy

12. Site Photography

When we visit a site, we may take photographs for the purpose of our engineering assessment.

How We Handle Site Photographs

Photographs Used for Marketing

We may use anonymised site photographs (showing completed work, structural details, or construction processes, with no identifiable individuals) for our portfolio, website, or social media. We will always seek your permission before using photographs of your property for marketing purposes.

13. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

13.1 Right of Access Art. 15

You have the right to request a copy of the personal data we hold about you. This is commonly known as a "Subject Access Request" (SAR). We will respond within one calendar month.

13.2 Right to Rectification Art. 16

You have the right to ask us to correct any personal data that is inaccurate or to complete any data that is incomplete.

13.3 Right to Erasure Art. 17

You have the right to ask us to delete your personal data. However, this right is not absolute. Please see Section 14 below for important information about how this right interacts with our professional record-keeping obligations.

13.4 Right to Restriction of Processing Art. 18

You have the right to ask us to limit how we use your data in certain circumstances, for example while we are considering a request for rectification or an objection you have raised.

13.5 Right to Data Portability Art. 20

Where we process your data on the basis of consent or contractual necessity, and the processing is carried out by automated means, you have the right to receive your data in a structured, commonly used, and machine-readable format.

13.6 Right to Object Art. 21

You have the right to object to our processing of your personal data where we rely on legitimate interests as the lawful basis. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where the processing is necessary for legal claims.

You have an absolute right to object to the use of your data for direct marketing at any time.

13.7 Right to Withdraw Consent

Where we process your data on the basis of your consent (for example, marketing communications), you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

13.8 Rights Related to Automated Decision-Making

We do not make decisions based solely on automated processing that produce legal effects or similarly significantly affect you. Our AI-assisted report preparation always involves human review and oversight (see Section 6.3). You have the right to request human intervention in any assessment.

13.9 How to Exercise Your Rights

To exercise any of these rights, please contact us:

We will respond to your request within one calendar month. In exceptional circumstances, we may extend this by a further two months, but we will let you know within the first month if this is necessary and explain why.

We will not charge a fee for responding to your request unless the request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse the request.

14. Right to Erasure and Professional Record-Keeping

Engineering records serve an important public safety function. We want to be transparent about situations where we may need to retain project data even after you request its deletion.

Under Article 17(3) of the UK GDPR, the right to erasure does not apply where processing is necessary for:

What Happens If You Request Erasure

If you ask us to delete your personal data, we will:

  1. Delete any marketing and contact data that we do not need for ongoing legal or professional purposes
  2. Restrict processing of project data that we are required to retain — this means we will store it securely but will not actively use it
  3. Inform you in writing which data has been deleted and which data we are retaining, together with the reasons and the date on which we expect to be able to delete it
  4. Set a review date and delete the retained data as soon as the retention period expires

Full details of our erasure procedure are documented in our Erasure SOP (GDPR-02), which is available on request.

15. Children's Data

Our services are directed at adults. We do not knowingly collect personal data from children under the age of 13. If you believe we have inadvertently collected data from a child under 13, please contact us and we will delete it promptly.

16. Cookies

Our website uses cookies and similar technologies. For full details of the cookies we use, their purposes, and how to manage your cookie preferences, please see our Cookie Policy (GDPR-09), available on our website.

17. How to Complain

If you are unhappy with how we have handled your personal data, you have the right to complain to the Information Commissioner's Office (ICO):

We would appreciate the opportunity to address your concerns before you contact the ICO. Please contact us first using the details in Section 1, and we will do our best to resolve the matter.

18. Changes to This Policy

We review this Privacy Policy at least once a year to ensure it remains accurate and up to date. If we make significant changes, we will update the "Last updated" date at the top of this page.

Where changes are material (for example, a new category of data sharing or a change to our lawful basis for processing), we will take reasonable steps to notify affected individuals, such as posting a notice on our website or, where appropriate, contacting you directly.

19. Contact Us

For any questions about this Privacy Policy or how we handle your personal data, please contact:

Data Protection Enquiries
PF & Co Holdings Ltd
2 Queens Drive, Guildford, GU2 9PP

Email: info@pfandco.co.uk
Telephone: +44 (0)1483 363020
Website: www.pfandco.co.uk

This Privacy Policy applies to PF & Co Holdings Ltd (trading as Site Intelligence), with engineering services delivered through PF & Co Construction Ltd (Company No. 12463571). It does not cover third-party websites linked from our site — please refer to their own privacy policies.