Privacy notice.

Who we are.

The Plan Company is a trading name of The Plan Company London Ltd, a company registered in England & Wales (company number 17105830), registered office 60 Midland Road, Wellingborough, NN8 1LU. For anything in this notice you can reach us at hello@theplancompany.co.uk. We're the data controller for the personal data described below.

What we collect.

We only collect what we need to quote, design and submit your project. Specifically:

• Contact details, name, email, phone, postcode and address of the site.
• Project details, what you want to build, photos or sketches you send us, existing drawings, survey data.
• Form submissions, anything you type into the quote form or contact form on this site.
• Payment details, handled entirely by Stripe. We see the last four digits, the card brand and whether the payment cleared. We never see or store the full card number.
• Technical data, IP address, browser, device type, and the pages you visit. See the cookies notice for detail.

Inside the client portal.

If you book a package you get a login to the portal so you can track your job, send us files and message the team. While you use it we hold:

• Sign-in records, the date, time and IP address you signed in from, so we can flag suspicious access.
• Files you upload, photos of the site, sketches, existing drawings, surveys and anything else you attach to your project.
• Messages between you and our team, read only by the team members assigned to your project, plus internal notes the team writes for context.
• Project status timeline, which stage your job is at (survey, drawings, calculations, submission, completion).
• Push notification tokens, only if you opt in to push notifications from your device.

Why we're allowed to use it.

Under UK GDPR we have to point to a lawful basis. Ours are:

• Performance of a contract - we need your data to quote your job, produce drawings and calculations, and submit to Building Control. Without it we can't do the work.
• Legitimate interest, to follow up on a quote you started, send service emails about your project, and run basic analytics so we know which pages help people and which don't. You can object at any time.
• Legal obligation, to keep financial records for HMRC and to respond to lawful requests.
• Consent, for analytics and advertising cookies (collected via the cookie banner) and for any marketing emails outside an active project. You can withdraw consent at any time.

Who we share it with.

A short list of processors who help us run the service:

• Supabase, UK GDPR-compliant database, authentication and file storage. Holds the bulk of your data: account login, project files and drawings, messages between you and our team, and the internal notes our team writes about your project. EU-hosted in the Frankfurt region.
• Netlify, the host that serves this website. UK and EU edge servers.
• Stripe, card payments. Stripe processes cardholder data on our behalf.
• Resend, transactional email (quote confirmations, project updates, invoices).
• Ordnance Survey (OS Places API), when you type your address into the quote form, the search is processed by Ordnance Survey to return matching UK addresses. We send postcode and partial address text only, nothing else.
• Google Tag Manager and Google Analytics 4, measures which pages help people convert. Loads only after you accept cookies via the banner. See the cookies notice for the cookies these set.
• Meta Pixel, advertising measurement, fired through Google Tag Manager. Loads only with your cookie consent.
• WhatsApp Business (Meta), if you message us via WhatsApp (the button on the contact page), the conversation is handled through Meta's WhatsApp Business API.
• Building Control, the relevant local authority or approved inspector for your submission. This is the whole point of the service.

We don't sell your data. We don't share it with anyone outside this list unless we're legally required to.

International transfers.

Some processors are based outside the UK. Stripe, Google and Meta are US companies; Resend and Supabase host data inside the EEA. Where data leaves the UK we rely on the UK Government's adequacy decisions, the UK International Data Transfer Addendum, or the EU Standard Contractual Clauses, depending on the supplier. We pick suppliers with these safeguards in place rather than ones without.

How long we keep it.

We don't keep data forever. Specifically:

• Quote-only enquiries (no booking), up to 12 months, then deleted.
• Project files and drawings - 7 years from the date of delivery, in line with the limitation period for construction claims and our professional indemnity requirements.
• Financial records, 6 years from the end of the relevant accounting period, as required by HMRC.
• Marketing list entries - until you unsubscribe, or 2 years of no engagement, whichever comes first.
• Portal account inactivity, if you don't log in for 24 months we email a heads-up before closing the account. The underlying project files stay on the 7-year retention above.

Your rights.

UK GDPR gives you rights over your data. You can ask us to:

• Access, give you a copy of what we hold about you.
• Rectify, correct anything wrong or out of date.
• Erase, delete your data, subject to records we have to keep for legal or insurance reasons.
• Restrict, pause our use of your data while a dispute is resolved.
• Port, receive your data in a machine-readable format so you can take it elsewhere.
• Object, to processing based on legitimate interest, including any marketing.

To exercise any of these, email hello@theplancompany.co.uk. We'll respond within one month. We may ask for proof of identity so we don't hand your data to the wrong person.

Complaints to the ICO.

If you think we've mishandled your data and we haven't fixed it to your satisfaction, you have the right to complain to the Information Commissioner's Office. Their contact details are at ico.org.uk/make-a-complaint. We'd prefer you tell us first so we have a chance to put it right.

Changes to this notice.

When we change anything material we'll update the date at the top. For active clients we'll also email a heads-up. This version was published on 5 June 2026.