Privacy Policy

1 - Introduction

This policy sets Andy Matthews Studio's commitment to protecting your privacy and personal data. This notice explains how we collect, use, store and protect personal information in accordance with UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This privacy notice applies to clients, prospective clients, employees, job applicants, contractors, consultants, suppliers, and website visitors. Andy Matthews Studio Ltd is the data controller responsible for your personal data.

Andy Matthews Studio Ltd is registered with the Information Commissioner's Office (ICO) under registration reference ZB736040.

2 - Information we collect

Depending on your relationship with us, we may collect and process the following categories of personal data:

2.1 - Clients and Prospective Clients

• Contact details including name, address, email, phone number

• Project information and property details

• Communication records and correspondence

• Financial information including invoicing and payment details

• All records associated with the provision of architectural services as set out in the RIBA Plan of Work

2.2 - Employees and Job Applicants

• Personal details including name, address, date of birth, contact information

• Right to work documentation

• Employment records, contracts, and references

• Financial details including National Insurance number, bank details, salary, pension information

• Professional qualifications and ARB registration details

• CPD records and training history

• Performance reviews and appraisal records including 1:1’s

• Time, attendance, and leave records

2.3 - Website Visitors

• Technical information including IP address, browser type, and device information

• Website usage data, navigation patterns, behavioural metrics, heatmaps, and session replay

• Contact form submissions and enquiries

3 - How We Use Your Information

We process personal data for the following purposes:

3.1 - Architectural Services and Client Projects

• Providing architectural design services and project management

• Preparing planning applications and building control submissions

• Contract administration and project coordination

• Communicating with you about your project

• Invoicing and payment processing

• Complying with professional and regulatory requirements including ARB standards

• Managing building safety information under the Building Safety Act 2022

3.2 - Employment and HR Management

• Recruitment and employment administration

• Payroll, benefits, and pension administration

• Performance management and professional development

• Health and safety compliance

• Managing CPD requirements for ARB-registered architects

3.3 - Legal Basis for Processing

We process personal data based on the following legal grounds:

• Contract performance: to fulfil our contractual obligations to clients and employees

• Legal obligation: to comply with employment law, tax obligations, professional regulations, and building safety requirements

• Legitimate interests: for business administration, improving our services, and protecting our legal rights

• Consent: where explicitly provided for specific purposes

4 - How We Store and Protect Your Information

We maintain appropriate technical and organisational security measures to protect your personal data.

4.1 - Systems and Infrastructure

• Personal data is stored and managed using the following systems:

• CapsuleCRM for client relationship management

• Transpond for marketing and newsletters

• Microsoft 365 and Outlook for email communications and file storage

• Atvero/Cmap for project information management and SharePoint integration

• Secure local and cloud-based backup systems

4.2 - Security Measures

Two-factor authentication (2FA) is required for all systems

• Role-based access controls and permissions

• Regular automated backups with local and offsite storage

• Encrypted data transmission and storage

• Secure document management with version control and audit trails

• Regular security reviews and updates managed by specialist IT support