1. Controller and contact
For the client enquiries collected through this portal, the intended controller is Dr. Ali Mohammed trading as Arch-iD Ltd / Alyco, an architectural design practice. Enquiries and information-rights requests: amohammed31@lancashire.ac.uk. This notice must be updated if a separately incorporated company takes on that role. No statutory Data Protection Officer is represented as appointed.
2. Information collected and why
Project enquiry forms collect your name, email, optional telephone, whether you are enquiring as a consumer or business, the selected service, an approximate project region and the description you choose to supply. Data-rights request forms collect name, email, request type and optional details. Servers also process essential network and security information in connection with lawful operating logs.
We use the information to answer your enquiry, take steps you request towards an appointment, administer appointments if agreed, manage records and comply with legal responsibilities. We do not require special-category health information, identification scans or sensitive building-access information through public forms.
Account sessions and logout
The guest ribbon requires a confirmed account. Essential Secure, HttpOnly, SameSite cookies keep this browser signed in across visits and renew with authenticated use, for up to 400 days per cookie issuance, subject to browser limits and the identity provider’s credential validity. There is no added inactivity sign-out. Logout clears this browser’s sign-in cookies; account revocation, removed credentials or cleared browser data can require a new login. Use Logout on shared devices. Logout does not erase downloaded files or separately saved offline copies. Public portfolio pages and public documents remain public.
2A. Accounts, personal workspace and offline copies
Account registration uses Netlify Identity and requires a name, email and password. Birth date and telephone are optional; supply them only when relevant to your appointment. Existing optional profile details can be cleared in Account settings. The hosted identity provider handles passwords. Birth dates and phone numbers are private account attributes; they are self-reported and are not independently verified. Email confirmation is required. Account access uses a necessary authenticated-session cookie.
Private project membership, notes, messages and personal notebook entries are held in Netlify Database. Project drawings are held in private Netlify Blobs storage and require project access to download. Personal notebook entries are associated with the signed-in account and are not shared with project collaborators. They are uploaded only when you choose to sync; project drafts are shared with project members when you choose to send them.
The offline workspace stores explicitly saved project snapshots, drafts and personal notes in encrypted browser storage on your device, protected by a separate passphrase. That passphrase is not sent to the server and cannot be recovered. Synced notebook entries are protected by server access controls; they are not encrypted with your local passphrase on the server. Creating a local notebook does not create an online account. Browser storage may be cleared, so sync important notes before relying on another device. Revisions are retained as separate notebook entries. Signing out does not erase encrypted offline copies or downloaded files. On a shared device, avoid saving private project snapshots and use the workspace controls to remove saved local data. For removal or export of online records, contact the studio using the privacy contact details below.
The practice owner remains responsible for confirming processing locations, retention periods, lawful grounds for collecting registration attributes, processor terms and rights-request procedures.
3. Lawful grounds
Privacy is recognised by Article 12 of the Universal Declaration of Human Rights. For current UK processing, the relevant framework includes the UK GDPR and the Data Protection Act 2018, which replaced the Data Protection Act 1998, as amended by subsequent legislation. EU GDPR may also apply depending on the processing and people concerned. This notice does not constitute certification or a legal determination of compliance.
Depending on the situation, the intended bases are steps taken at your request before entering a contract, contract performance (where a contract exists), compliance with a legal obligation and limited legitimate interests such as proportionate practice administration, record integrity and fraud prevention. Marketing consent is not requested or inferred from an enquiry. Legally required processing does not rely on consent merely because you acknowledge this notice.
4. Recipients, processors and transfers
Information is intended to be accessible only to authorised practice administrators, secure hosting and technical service providers, and necessary professional advisers or legal authorities when justified. Before deployment the practice must document the actual hosting, support, backup, email and other processors and establish required processor contracts and any safeguards for restricted international transfers. Netlify provides the current account, database and private file services. Hosting or support may involve processing outside the UK or EEA; no UK-only or EU-only residency is promised by this website. The practice must verify applicable transfer safeguards and provider terms.
5. Security and restricted collection
Enquiry, user identity, project membership, milestones, messages and notes are stored in a private server-side database. Private uploaded drawings are stored outside the public site directory and checked for project membership on download. Account sign-in uses Netlify Identity. When enabled, Google and Microsoft/Outlook sign-in request basic identity details (account identifier, name and email), not access to your mailbox, contacts or files. Each provider handles its own passwords, PINs and security codes. Arch-iD stores the provider identifier linked to your confirmed account, short-lived sign-in attempts and a hashed session credential. Existing accounts must sign in before connecting a provider; matching email addresses alone do not link accounts. Necessary provider session cookies renew for up to 400 days with use; logout revokes this browser’s provider session. Expired sign-in attempts and sessions are removed during subsequent sign-in attempts. Provider account links remain until account removal; contact the studio to request removal. Google and Microsoft process sign-in under their own privacy policies. The public site does not contain client-submission data. Production must employ HTTPS, suitable identity and access controls, encrypted storage/backups, patching, logs and tested incident response procedures. Downloaded files become the recipient’s responsibility to secure.
6. Retention and deletion
Records should be kept no longer than necessary for enquiry response, contractual, tax, insurance and potential legal-claims purposes. Before launch, Arch-iD Ltd must adopt and publish a clear retention schedule covering unsuccessful enquiries, active/completed appointments, consent records, audit logs and rights requests. Rights requests are not automatically deleted; the controller assesses identity, legal exemptions and other obligations before taking action.
7. Information rights and complaints
You may have rights to request access, rectification, erasure, restriction, objection or portability, depending on circumstances. Contact the controller directly using the email above for access, correction, erasure, restriction, objection or portability requests. Do not send passwords or identification documents in an initial email. A reasonable identity check may be required before information is disclosed. Requests are generally due a response within one month; any permitted extension, exemption or identity verification must be assessed and communicated by the controller. You can complain to the Information Commissioner's Office.
8. Automated processing
The portal uses automated authentication and permission checks to control access to private account and project information. It does not automatically accept contracts, approve fees, decide personal-data rights or make decisions producing legal or similarly significant effects about people. Human review is required.
9. Cookies and changes
The cookie prompt uses a first-party cookie named archid_cookie_notice to remember when you select “Save cookies” or dismiss the notice, for up to six months. It records only that you have seen the notice. No optional analytics or advertising cookies are enabled by this prompt. Use “Cookie settings” in the page footer to reopen the notice.
The account service uses necessary authenticated-session cookies for Netlify Identity sign-in. The existing private administration area separately uses HTTP Basic authentication. No advertising trackers are supplied by default. Hosting and embedded services must be reviewed separately for cookies and tracking and for any additional notice or consent obligations. Updated notices should show their effective date and explain material changes.