Privacy policy

Aspect Building Solutions Ltd Last updated: 13 October 2026

1. Who we are Aspect Building Solutions Ltd (“Aspect”, “we”, “us”, “our”) is the data controller for the personal data described in this policy.

Registered office: Wentworth House, Turnberry Park Road, Morley, Leeds, LS27 7LE Company registration number: 06382267 ICO registration number: ZA654529 General contact: info@aspect-building.co.uk, 0113 816 0007 Data protection contact: [privacy@aspect-building.co.uk] If you have any question about this policy or about how we handle your personal data, please use the data protection contact above.

2. What this policy covers This policy applies to our public website at aspect-building.co.uk, and to our staff and supply-chain portal at portal.aspect-building.co.uk, which is used by Aspect employees and by our suppliers and subcontractors.

It explains what personal data we collect, why, who we share it with, how long we keep it, and your rights. Cookies are covered in our separate Cookie Policy.

3. The personal data we collect, and why We collect different data depending on your relationship with us.

Website visitors and enquirers. When you use the contact form we collect your name, company, email address, phone number and the content of your message. We use this to respond to your enquiry and to keep a record of it. Lawful basis: our legitimate interests in responding to enquiries and running our business, or steps taken at your request before entering into a contract.

Job applicants. When you apply through our careers page or send us a CV we collect the details you provide, including your name, contact details, employment history, the position of interest, and anything in your CV or covering message. Lawful basis: steps taken at your request before entering into a contract, and our legitimate interests in recruitment.

Clients and customer contacts. For the people we deal with at our clients (including public-sector clients such as West Yorkshire Fire and Rescue Service) we process names, job titles, contact details, and information contained in instructions, work orders, purchase orders, correspondence and site records, including photographs of sites and works. Lawful basis: performance of our contract with the client, and our legitimate interests in delivering and evidencing our work.

Suppliers and subcontractors, and their staff. Through the portal we process information about the firms in our supply chain and the individuals at them, including contact details, trades and coverage, insurance and accreditation details, compliance and competence records, CIS details, bank details for payment, and uploaded documents. Where a subcontractor’s workers need to be checked, this can include criminal-offence information (DBS checks). Lawful basis: performance of our contract with the supplier or subcontractor; compliance with legal obligations (including the Construction Industry Scheme, tax law, the Building Safety Act 2022 “golden thread”, and health-and-safety duties); and our legitimate interests in managing a compliant supply chain. Criminal-offence data is processed only where necessary and under an appropriate condition in Schedule 1 of the Data Protection Act 2018.

Employees and workers. The portal holds employment records for Aspect staff, including personal and contact details, job and pay information, timesheets, PAYE/NI and CIS data, UTR, bank details, holiday and qualification records, and, where relevant, DBS checks. Lawful basis: performance of your employment contract; compliance with our legal obligations as an employer; and our legitimate interests in running the business. Employees are given a fuller staff privacy notice separately.

People we message on WhatsApp. Where we use WhatsApp to communicate about jobs, we process the phone number, name, messages and any photos or files exchanged. Lawful basis: our legitimate interests in communicating efficiently about work, and performance of the relevant contract. WhatsApp messaging is operated through Meta’s WhatsApp Business Platform (see section 5).

Analytics. With your consent, we collect usage data about how visitors use the public website (see the Cookie Policy). We do not use analytics in the portal. Lawful basis: consent.

4. Where we get your data Most data comes directly from you. We also receive data from our clients (for example, a work order naming a site contact), from your employer (where you are a contact at a supplier), from referees and accreditation or checking bodies, and from our own systems as we carry out work.

5. Who we share your data with We do not sell your personal data. We share it only as needed to run our business and meet our obligations, with:

Service providers who host and run our systems, each under a data-processing agreement: Supabase (database, file storage and authentication, hosting region [UK/EU – confirm]); Vercel (website and portal hosting); Microsoft (email and document storage via Microsoft 365 and SharePoint); Resend (sending our emails); Xero (accounting and invoicing); Radius / Velocity (fuel-card and vehicle transaction data); Meta Platforms (WhatsApp Business messaging); and Google (website analytics, only with your consent). Our professional advisers (accountants, lawyers, insurers) where necessary. Our clients and their representatives, where the data relates to work we do for them. Government and regulatory bodies where we are required to share data, for example HMRC (tax and CIS), and in connection with health-and-safety and Building Safety Act duties. Accreditation and checking bodies (for example CHAS, Constructionline, the DBS) as part of supply-chain compliance. 6. Storing your data and international transfers We store personal data in the UK or European Economic Area wherever possible. Some of our providers (such as Meta and Google) may process data outside the UK. Where that happens, we rely on an adequacy decision or on appropriate safeguards such as the UK International Data Transfer Agreement or Addendum, or Standard Contractual Clauses.

7. How long we keep your data We keep personal data only as long as we need it:

Website enquiries: 2 years, then deleted automatically. Job applications (unsuccessful): 1 year, then deleted automatically. System activity and audit logs: 2 years. Supplier and subcontractor records: the duration of the relationship, then as required by law. Building Safety Act “golden thread” records: as long as required for the life of the relevant building [confirm]. Financial and tax records, including CIS: 6 years plus the current year. Employment records: for the duration of employment and the periods set by law afterwards. Where no period is fixed by law, we keep data for as long as is reasonably necessary and then delete or anonymise it.

8. How we keep your data secure Access to the portal is role-based and enforced in the database itself, so people see only the data their role allows. We use encryption in transit, restrict access to sensitive fields (such as bank details, which require a separate authorisation step to change), keep an audit log of significant actions, and host with reputable providers. We review our security arrangements regularly.

9. Your rights Under UK data protection law you have the right to: be informed about how we use your data; access the personal data we hold about you; ask us to correct inaccurate data; ask us to erase your data in certain circumstances; restrict or object to our processing in certain circumstances; data portability for data you gave us, where it is processed by automated means on the basis of consent or contract; and withdraw consent at any time where we rely on consent (for example, analytics cookies).

To exercise any of these rights, contact us using the details in section 1. We will respond within one month, and you will not usually have to pay a fee.

10. Automated decision-making We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. The portal flags suppliers whose compliance is out of date, but a person always makes the final decision, with a recorded override where appropriate.

11. Cookies The website and portal use cookies and similar technologies. Please see our Cookie Policy for details and for how to manage your choices.

12. Changes to this policy We may update this policy from time to time. The “last updated” date at the top shows when it last changed. Significant changes will be notified where appropriate.

13. Complaints If you are concerned about how we handle your personal data, please contact us first so we can try to resolve it. You also have the right to complain to the Information Commissioner’s Office (ICO): ico.org.uk; helpline 0303 123 1113; or Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.