This policy explains how Altaris Advisory Ltd collects, uses and protects personal information when you visit our website, use our instant Quote Portal, receive a quotation through a professional referral, or work with us.
1. Who we are
Altaris Advisory Ltd ("Altaris", "we", "us") is a company registered in England and Wales under company number 17185606, with its registered office at 1 Belvedere, Ramsey, Huntingdon, PE26 2XZ. We provide CDM 2015 Principal Designer and related consultancy services.
We are generally the controller of the personal data described in this policy. Where a particular client arrangement requires us to act as a processor, that will be addressed separately in the appointment. We are registered with the Information Commissioner's Office (ICO) under registration number ZC215128.
For any question about this policy or your personal data, contact:
- Email: hello@altarisadvisory.co.uk
- Post: Data Protection, Altaris Advisory Ltd, 1 Belvedere, Ramsey, Huntingdon, PE26 2XZ
We are a small business and have not appointed a Data Protection Officer, as the law does not require us to. The Director is responsible for data protection.
2. Information we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Contact details | Name, job title, company, email address, phone number | You or an authorised professional, via the Quote Portal, email or phone |
| Quote portal answers | Project type, sector, contract value, programme length, the options you select, the site postcode, requested site visits and the calculated fee | You or an authorised professional, via the Quote Portal |
| Project information | Drawings, surveys, pre-construction information, risk registers, programmes and correspondence about your project | You, your project team (designers, contractors, landlords) |
| People named in project documents | Names, roles, company and contact details of other duty holders and project team members | You, your project team |
| Billing details | Billing contact, billing address, purchase order numbers, payment history | You, your accounts team |
| Technical data | IP address, browser and device type, pages visited, referring site, security/session identifiers, where applicable | Your device, website hosting and security services |
| Marketing preferences | Whether you want to hear from us | You |
| Professional referrals | Referring professional’s name, firm and contact details; client name, organisation and email; associated quotation and response preferences | An architect, designer, contractor or other professional authorised to request a quotation on the client’s behalf |
| Start of works | Whether works are underway, not scheduled, or the anticipated construction start date | You or an authorised professional using the Quote Portal |
We do not knowingly collect special category data (such as health information) through the website. Please do not include it in quote portal free-text fields or uploads. If a project document unavoidably contains it (for example, an accident record in a health and safety file), we handle it only as needed to deliver our services and keep it secure.
Our website is not aimed at children and we do not knowingly collect their data.
3. How we use it and our lawful basis
| Purpose | Lawful basis under UK GDPR |
|---|---|
| Calculating your instant fee, including working out travel for site visits from the postcode you enter | Steps taken at your request before entering a contract; where you act for a business, our legitimate interest in responding to enquiries |
| Sending you a confirmation email, reviewing your submission and issuing a formal fee proposal | As above |
| Delivering agreed services, including statutory CDM Principal Designer duties and other consultancy duties within the scope of our appointment | Performance of our contract with you; compliance with legal obligations |
| Keeping project records, including the health and safety file and evidence of our duties | Compliance with legal obligations; our legitimate interest in defending claims |
| Invoicing, collecting payment and keeping accounts | Performance of our contract; compliance with legal obligations (tax and company law) |
| Running, securing and fixing our website | Our legitimate interest in a safe, working website |
| Understanding how visitors use the website (analytics) | Legitimate interests in operating and improving the service for cookieless, aggregated measurement; consent or another applicable statutory exception if device storage/access is used |
| Sending occasional updates about our services | Corporate subscribers: legitimate interests, with an opt-out; individuals, sole traders and some partnerships: consent or a lawful soft opt-in where available |
| Handling complaints, claims and insurer notifications | Our legitimate interest in managing our business and defending claims |
| Receiving a client’s details from an authorised professional and sending the specific requested quotation to that client | Our legitimate interests in responding to authorised business enquiries, subject to a balancing assessment; where the individual contracts with us, steps before a contract may apply |
Where we rely on legitimate interests, we have balanced them against your rights. You can ask us for details of that assessment.
Automated pricing. Our portal calculates an indicative fee automatically from project answers. This does not decide whether we will work with you, and no appointment is made until a Proposal has been issued and agreed. We review enquiries before confirming any appointment. The calculation is not an automated decision with legal or similarly significant effects.
4. Who we share it with
We never sell your personal data. We share it only where needed, with:
- Service providers. We use Namecheap (website hosting), Cloudflare (Quote Portal hosting, security, and associated reporting), Microsoft 365 (business email and document storage), Resend (transactional email), and Xero (accounts). Their roles as processors or independent controllers depend on the relevant service and contractual arrangements.
- Google (Google Maps Platform): when you request a site visit, the site postcode and our base location are sent to Google to calculate a driving route. Google processes this as an independent controller under its own privacy policy. We do not send your name or contact details to Google for this.
- Quotation and website reporting. We record website and Quote Portal activity to understand use of our services. This includes aggregated visit and calculation counts; security or diagnostic records may also include technical identifiers. We do not use Google Analytics cookies in the current website build.
- Other project duty holders: under CDM 2015 and the Building Regulations we must share relevant project information with the client, designers, principal contractor, contractors and the building control body or Building Safety Regulator. This can include the names and contact details of people working on the project.
- Regulators and authorities: the Health and Safety Executive, the Building Safety Regulator, HMRC, the police or courts, where the law requires or permits it.
- Professional advisers and insurers: our accountant, lawyers and professional indemnity insurers, where needed to run our business or deal with a claim.
- A buyer of our business: if we sell or restructure the business, your data may transfer to the new owner, who must keep using it in line with this policy.
5. International transfers, retention and security
International transfers. Some of our service providers may process information outside the UK. Where this constitutes a restricted transfer, we use applicable adequacy arrangements or suitable transfer safeguards as required by UK data protection law. Contact us if you would like information about relevant safeguards.
How long we keep it.
| Data | How long |
|---|---|
| Quote portal submissions that do not become appointments | 2 years from submission |
| Project files and correspondence for appointments | Normally 15 years from completion. Up to 30 years only where the nature of a particular project and potential statutory claims justify longer retention, subject to periodic review |
| Invoices and accounting records | 6 years from the end of the financial year they relate to |
| Analytics data | Up to 14 months for internal reporting; provider diagnostic logs may be shorter |
| Marketing preferences | Until you opt out, plus a suppression record so we do not contact you again |
The health and safety file belongs to the client. We hand it over at the end of the project and keep a copy only as part of our project records.
Security. We use access-controlled business systems, appropriate account security, and HTTPS for the website. We review access and protect records proportionately to their sensitivity. Where a personal data breach requires notification, we will inform the ICO and any affected people as required by law.
6. Your rights and how to complain
You have the right to:
- access the personal data we hold about you
- have inaccurate data corrected
- have data erased, where we no longer have a reason to keep it
- restrict or object to our use of it, including objecting to marketing at any time
- receive data you gave us in a portable format, where we rely on consent or contract
- withdraw consent at any time, without affecting earlier use
To use any of these rights, email hello@altarisadvisory.co.uk. We may ask you to confirm your identity. We will respond within one month, or tell you if we need longer because the request is complex. Some rights are limited where we must keep records by law, such as Principal Designer records.
Complaining to us. If you are unhappy with how we have handled your personal data, please complain to us first, by email or post using the details in section 1. You do not need to use any particular wording. We will:
- acknowledge your complaint within 30 days of receiving it
- look into it without undue delay and keep you updated
- tell you the outcome and any action we have taken
Complaining to the ICO. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. The ICO will normally expect you to have raised the matter with us first.
7. Cookies and similar technologies
Cookies and similar technologies are small files or other identifiers that a website may store or access on your device. The current Altaris Advisory website does not include Google Analytics or advertising tags, or a cookie consent banner. Our hosting, anti-abuse and Quote Portal security services may use strictly necessary security/session technology. We also use server-side or otherwise cookieless counts to understand visits, quote calculations and enquiries. We will not introduce technology requiring consent without first putting appropriate information and choice controls in place. Where an analytics exception applies under UK law, we will provide the required information and an easy opportunity to object.
Google Maps routing. For optional site attendance pricing, the postcode of the project location and our base location may be sent to Google from our server to calculate travel. We do not deliberately transmit the quotation contact’s name or email for this calculation, and no Google map is embedded in the website.
Professional referrals. If a professional sends us your contact details to obtain a quotation on your behalf, we will identify that professional and provide a link to this policy when we first contact you, normally in the quotation email. You can ask us not to contact you again about that enquiry.
8. Changes to this policy
We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated.
Last updated: 18 October 2026