Privacy Policy

1. Data Controller & Registered Office

Orama Design & Build Ltd acts as the data controller for the personal data collected through our website (https://oramadesignandbuild.com), initial project consultations, and ongoing residential construction contracts.

Registered Office: 850 Green Lanes, London N21 2RS.
Operating Base: Potters Bar (EN6), serving Hertfordshire and North London.
Contact: Founder Costas Joannides, costas@oramadesignbuild.co.uk or 07940 077 994.

2. Personal Information We Collect

We collect personal information directly when you submit an enquiry, request a feasibility consultation, or enter into a building agreement:

• Identity & Contact Details: Full name, telephone number, email address, and communication preferences (including optional WhatsApp channel consent).
• Project & Property Information: Site address, postcode, property type (e.g., detached, semi-detached, Victorian terrace), architectural scope (extension, refurbishment, loft conversion, structural alteration), budget range, desired project start date, and planning permission status.
• Architectural & Technical Data: Existing floorplans, planning application drawings, structural engineering calculations, building control notices, and photographic site surveys provided during feasibility or construction.
• Technical & Security Logs: Anonymised IP addresses, browser user agent, device specifications, and anti-spam verification keys collected purely to safeguard form submission integrity and mitigate automated abuse.

3. Lawful Bases for Processing (UK GDPR Art. 6)

Under the UK GDPR, we process personal information strictly in accordance with one or more of the following lawful bases:

• Performance of a Contract or Pre-Contractual Steps (Art. 6(1)(b)): Evaluating project feasibility, conducting on-site surveys, issuing detailed architectural scopes and schedules of work, and managing residential building contracts through handover.
• Legitimate Business Interests (Art. 6(1)(f)): Responding to homeowner enquiries, maintaining project communications, defending against cybersecurity threats, and optimising website usability.
• Compliance with Legal & Statutory Obligations (Art. 6(1)(c)): Maintaining tax and financial accounting records, satisfying statutory Building Regulations Part A–S compliance, and archiving structural safety notices.
• Explicit Consent (Art. 6(1)(a)): Where you elect to receive optional updates or grant analytics consent under Google Consent Mode v2 (which can be revoked at any time).

4. Third-Party Processors & Data Sharing

We do not sell, rent, or trade personal data to third parties. We share data only with verified technical processors and professional partners required to deliver our services:

• Database & Infrastructure: Supabase Inc. (secure, encrypted database hosting for enquiry persistence and lead management).
• Notification Services: Secure SMTP mail relays for real-time notification of homeowner enquiries to senior project managers.
• Professional Subcontractors & Consultants: Structural engineers, approved building control inspectors (e.g. Hertfordshire Building Control), quantity surveyors, and specialist trades when required for your project.
• Analytics & Measurement: Google Tag Manager & Google Analytics 4 under Google Consent Mode v2 (strictly inactive until consent is granted).
• Client Reviews & Booking Embeds: Elfsight (display of verified Google Reviews) and Cal.com (optional consultation booking).
• Statutory & Local Authorities: Local planning authorities (e.g. Hertsmere Borough Council, Welwyn Hatfield, Barnet) and Building Control bodies when submitting plans on your behalf.

5. Data Retention Schedules

We maintain strict retention windows to balance legal requirements with homeowner privacy rights:

• General Website Enquiries: Uncontracted project enquiries are retained for up to 12 months for follow-up feasibility discussions, after which they are securely deleted or anonymised unless you request earlier deletion.
• Active Residential Building Contracts: Project agreements, structural calculations, as-built drawings, and warranty records are retained for 6 to 10 years following practical completion, complying with the UK Latent Damage Act 1986, Building Safety Act 2022, and standard construction defect limitation periods.
• Financial & Statutory Records: Invoices, payment receipts, and tax records are retained for 6 years following the end of the relevant tax year in compliance with HMRC statutory rules.

6. Data Security & Storage

All website transmissions are protected using 256-bit TLS encryption. Our server infrastructure applies strict Content Security Policy (CSP) headers, HTTP Strict Transport Security (HSTS), and database-level access restrictions to prevent unauthorised access, interception, or disclosure.

7. Your Statutory Rights (UK GDPR)

As an individual residing in the United Kingdom or EU, you hold extensive statutory rights under the UK GDPR:

• Right of Access: You may request a Subject Access Request (SAR) copy of all personal information we hold about you.
• Right to Rectification: You may request immediate correction of inaccurate or incomplete personal records.
• Right to Erasure ('Right to be Forgotten'): You may request deletion of personal information where no statutory or contractual obligation requires continued retention.
• Right to Restrict or Object: You may restrict processing or object to processing carried out under legitimate interests.
• Right to Data Portability: You may request transfer of your data in a structured, machine-readable format.
• Right to Withdraw Consent: Where processing relies on consent, you may withdraw it at any time without penalty.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF (Tel: 0303 123 1113, website: ico.org.uk).

8. Privacy Enquiries & Contact

To exercise any of your data rights, submit a question, or update your contact preferences, please email costas@oramadesignbuild.co.uk or telephone 07940 077 994. We respond to all verified statutory data requests in writing within one calendar month.