1. Controller and contact
For the client enquiries collected through this portal, the intended controller is Dr. Ali Mohammed trading as Arch-iD Ltd / Alyco, an architectural design practice. Enquiries and information-rights requests: amohammed31@lancashire.ac.uk. This notice must be updated if a separately incorporated company takes on that role. No statutory Data Protection Officer is represented as appointed.
2. Information collected and why
Project enquiry forms collect your name, email, optional telephone, whether you are enquiring as a consumer or business, the selected service, an approximate project region and the description you choose to supply. Data-rights request forms collect name, email, request type and optional details. Servers also process essential network and security information in connection with lawful operating logs.
We use the information to answer your enquiry, take steps you request towards an appointment, administer appointments if agreed, manage records and comply with legal responsibilities. We do not require special-category health information, identification scans or sensitive building-access information through public forms.
2A. Client account registration (proposed secure portal)
If the owner activates the Supabase-backed client portal, registration collects full name, date of birth, phone number, email and authentication credentials. The date of birth and phone number are used as privately held registration attributes and are not disclosed to project collaborators. Birth dates are self-reported; phone numbers are collected but not independently verified. Passwords are handled by the hosted identity provider and are not stored as plaintext by Arch-iD Ltd.
Client accounts, project membership, notes and chat may be processed in a Supabase-managed PostgreSQL project, with drawings in private access-controlled object storage. The intended administrator of the database project is the Arch-iD Ltd practice owner; collaborators may access only projects to which they are assigned. The owner must confirm actual processing locations, data retention periods, lawful basis (including the specific reason for requesting date of birth), deletion procedure, processor terms, and privacy rights contact before real registration is enabled.
3. Lawful grounds
Depending on the situation, the intended bases are steps taken at your request before entering a contract, contract performance (where a contract exists), compliance with a legal obligation and limited legitimate interests such as proportionate practice administration, record integrity and fraud prevention. Marketing consent is not requested or inferred from an enquiry. Legally required processing does not rely on consent merely because you acknowledge this notice.
4. Recipients, processors and transfers
Information is intended to be accessible only to authorised practice administrators, secure hosting and technical service providers, and necessary professional advisers or legal authorities when justified. Before deployment the practice must document the actual hosting, support, backup, email and other processors and establish required processor contracts and any safeguards for restricted international transfers. The software contains no third-party analytics or advertising trackers by default.
5. Security and restricted collection
Enquiry, user identity, project membership, milestones, messages and notes are stored in a private server-side database. Private uploaded drawings are stored outside the public site directory and checked for project membership on download. The service uses third-party identity providers only if the user opts for Google or Microsoft login. A restricted Excel workbook is regenerated from database records and available only through an authenticated administration endpoint. The public site does not contain client-submission data. Production must employ HTTPS, suitable identity and access controls, encrypted storage/backups, patching, logs and tested incident response procedures. Excel downloads become the administrator's responsibility to secure.
6. Retention and deletion
Records should be kept no longer than necessary for enquiry response, contractual, tax, insurance and potential legal-claims purposes. Before launch, Arch-iD Ltd must adopt and publish a clear retention schedule covering unsuccessful enquiries, active/completed appointments, consent records, audit logs and rights requests. Rights requests are not automatically deleted; the controller assesses identity, legal exemptions and other obligations before taking action.
7. Information rights and complaints
You may have rights to request access, rectification, erasure, restriction, objection or portability, depending on circumstances. You may use the Privacy Desk or contact the controller directly. A reasonable identity check may be required before information is disclosed. The portal records an indicative review-by date; actual statutory deadlines and extensions must be assessed by the controller. You can complain to the Information Commissioner's Office.
8. Automated processing
The website automatically logs enquiries and information-rights requests, generates references, and maintains an Excel snapshot. It does not automatically accept contracts, approve fees, decide personal-data rights or make decisions producing legal or similarly significant effects about people. Human review is required.
9. Cookies and changes
The studio uses a necessary, short-lived, HttpOnly authenticated-session cookie and an OAuth state cookie during Google or Microsoft sign-in, when configured. The existing private administration area separately uses HTTP Basic authentication. No advertising trackers are supplied by default. Hosting and embedded services must be reviewed separately for cookies and tracking and for any additional notice or consent obligations. Updated notices should show their effective date and explain material changes.