Privacy notice
Who we are. Penrose (“we”) provides construction project information to contractors, suppliers and consultants. We are the data controller for the personal data described here. Contact: [privacy email], [postal address]. ICO registration number: [ICO registration number].
1. What this notice covers
- Section A: business contacts we find in public planning information (you may not have given us your details directly).
- Section B: our customers and website visitors.
Section A: business contacts in public planning information
What we collect. Only business contact details of people acting for a company: name, job title, company, work email and work phone. We collect them only when the same public record names a company (for example an agent or applicant firm on a planning application). We never keep:
- details of householders or private individuals;
- council officers’ details;
- personal email addresses (for example Gmail or Hotmail);
- home addresses.
Where it comes from.
- The Planning London Datahub (Greater London Authority), under the Open Government Licence v3.0.
- PlanIt (planit.org.uk), an aggregator of public planning registers.
- Later, where applicable: Companies House, public news articles and company websites.
Why we use it. To show our customers who is involved in construction projects, so they can find work and contact the right business. Lawful basis: legitimate interests (UK GDPR Article 6(1)(f)). We have balanced our interests against yours: the details are business details, already public, used for business-to-business purposes, and you can object at any time. Our assessment is available on request.
Who sees it. Our paying customers (construction businesses) and our service providers, listed in section C. We do not sell lists of personal data, and we never use this information for recruitment.
AI processing. We use AI services to classify projects (for example the type of work). Personal names are removed before project information is sent to them.
How long we keep it. While the project is live and for [6] years afterwards, because project history is part of our service. We delete details sooner if you ask.
Your right to object (opt out). You can ask us at any time to stop using your details. Email [privacy email] with your name and company. We will remove you within [5] working days and add you to a suppression list, so your details are not collected again. We keep only the minimum needed to honour your request.
Section B: customers and website visitors
- Account details: name, work email and company, to provide the service and log you in (legal basis: contract).
- Your CRM data (if you connect it): read-only, limited to agreed fields, kept only in your own account and never shared with other customers or added to our shared data.
- Resource planner (if you use it): your staff information stays on your own systems; we never receive it.
- Emails: service emails (for example digests) are sent from our business domain; you can unsubscribe from non-essential emails at any time.
- Cookies: essential cookies only (to keep you signed in to the app).
Section C: service providers (processors)
- Supabase (database hosting, London region)
- Vercel (website hosting)
- Resend (email delivery)
- GitHub (automated data processing)
- AI classification providers: TypeSafe; Anthropic as a back-up (no personal names sent)
Where a provider handles data outside the UK, we rely on UK-approved safeguards (the UK International Data Transfer Agreement or Addendum, or adequacy regulations).
Section D: your rights
You have the right to:
- access your data;
- correct it;
- have it erased;
- restrict its use;
- object, including an absolute right to object to direct marketing.
Contact [privacy email]. We reply within one month. If you are unhappy, you can complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113).
Last updated: 29 September 2026.