Privacy policy.

Who we are.

Apila Consultancy Limited, trading as Apila PM, provides client-side construction project management across the United Kingdom. We are the data controller for the personal data described in this policy.

This policy explains what personal data we collect, why we collect it, how we use it, and your rights under UK data protection law, including the UK General Data Protection Regulation and the Data Protection Act 2018.

The personal data we collect.

When you contact us or request a fee proposal. Through our website contact form, by phone, by email or through LinkedIn, we may collect your name, job title, organisation, phone number, email address, the project you are enquiring about, and any details you choose to provide.

When you become a client. We collect the information needed to deliver our services, including your contact details, project addresses, correspondence, meeting notes, project records and reports, invoices and payment records.

When you visit our website. We collect limited technical data through cookies, subject to your consent. See our cookie policy for full details.

We do not knowingly collect data from children. We do not collect special category data unless you volunteer it as part of describing a project requirement.

Why we use your data, and our lawful bases.

We use your personal data to:

• Respond to enquiries and prepare fee proposals. Lawful basis: legitimate interests, or steps taken at your request before entering a contract.
• Deliver our services, including programme management, reporting and correspondence. Lawful basis: performance of a contract.
• Issue invoices, take payment and keep accounting records. Lawful basis: contract and legal obligation.
• Keep records required by professional, regulatory or insurance obligations. Lawful basis: legal obligation and legitimate interests.
• Improve our website. Lawful basis: legitimate interests, with consent for analytics cookies.
• Respond to complaints and protect our legal position. Lawful basis: legitimate interests.

We do not sell your personal data, and we do not use it for automated decision-making or profiling.

Who we share your data with.

We share personal data only where necessary, with:

• Service providers who help us run the business. These currently include Lovable, which hosts this website, Supabase, which stores contact form submissions, Google Analytics, which provides website analytics where you have accepted analytics cookies, and Microsoft, which provides our email.
• Subconsultants and project team members, where they are engaged on a project you are involved in.
• Professional advisers, including our accountants and insurers, where needed.
• Regulators or authorities, where required by law.

All providers act under contracts that require them to protect your data and to use it only on our instructions.

International transfers.

We aim to keep personal data within the United Kingdom and the European Economic Area. Where a provider processes data outside these areas, appropriate safeguards are in place, such as UK approved standard contractual clauses or an adequacy decision.

How long we keep your data.

• Enquiries that do not become projects: up to 12 months.
• Client and project records, including reports and correspondence: 6 years after completion, or 12 years where the appointment was executed as a deed, reflecting the period during which a claim may be brought and our professional indemnity insurance requirements.
• Accounting and tax records: 6 years, as required by law.
• Analytics data: 14 months.
• Cookie consent records: 12 months.

When data is no longer needed, we delete or anonymise it securely.

How we protect your data.

We use appropriate technical and organisational measures, including secure hosting, access controls, strong authentication on business accounts, and encrypted transmission of website form data.

Your rights.

Under UK data protection law you have the right to access the personal data we hold about you, ask us to correct inaccurate data, ask us to delete your data where applicable, restrict or object to how we use your data, receive your data in a portable format, and withdraw consent at any time where we rely on consent.

To exercise any of these rights, contact johnny@apilapm.co.uk. We will respond within one month.

If you are not satisfied with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113.

Changes to this policy.

We may update this policy from time to time. Any changes will be published on this page with an updated date.

Contact us.