1. Who controls your personal data
Oberon Engineering Ltd, company number 14106874, is the controller of personal data processed for BuildConnect UK. Registered office: 167-169 Great Portland Street, 5th Floor, London, England, W1W 5PF.
Privacy enquiries and rights requests can be sent to costi.i@oberonplc.co.uk.
2. Personal data we collect
Depending on how you use the platform, we process account and identity details, contact information, user role, company information, Companies House data, service areas, trade information, insurance dates, project and tender information, private project contact details, project documents, messages, introduction requests, commission acceptances, awards, invoices, payment references, email-delivery records and support correspondence.
We also process technical and security information such as IP address, browser/user-agent information, authentication/session data, timestamps, audit events and security logs. We do not intend to collect special-category personal data unless it is genuinely necessary; users should avoid uploading sensitive information that is not required for a project.
3. Where data comes from
Most information comes directly from users. We may also receive information from another project participant, Companies House and other public registers, payment providers such as Stripe, email-delivery providers, and technical/security systems used to operate the service.
Companies House information is used as verification evidence and may include company status, legal name, registered office and registration number.
4. Why we use personal data and our lawful bases
Contract: to create and administer accounts, publish projects, operate controlled introductions, provide messaging and documents, record awards, administer commission agreements, issue invoices and provide requested platform services.
Legitimate interests: to verify marketplace participants, prevent fraud and circumvention, secure the platform, keep evidential audit trails, resolve disputes, improve service reliability and protect users and our business. We balance these interests against the rights and interests of individuals.
Legal obligation: to meet accounting, tax, company-law, law-enforcement, regulatory and other legal requirements where applicable.
Consent: where the law specifically requires consent, for example if we later introduce optional marketing communications or non-essential cookies. Consent can be withdrawn for the relevant activity without affecting earlier lawful processing.
5. How project information is shared
Public opportunity information is separated from private client/contact details. Private details are disclosed only to authorised users, including the relevant client, administrators and contractors whose introduction has been approved under the platform workflow.
Clients can see information needed to assess introduction requests. Contractors can see project information and, after approval, the private information required to contact the client and progress the opportunity.
6. Service providers and other recipients
We use service providers to operate BuildConnect UK, including Supabase for database/authentication infrastructure, Vercel for application hosting, Resend for transactional email, Stripe for payment processing and Companies House data/API services for company verification.
We may also disclose information to professional advisers, insurers, auditors, banks, courts, law-enforcement bodies, regulators or public authorities where reasonably necessary or legally required. We do not sell personal data to advertisers.
7. Payment information
Stripe processes payment-card and checkout information under its own privacy terms. BuildConnect UK stores transaction references, payment status, amount and audit information needed to reconcile commission payments, but does not store full card numbers or card security codes.
8. International transfers
Some service providers may process data outside the United Kingdom. Where a restricted international transfer occurs, we rely on an applicable adequacy regulation or appropriate contractual and organisational safeguards such as the UK International Data Transfer Agreement or UK Addendum, as appropriate.
9. Retention
We keep account and contractual records for as long as the account or relevant relationship is active and then for a period reasonably required for legal claims, accounting, fraud prevention and audit. Financial, invoice, commission and key contractual evidence is generally retained for up to six years after the relevant relationship or accounting period, unless law requires longer.
Closed or unsuccessful project and messaging records may generally be retained for up to 24 months after closure, unless they are linked to an award, payment, dispute, complaint, security issue or legal requirement. Security logs may generally be retained for up to 12 months. We may anonymise information instead of deleting it where appropriate.
10. Security
We use access controls, row-level database security, authenticated sessions, restricted private project data, audit logging and service-provider security controls. No online system can be guaranteed completely secure, so users must also protect their passwords and devices and notify us promptly of suspected compromise.
11. Your data-protection rights
Depending on the circumstances, you may have rights to access personal data, correct inaccurate data, request erasure, restrict processing, object to certain processing, and receive certain data in a portable format. Where processing is based on consent, you may withdraw that consent.
Some rights are qualified and may not apply where we need to retain records for a contract, legal obligation, fraud prevention, disputes or legal claims. To exercise a right, contact costi.i@oberonplc.co.uk. We may need to verify identity before acting on a request.
12. Automated checks
We use automated and rules-based checks to support functions such as company verification, permissions, payment status and fraud/security controls. We do not currently make solely automated decisions that produce legal or similarly significant effects on individuals. Where a material verification decision needs review, contact us.
13. Cookies and similar technologies
BuildConnect UK currently uses cookies or local/session storage that are necessary for authentication, security and core application operation. We do not currently enable non-essential advertising or analytics cookies on the platform.
Third-party services opened separately, such as Stripe Checkout, may use their own cookies under their own notices. If we introduce non-essential analytics, advertising or similar cookies, we will update our notice and obtain consent where required before placing them.
14. Complaints, changes and contact
If you are unhappy with how we use personal data, please contact us first at costi.i@oberonplc.co.uk so we can investigate. You also have the right to complain to the UK Information Commissioner's Office (ICO).
We review this Privacy Notice when our processing or legal requirements change. Material updates are versioned and, where appropriate, brought to users' attention before the new processing begins.