Privacy Policy

1. Data Controller & Scope

Orama Design & Build Ltd ("Orama", "we", "us", or "our") acts as the data controller responsible for the personal data collected through our website (https://oramadesignandbuild.com), digital communications, and project management services.

This policy applies globally to all users, regardless of their location, and complies with applicable international data protection laws including the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), the California Consumer Privacy Act (CCPA/CPRA), and other global privacy frameworks.

2. Information We Collect

We collect personal information that you voluntarily provide to us, as well as technical data generated automatically when you interact with our website:

• Identity & Contact Data: Name, email address, telephone number, and preferred communication channels supplied when submitting an enquiry or contacting us.
• Project & Property Data: Site address, postcode, property type, estimated scope of work, budget indications, architectural preferences, and planning background.
• Communications Data: Records of correspondence via email, online contact forms, phone calls, WhatsApp messages, or site consultation notes.
• Technical & Usage Data: IP address, browser type, device information, operating system, referrer URLs, and security logs collected to protect website integrity and prevent fraudulent form submissions.

3. Legal Bases & Purposes of Processing

We process personal data only when authorised by applicable privacy laws under the following lawful bases:

• Performance of a Contract (or pre-contractual steps): Processing your enquiry, preparing site feasibility assessments, issuing project proposals, and fulfilling architectural and construction agreements.
• Legitimate Business Interests: Operating, optimising, and securing our website, protecting against spam and security threats, maintaining accurate client management records, and managing business operations.
• Compliance with Legal Obligations: Retaining financial records, tax accounting, building control documentation, health and safety compliance, and responding to statutory law enforcement requests.
• Consent: Where you voluntarily request marketing updates or opt into specific communication channels (which you can withdraw at any time).

4. Data Sharing & Third-Party Processors

We do not sell, rent, or trade your personal information to third parties. We share data only with trusted service providers necessary to deliver our website and services:

• Infrastructure & Cloud Providers: Secure web hosting, database storage, server management, and security services.
• Professional Sub-Contractors & Partners: Structural engineers, approved building control inspectors, quantity surveyors, and architectural partners engaged for your project.
• Communications Tools: Email deliverability platforms and direct communication tools (such as WhatsApp Business) where initiated by you.
• Legal & Regulatory Bodies: Local authorities, planning departments, building control bodies, tax authorities, and legal advisers where required by law.

5. International Data Transfers

As we operate globally and utilise enterprise cloud technology, your information may be processed on servers located outside your home jurisdiction, including in the United Kingdom, the European Union, and the United States.

Where data is transferred internationally, we ensure appropriate safeguards are implemented, such as UK Standard Contractual Clauses (SCCs), EU Model Clauses, UK Adequacy Decisions, or international data transfer agreements guaranteeing an equivalent level of privacy protection.

6. Retention & Data Security

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, building control, and warranty requirements. General website enquiries that do not result in an active project are archived or securely deleted within a reasonable retention window.

We maintain technical and organisational measures to safeguard your information against unauthorised access, loss, misuse, or alteration. These include SSL/TLS encryption, restricted database access, firewalls, and server-level rate limiting.

7. Your Rights (UK, EU & Worldwide)

Depending on your jurisdiction (including under UK GDPR, EU GDPR, and US Privacy Laws), you hold specific rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete information.
• Right to Erasure ('Right to be Forgotten'): Request deletion of your data where legal grounds permit.
• Right to Restriction & Objection: Object to processing based on legitimate interests or request processing restrictions.
• Right to Data Portability: Request transfer of your data in a structured, machine-readable format.
• California Rights (CCPA/CPRA): California residents have the right to know what personal information is collected, request deletion, and opt out of any data sharing (we do not sell personal data).
• Right to Complain: You have the right to lodge a complaint with your local data protection authority, such as the UK Information Commissioner's Office (ICO) at ico.org.uk.

8. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or need assistance, please contact us at costas@oramadesignbuild.co.uk or call 07940 077 994.