1. Data controller
The data controller responsible for your personal data is:
Architectural Drawings Ltd
86-90 Paul Street, London EC2A 4NE
Email: hello@architecturaldrawings.co.uk
ICO registration number: ZA847291
2. What personal data we collect
We collect and process the following categories of personal data, depending on how you interact with us:
- Identity data — your full name
- Contact data — email address, telephone number, postcode
- Project data — property address, project type, planning history, uploaded drawings, photographs and site survey information
- Account data — login credentials (email and hashed password) when you register for the client portal
- Transaction data — payment amounts and dates (card details are processed directly by Stripe and never stored on our systems)
- Technical data — anonymised page-view analytics collected via Plausible (no cookies, no personal identifiers)
We collect this data when you:
- Request a quote through our website
- Register for a client portal account
- Request a callback or send us an email
- Engage us for architectural services
3. Legal basis for processing
We rely on the following lawful bases under Article 6 of the UK GDPR:
- Contract performance — processing necessary to provide you with a quote, deliver our architectural services and manage your client account
- Legitimate interests — sending operational communications about your project, improving our services, and maintaining the security of our systems
- Consent — where you have explicitly opted in, for example to receive marketing communications (you may withdraw consent at any time)
- Legal obligation — where we are required to retain data to comply with tax, accounting or regulatory requirements
4. How we use your data
Your personal data is used for the following purposes:
- Processing and responding to your quote request
- Delivering architectural technology services, including preparing planning applications and building regulations drawings
- Managing your client portal account and project dashboard
- Sending operational emails related to your project (status updates, document delivery, invoice notifications)
- Processing payments via Stripe
- Complying with legal and regulatory obligations
We do not use your data for automated decision-making or profiling.
5. Third-party service providers
We share personal data only with trusted third-party processors who assist in delivering our services. Each operates under a data processing agreement:
- Stripe (payments) — processes card payments securely. Stripe is PCI DSS Level 1 certified. We never see or store your full card details.
- Postmark (transactional email) — delivers operational emails such as quote confirmations, project updates and password resets.
- Railway (hosting) — hosts our website and client portal infrastructure.
- Plausible Analytics (anonymous analytics) — provides cookieless, privacy-first website analytics. No personal data is collected or transmitted; all data is aggregated and anonymous.
We do not sell, rent or trade your personal data to any third party. We do not share your data with marketing companies.
6. International data transfers
Some of our third-party processors (Stripe, Postmark, Railway) may process data outside the United Kingdom. Where this occurs, appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the ICO, to ensure your data receives an equivalent level of protection.
7. Data retention
We retain your personal data only for as long as necessary for the purposes set out in this policy:
- Client account data — retained for the duration of your account plus 6 years after closure, in line with HMRC record-keeping requirements
- Quote request data (where no engagement follows) — retained for 2 years, then securely deleted
- Project files and drawings — retained for the duration of your account plus 6 years (to cover limitation periods for professional negligence claims)
- Transactional records — retained for 6 years as required by HMRC
8. Cookies and tracking
We take a minimal approach to cookies and tracking:
- No tracking cookies — we do not use Google Analytics, Facebook Pixel or any cookie-based tracking technology
- Plausible Analytics — our analytics tool is fully cookieless. It collects no personal data and does not track individual visitors across sessions
- sessionStorage for authentication — when you log into the client portal, we use your browser's sessionStorage (not cookies) to maintain your session. This data is automatically cleared when you close the browser tab
- Stripe — may set its own strictly necessary cookies during the payment process to prevent fraud
Because we do not use non-essential cookies, a cookie consent banner is not required under the Privacy and Electronic Communications Regulations (PECR).
9. Data security
We implement appropriate technical and organisational measures to protect your personal data, including:
- HTTPS encryption across our entire website and client portal
- Hashed and salted password storage
- Cyber Essentials certification (renewed annually)
- Access controls limiting staff access to data on a need-to-know basis
- Regular security reviews of our hosting and third-party integrations
10. Your rights
Under the UK GDPR, you have the following rights in relation to your personal data:
- Right of access — request a copy of the personal data we hold about you
- Right to rectification — request correction of inaccurate or incomplete data
- Right to erasure — request deletion of your data where there is no compelling reason for continued processing
- Right to data portability — receive your data in a structured, commonly used, machine-readable format
- Right to restrict processing — request that we limit how we use your data
- Right to object — object to processing based on legitimate interests
- Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing
To exercise any of these rights, please email hello@architecturaldrawings.co.uk. We will respond within one calendar month.
11. Right to complain
If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Website: ico.org.uk
Helpline: 0303 123 1113
We would appreciate the opportunity to address your concerns before you approach the ICO, so please contact us first.
12. Changes to this policy
We may update this privacy policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.
Last updated: April 2026