Privacy Policy

1. Who We Are

GHD Approvals Ltd is a company registered in the United Kingdom with its operating address at 12 Buttermere Road, Liverpool - L16 2NN, United Kingdom (GB). The firm provides computer systems design and related professional services, with a particular focus on permit application handling for planning, licensing and inspection processes. In data protection terms, GHD Approvals Ltd is the controller for the personal data described in this policy, which means that the company decides why the data is held and how it is used.

Where we handle personal data on behalf of a client under written instructions, for example where a client asks us to manage a case file inside their own systems, the company may act as a processor for that client. In those situations the client remains the controller, and our use of the data is limited to the instructions recorded in the engagement and to the lawful handling of the case. The boundaries between controller and processor work are recorded at intake, so that responsibility is never left ambiguous.

You can reach the desk by email at permits@ghdapprovals.lat, by telephone on +12674895046, or by post at the address above. The same contact points apply for any question about this policy, any request to exercise a right described below, or any concern about the way personal data has been handled.

2. Scope of This Policy

This policy covers personal data processed through this website, through email and telephone contact with the desk, and through the case files kept in the permit ledger. It applies to prospective clients, existing clients, named contacts at client organisations, applicants and agents whose details appear in a submission, site staff and contractors, professional advisers, authority officers where their details are recorded in correspondence, and suppliers who provide services to the desk.

The policy does not cover websites operated by other organisations, even where a link to them appears on this site or where we share a case file with them at the instruction of a client. Those organisations are responsible for their own privacy notices, and we recommend that you read them before supplying personal data.

The policy also does not replace the specific arrangements that may be set out in a written engagement. Where a client agreement contains data protection terms, those terms apply to the work described in that agreement and take priority over any general statement in this policy that is less protective of the individual concerned.

3. Personal Data We Collect

We collect only the personal data that is necessary for the permit work described in this policy. The categories that may be held include identity details such as name and job title, contact details such as postal address, email address and telephone number, organisation details such as employer or firm, and the content of correspondence sent to the desk.

Case files may also contain information about a person role in a project, including whether that person is a site contact, a responsible person for a licence, an author of a report or a signatory on an application. Where a submission requires professional declarations, the file may record the professional body and registration number of the person making the declaration. We do not seek sensitive categories of data, such as health information or information about beliefs, but a client may occasionally include such information in a document that is necessary to an application, and in that case it is handled as part of the case record.

Technical data collected through this website is limited. The site is a set of static pages and does not include a customer account system, an online payment facility or a stored contact database. When you visit a page, the server that delivers it will process an internet protocol address and standard request information in order to return the page and to protect the service against misuse. We do not use that information to build a profile of individual visitors.

• Identity data: name, title, role in a project or organisation.
• Contact data: postal address, email address, telephone number.
• Organisation data: employer, firm, site or premises name.
• Correspondence data: the content of emails, letters and telephone notes.
• Case data: references, dates, declarations and professional registration details where an application requires them.
• Technical data: internet protocol address and standard request information processed by the hosting service.

4. How We Collect Personal Data

Most personal data reaches the desk directly. You may send an email, complete the contact form, call the office or write a letter, and the details in that message become the start of a case record. Where a client instructs us, we may also collect details from the client own systems, from documents the client supplies, or from public registers that are relevant to an application.

Some information is collected from third parties. A planning authority may correspond with the desk about an application and mention officers or consultees by name. A consultant may send a report that lists the qualifications of its authors. A site manager may supply a list of contractors who need to be present for an inspection. In each case the information is recorded because it is part of the matter being handled, and it is kept to the extent that the matter requires.

We may also receive information from a client about people who have not dealt with us directly, for example the named contacts at a premises or the authors of a technical report. Where this happens, we rely on the client to have a lawful basis for sharing the information and to have informed the individuals concerned. We ask clients to share only what the case requires, and we do not ask for more than that.

5. Why We Process Personal Data

Personal data is used to open and run a case file, to communicate about a submission, renewal, inspection booking, compliance check, appeal run or certificate collection, to prepare the documents that a matter requires, and to keep a record of what was lodged and when. It is also used to answer enquiries, to manage client relationships and to maintain the accuracy of the ledger over time.

Where a case involves a third party, such as an authority officer or a professional adviser, the personal data is used to correspond with that person about the matter, to record their role in the file and to evidence the steps taken. We do not use case data for unrelated purposes, and we do not sell it. The desk does not operate a marketing list built from case files, and a person whose details appear in a submission is not added to any promotional mailing as a result.

We also process personal data to meet legal and regulatory obligations, such as keeping records for the period required by professional standards, responding to a lawful request from an authority, and maintaining records that may be needed if a decision is challenged. Finally, we process data for legitimate business purposes, including protecting the website and the desk from misuse, maintaining the security of the office, and managing the firm accounts.

6. Lawful Bases for Processing

Under the data protection law that applies in the United Kingdom, we must identify a lawful basis for each use of personal data. Where we handle data to perform a contract with a client, or to take steps at the request of a client before a contract is made, the lawful basis is performance of a contract. This covers most of the day to day work of opening a case and carrying it through to release.

Where we handle data to comply with a legal obligation, such as a record keeping requirement or a response to a lawful authority request, the lawful basis is legal obligation. Where we handle data for a legitimate interest, such as corresponding with a client who has asked for a quote, protecting the website from abuse or maintaining business records, the lawful basis is legitimate interests, and we balance that interest against the rights of the individual before relying on it.

In limited circumstances we may rely on consent, for example where a person asks to receive occasional updates about the desk or where a client asks us to pass their details to a third party for a purpose that is not part of the case. Consent can be withdrawn at any time, and a withdrawal does not affect processing that took place before it was received.

• Contract: opening a case, preparing documents, corresponding about a matter.
• Legal obligation: retention of records, response to lawful requests.
• Legitimate interests: enquiries, security, business administration.
• Consent: optional updates and any purpose identified at the point of collection.

7. Personal Data in Permit Case Files

A permit case file is different from a general enquiry record because it may be produced to an authority, a tribunal or an insurer at a later date. For that reason the file records not only the current position but the history of a matter, including who supplied a document, when it was lodged and what response was received. This history is kept because it is necessary to demonstrate that the matter was handled properly.

A case file may therefore contain personal data that an individual did not send to us directly, such as a name in a covering letter or a signature on a declaration. We limit the personal data in a file to what the matter actually requires, and we do not add commentary about individuals that is unnecessary to the record. Notes are written in professional language and are intended to be read by a client, an authority or a representative if the file is ever produced.

Where a client asks us to remove a document from a closed file, we will explain any retention obligation that prevents removal and, where removal is possible, record the request and the date. A file that has been produced to an authority is generally retained in the form in which it was produced, because the value of the record depends on its integrity.

8. Sharing Personal Data

Personal data is shared only where there is a clear reason to share it and a lawful basis for doing so. In the ordinary course of a case, information is shared with planning authorities, licensing authorities, inspection bodies, tribunals and other public bodies to which an application or appeal is made. This sharing is inherent in the work: an application cannot be lodged without the authority receiving the documents and the details they contain.

We may also share information with professional advisers acting for a client, such as planning consultants, architects, legal representatives and surveyors, where the adviser is working on the same matter and needs the file to do so. Where a client has instructed an adviser, we follow the client instructions about what is shared, and we record the sharing in the case ledger.

Service providers who support the desk may have access to personal data as part of their work. These include the provider of our email service, the provider of our document storage and any contractor who maintains the office systems. Each provider is engaged on terms that require confidentiality and appropriate security, and access is limited to what is needed to provide the service.

We may disclose personal data where we are required to do so by law, by a court order or by a lawful request from a regulator or authority. We may also disclose data where disclosure is necessary to establish, exercise or defend a legal claim, or to protect the rights and safety of a person. We do not sell personal data to any party, and we do not share case data for commercial advertising.

9. International Transfers

The desk operates from Liverpool, and the majority of personal data is processed within the United Kingdom. Some service providers, however, may store or process data in another country as part of the service they provide, for example where an email or document storage platform uses data centres outside the United Kingdom. Where a transfer outside the United Kingdom takes place, we ensure that a lawful transfer mechanism is in place, such as the international data transfer agreement approved for use in the United Kingdom or a finding of adequacy for the destination country.

Where a client or an authority requires data to be shared with a party in another country, we follow the instruction and record the transfer in the case file. We will tell a client if a proposed transfer raises a question about safeguards, and we will not proceed with a transfer that cannot be supported by an appropriate mechanism.

You can ask for more information about the safeguards that apply to a particular transfer by contacting the desk at permits@ghdapprovals.lat.

10. How Long We Keep Data

Personal data is kept for no longer than is necessary for the purpose for which it was collected, subject to the retention obligations that apply to professional records. Enquiries that do not become matters are normally held for a short period so that a follow up conversation can take place, and are then deleted or archived in a minimal form.

Case files are kept for a longer period because they may be needed to demonstrate how a matter was handled, to respond to a later question from an authority, or to support a renewal or an appeal. The period depends on the type of matter and on the requirements that apply to it, and it is recorded in the ledger when the file is opened. Where a matter results in a certificate or a licence, the file is typically retained for the life of the permission and for a defined period afterwards.

When the retention period ends, the file is reviewed and either destroyed or reduced to a minimal record that no longer identifies individuals, depending on what the firm needs to retain for audit or insurance purposes. Destruction is carried out in a way that removes the data from active systems, and the ledger records that the review took place and the date on which it did.

11. How We Protect Data

We use technical and organisational measures to protect personal data against loss, misuse and unauthorised access. Access to case files is limited to the people who need it for the work, and each handler uses a named account rather than a shared login. Files are stored in systems that are protected by access controls and encrypted in transit, and paper records are kept in a locked room when the desk is not staffed.

Staff and contractors receive instructions on handling personal data, including how to recognise a request for information, how to avoid sending a file to the wrong recipient and what to do if a message or device is lost. We review our arrangements periodically, and we test the procedures that apply if a personal data breach occurs.

If a breach occurs that is likely to result in a risk to the rights of individuals, we will notify the relevant supervisory authority without undue delay and, where the risk is high, we will inform the individuals concerned. We keep a record of any breach and of the action taken in response, so that the lessons can be applied to later work.

12. Cookies and Website Data

This website is built as a set of static pages. It does not set advertising cookies, it does not run third party tracking scripts, and it does not create profiles of visitors. The small amount of technical information processed when a page is requested is used to deliver the page and to keep the service secure.

The contact form on this website does not send data to a server. It prepares a message in your own email application and passes it to that application, which you control. Nothing you type into the form is stored by this website. If your browser or email application keeps a draft, that draft is held by your own software under your own settings.

If we introduce a feature in future that requires a cookie or a similar technology, we will describe it in this policy and, where the law requires it, ask for consent before the technology is used.

13. Your Data Protection Rights

You have rights in relation to the personal data that we hold about you. You can ask for a copy of the data, ask us to correct anything that is inaccurate, ask us to delete data where there is no continuing reason to hold it, and ask us to restrict the way the data is used while a question about it is resolved. You can also object to processing that relies on legitimate interests, and you can ask for data you provided to be supplied in a portable format.

To exercise a right, write to the desk at permits@ghdapprovals.lat or by post to GHD Approvals Ltd, 12 Buttermere Road, Liverpool - L16 2NN, United Kingdom (GB). We will normally respond within one month, and if a request is complex we will tell you if more time is needed. We may ask for information to confirm identity before we act, so that personal data is not released to the wrong person.

There are limits to some rights. A request to delete data cannot override a legal obligation to retain a record, and a request to restrict processing may be limited where the data is needed to establish or defend a legal claim. Where we cannot comply with a request in full, we will explain the reason and set out any steps we can take instead.

• Right of access to the personal data we hold about you.
• Right to correction of inaccurate or incomplete data.
• Right to erasure where there is no continuing lawful reason to hold the data.
• Right to restriction of processing while a concern is investigated.
• Right to object to processing based on legitimate interests.
• Right to data portability for data supplied under a contract or with consent.

14. Marketing Communications

The desk does not add clients or case contacts to a marketing list. If you ask to receive occasional notes about the service, we will record that request and use your contact details only for that purpose. You can withdraw the request at any time by replying to a message or by writing to permits@ghdapprovals.lat, and the withdrawal will be actioned promptly.

Correspondence about a live case is not marketing. A message confirming a lodgement date, an inspection window or the release of a certificate is part of the service and will continue while the case is open, even if you have opted out of optional updates.

15. Privacy for Children

The service is intended for businesses, organisations and the professional people who act for them. This website is not directed at children, and the desk does not knowingly collect personal data from a child in the course of ordinary enquiries. Where a case file includes information about a child, for example in a submission that concerns a community building, the information is handled as part of the professional record and access is limited to those working on the matter.

If you believe that we have collected personal data from a child without an appropriate basis, please contact the desk so that the matter can be reviewed and, where necessary, the data removed.

16. Automated Decisions

We do not make decisions about individuals by automated means in a way that produces legal effects or similarly significant effects. Case work involves professional judgement by a named handler, and decisions about how a file is prepared are taken with the client and, where relevant, with the authority concerned.

Some administrative steps are routine and may be supported by software, such as producing an index or checking a date. These steps assist the handler; they do not replace the human review that precedes a lodgement, a release or a response to an authority.

17. Changes to This Policy

This policy may be updated to reflect a change in the way the desk works, a change in the law or an improvement in the way information is presented to clients. When a change is made, the updated policy is published on this page with a revised date at the top, so that a reader can see when the current version took effect.

Where a change is material and affects the way personal data is used, we will take reasonable steps to bring it to the attention of clients with open cases. We will not apply a new use to data that was collected under an earlier version of this policy without a lawful basis for doing so.

18. Complaints and Supervision

If you are unhappy with the way we have handled personal data, please contact the desk first so that the matter can be investigated and, where possible, resolved. We will acknowledge a complaint, explain what we have found and set out any action we have taken. Most concerns about a case record can be settled quickly once the file has been reviewed.

You also have the right to complain to the Information Commissioner Office, the supervisory authority for data protection in the United Kingdom. The office can be contacted through its website or by post, and it accepts complaints about the handling of personal data by organisations in the United Kingdom. We will cooperate fully with any review and provide the information required to assess the complaint.

19. How to Contact Us

For any question about this policy, any request to exercise a right, or any concern about the handling of personal data, please contact the desk using the details below. Enquiries are logged in the order they arrive and answered during business hours, Monday to Friday from 09:00 to 17:30.

The developer of this website is GHD Approvals, operating through GHD Approvals Ltd. If a person is unsure whether the company or another party is responsible for a particular record, the desk will help identify the controller and explain the next step. We aim to make every answer useful, whether the question concerns a policy, a case file or the way a request has been handled.