Privacy Policy

Version 2.0 — Last updated: 31st August 2026

1. Introduction

BuiltRight Technologies Ltd ("we", "us", "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Platform.

We are registered as a data controller with the Information Commissioner's Office (ICO) and comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, phone number, company name, job title
• Payment Information: Billing address, payment card details (processed securely by Stripe)
• Business Data: Documents, files, and data you upload or create using our services
• Communications: Messages you send to us or through our Platform

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, time spent, click patterns
• Device Information: IP address, browser type, operating system, device identifiers
• Cookies: Session data, preferences, authentication tokens
• Log Data: Access times, error logs, referral URLs

2.3 Information from Third Parties

• Authentication providers (if you sign in via social login)
• Payment processors (transaction status and confirmation)
• Business partners and integrations you authorise

3. How We Use Your Information

3.1 Service Delivery

• To provide, maintain, and improve our services
• To process transactions and manage your subscription
• To authenticate your access and maintain security
• To provide customer support

3.2 Communication

• To send service updates and administrative notices
• To respond to your enquiries and requests
• To send marketing communications (with your consent)

3.3 Legal Bases

• Contract: Processing necessary to perform our contract with you
• Legitimate Interests: To improve our services, prevent fraud, ensure security
• Consent: For marketing communications and optional features
• Legal Obligation: To comply with applicable laws and regulations

4. Sharing Your Information

We may share your information with:

• Service Providers: Cloud hosting (UK-based), payment processing (Stripe), email services
• Professional Advisers: Lawyers, accountants, auditors when necessary
• Legal Authorities: When required by law or to protect our rights
• Business Transfers: In connection with a merger, acquisition, or sale of assets

We do NOT sell your personal data to third parties.

5. Data Security

We implement appropriate security measures including:

• Encryption of data in transit (TLS 1.3) and at rest (AES-256)
• Secure authentication and access controls
• Regular security assessments and updates
• Employee training on data protection
• Incident response procedures

While we implement robust security measures, no system is completely secure. We encourage you to use strong passwords and protect your account credentials.

6. Data Storage and Transfers

Information may be processed in the United Kingdom, the European Economic Area, or other locations approved for transfer under UK adequacy regulations. We do not claim exclusive UK-only storage.

Where a transfer requires additional safeguards, we use the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or rely on an applicable adequacy decision.

7. Data Retention

• Active Account Data: For the duration of your subscription
• After Account Closure: 30 days to allow data export, then deleted
• Billing Records: 7 years for legal and tax purposes
• Security Logs: 12 months
• Anonymised Analytics: Indefinitely (non-personal data)

8. Your Rights

Under UK GDPR, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data ("right to be forgotten")
• Restriction: Limit how we process your data
• Portability: Receive your data in a portable format
• Object: Object to processing based on legitimate interests
• Withdraw Consent: Where processing is based on consent

To exercise these rights, contact us at privacy@builtright-technologies.co.uk. We will respond within 30 days.

8A. Client Finder — Business Prospect Information

Client Finder is a business research and prospecting application within our Platform. It processes information about businesses and business representatives — company names, trading details, company numbers, addresses, sectors, websites, financial filings, planning applications, procurement activity and business signals — gathered from Companies House, business websites, planning portals, procurement portals and other legitimate publicly accessible sources. Artificial intelligence assists with researching, matching, scoring and drafting outreach for this information.

BuiltRight Technologies Ltd is the controller for this research and matching activity. Client Finder customers are separately responsible, as controllers in their own right, for any marketing campaign they choose to run. Our primary lawful basis is legitimate interests under Article 6(1)(f) UK GDPR for proportionate corporate B2B prospecting; where PECR requires consent — including electronic marketing to sole traders, ordinary partnerships and other individual subscribers — an appropriate lawful basis such as consent is required before that contact is made.

This information is disclosed to authorised Client Finder subscribers to enable their own outreach. Prospect personal data is retained for a default of 12 months from last verification or legitimate use, then deleted or anonymised. Where a person objects to processing or contact, we keep the minimum identifier necessary on a suppression record to honour that objection.

Full detail on Client Finder prospect processing, including your rights and how to object, is set out in the separate Client Finder Prospect Privacy Notice.

9. Cookies

We use essential, functional, and analytics cookies. For full details see our Cookies Policy.

10. Children's Privacy

Our Platform is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through the Platform. Your continued use of the Platform after changes become effective constitutes acceptance of the updated policy.

12. Contact Us

For privacy-related enquiries or to exercise your rights:

• Email: privacy@builtright-technologies.co.uk
• Data Protection Officer: dpo@builtright-technologies.co.uk
• Postal: BuiltRight Technologies Ltd, 128 City Road, London, EC1V 2NX

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

Version History

• Version 2.0 — 31st August 2026 (current)
• Version 1.0 — 2nd April 2026

© 2026 BuiltRight Technologies Ltd. Company Registration No. 16877690 (England & Wales). 128 City Road, London, EC1V 2NX.