Privacy

1. Who we are

Built Matters is a product and brand operated by Vamberic Studio Ltd. Vamberic Studio Ltd is the data controller for the personal information described in this policy, meaning it decides why and how that information is used.

We handle personal information under applicable UK data protection law, including the UK GDPR and the Data Protection Act 2018. Contact arrangements are set out at the end of this policy.

2. The website today

This is an informational website. It does not currently provide user accounts, payment processing, customer dashboards, energy-data uploads, contact enrichment or automated prospect workspaces. The online enquiry form is disabled and cannot accept submissions.

The website application does not include analytics, advertising pixels or tracking cookies, and does not use browser storage to track visitors. Fonts and images are served with the site rather than loaded from advertising or analytics services. Hosting infrastructure may generate technical and security records as explained below.

There is no tracking consent banner because no optional tracking is implemented. We will review this information and any consent requirements before adding cookies, storage or other functionality.

3. Information and sources

Information provided voluntarily: if you communicate with us through a channel made available to you, we may receive your name, business contact details, organisation, role and the contents of your message. Please provide only information relevant to your communication and avoid unnecessary sensitive personal information.

Technical information: hosting and security infrastructure may record IP addresses, request times, requested URLs, browser or device information, response codes and security events. These records can be personal data even when you do not identify yourself by name.

Business contacts: where relevant business outreach is introduced, contact information may come from you or your organisation, public business information or professional/business data providers. This may include a name, business email, job role, employer and the source of the information. We will provide the relevant privacy information when required, including when first contacting someone whose details came from another source.

4. Public organisational information

Built Matters may analyse public information about organisations, including published energy and ESOS information. Information about a company or its consumption is not necessarily personal data. A named contact, identifiable sole trader or other information relating to an individual can be personal data.

Public availability does not remove data protection responsibilities. Where public information identifies a person, its use must have an appropriate lawful basis and respect that person's rights. Public source information may be historical or incomplete.

5. Purposes and lawful bases

• Operating and securing the website: our legitimate interests in making business information available, maintaining reliable services, investigating faults and preventing misuse.
• Responding to communications and managing business relationships: our legitimate interests in handling relevant enquiries and communicating with business representatives.
• Steps towards or performance of a contract: where an individual asks us to take steps before entering a contract, or is personally a party to a contract, we may process information necessary for that purpose. For representatives of a corporate customer, the basis will normally be legitimate interests in administering the business relationship instead.
• Legal obligations: where processing is required by applicable law, such as keeping records we are legally required to retain or responding to a valid statutory request.
• Relevant B2B marketing, if introduced: legitimate interests where permitted and justified, or consent where the applicable rules require it.

Reliance on legitimate interests requires consideration of necessity, reasonable expectations and the effect on the individual. It is not a blanket permission to use any business contact information. If we rely on consent, you may withdraw it without affecting processing that was lawful before withdrawal.

6. Relevant business outreach and objections

The intended marketing approach is targeted outreach to business contacts whose roles and organisations may be relevant to Built Matters Energy. Its purpose is to explain a potentially relevant business product, not to conduct mass consumer marketing. The current website does not operate an outreach or enrichment system.

Before using personal information for outreach, we will assess the appropriate basis and applicable electronic marketing rules. Legitimate interests does not override a requirement for consent, including where that requirement applies to sole traders or certain partnerships.

You can object to direct marketing at any time, without giving a reason. Any marketing communication must provide a usable way to opt out. If you object, we will stop using your personal information for direct marketing and related profiling. We may retain the minimum suppression information needed to ensure that the objection continues to be respected.

7. When Energy services become available

When application functionality becomes available, we may process customer-supplied information to provide the agreed service. Before enabling this, we will explain the relevant data, purposes, roles and providers in service-specific privacy information and terms. These may include separate data-processing terms where we act as a processor for a customer.

No customer energy-data processing, account decision-making or automated prospect workspace is currently provided by this website. It does not make solely automated decisions with legal or similarly significant effects on individuals.

8. Service providers and disclosure

Information may be handled by providers supporting website hosting, infrastructure and security, and, where used for business correspondence, communications and IT services. Access should be limited to what is needed for their role, with appropriate contractual and security arrangements where they process information on our behalf.

We may also disclose relevant information to professional advisers, regulators or other authorities where necessary for a legal obligation, a legal claim or the protection of rights. This policy does not identify an unverified provider as a current recipient.

9. International transfers

Where a provider stores or accesses personal information outside the UK, we must assess whether UK international-transfer rules apply and ensure an appropriate legal basis for the transfer, such as applicable adequacy arrangements or required safeguards.

This policy does not assert that a particular country, provider or safeguard is currently used. Relevant arrangements must be confirmed for the deployed services. You may request information about any applicable transfer arrangements using the contact details below.

10. How long information is kept

We retain personal information only for as long as needed for its purpose, taking account of legal requirements and the need to establish, exercise or defend legal claims. Correspondence is kept while the issue or relationship remains relevant. Technical records are kept for the period needed to investigate faults, security events or misuse.

Retention decisions consider the type and sensitivity of information, why it was collected, whether the purpose remains current and whether a shorter period or anonymisation would suffice. Suppression information may need to be kept longer than marketing records so that objections remain effective. Information should be deleted or anonymised when no longer needed.

11. Security

We use proportionate organisational and technical measures to protect personal information, taking account of the information and risks involved. No internet transmission or storage system can be guaranteed completely secure. Please do not send credentials or unnecessary sensitive information in general correspondence.

12. Your rights

Depending on the circumstances, you may ask for access to your personal information, correction of inaccurate information, erasure, restriction of processing or a portable copy of information you supplied. You may object to processing based on legitimate interests and have an unconditional right to object to direct marketing. Where consent is the basis, you may withdraw it.

Rights can be subject to legal conditions and exceptions. We may need proportionate information to verify your identity before responding. We will handle requests within the applicable statutory time limits. You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator.

13. Third-party websites

Links may take you to websites operated by other organisations. Their privacy practices and terms govern their own services. Review their information before providing personal data.

14. Changes to this policy

We will update this policy when relevant practices or requirements change and show the revised date above. Where a new purpose or activity requires additional notice or consent, we will address that before the relevant processing begins.

15. Contact and privacy requests

For privacy requests, objections or questions, contact Vamberic Studio Ltd at privacy@built-matters.com.