Privacy Policy: QC Consultancy
Version 1.0 · 16 October 2026 · qcconsultancy.co.uk
1. Who we are
1.1 This Privacy Policy explains how QC Consultancy Ltd ("QC Consultancy", "we", "us") collects and uses personal data through qcconsultancy.co.uk (the "Website"), when you contact us, and when we contact people about our business. Each of our products, QC Procurement, SVETrack and QC Design QA, has its own privacy policy on its own website.
1.2 QC Consultancy Ltd is registered in England and Wales under company number 17228244. Its registered office address is shown on the Companies House register. We are registered with the Information Commissioner's Office under number ZC165311.
1.3 We comply with the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.
1.4 For any privacy question, contact us at contact@qcconsultancy.co.uk.
2. Data we collect
2.1 Website data: aggregated page view statistics, and technical data such as IP address and browser type held in our hosting provider's logs.
2.2 Enquiries: your name, email address, organisation, job title and anything else you choose to tell us when you contact us. You do not have to contact us, but we need your name and email address to reply.
2.3 Business contact data: the name, job title, employer, business email address, business phone number and professional profile of people at construction companies whom we may contact about our products. We take this from the person directly, from their employer's website, from professional networks such as LinkedIn, and from business contact databases.
2.4 Client records: names and contact details of people at organisations we work with, and records of our dealings with them.
3. How we use it and our lawful basis
3.1 We use personal data for the following purposes, on the lawful basis shown:
(a) running and securing the Website: legitimate interests (Article 6(1)(f));
(b) answering enquiries: legitimate interests, or taking steps at your request before entering a contract (Articles 6(1)(f) and 6(1)(b));
(c) contacting people at businesses about our products and services: legitimate interests (Article 6(1)(f));
(d) managing client relationships: legitimate interests (Article 6(1)(f)), or performance of a contract where you are our client personally; invoicing and keeping accounts: legal obligation (Article 6(1)(c)); and
(e) complying with the law and responding to lawful requests: legal obligation (Article 6(1)(c)).
3.2 Where we rely on legitimate interests, those interests are running and securing the Website, answering enquiries, managing client relationships and promoting our products and services to businesses. We have balanced them against your interests. You can ask us for details of that assessment.
3.3 We do not sell personal data, and we do not make decisions about you by automated means that have legal or similarly significant effects.
4. Business contact
4.1 We contact people only in their professional capacity, at their business address, about products relevant to their role.
4.2 Our first message to you says who we are, where we got your details and that you can object at any time, and links to this policy. Every message says how to opt out. If you opt out, we keep only your email address on a suppression list so that we never contact you again.
4.3 We do not send marketing emails to personal email addresses, sole traders or partnerships without consent.
5. Where your data is stored
5.1 Our business records are stored in our database provider's data centre in London. Our email is provided by Microsoft in the UK and EU. The Website is hosted on Vercel's global network.
5.2 Our database provider is a Singapore company and our website host is based in the United States. They may process data there or allow their support staff to access it from outside the UK.
5.3 Where personal data leaves the UK, we rely on UK adequacy regulations, including the UK Extension to the EU to US Data Privacy Framework where the recipient is certified, or on the International Data Transfer Addendum to the EU Standard Contractual Clauses. You can ask us for a copy of these safeguards.
6. Who we share it with
6.1 We share personal data only with:
(a) the service providers listed in clause 6.2, and anyone we engage to help run our business, under written contracts;
(b) our professional advisers, such as accountants and solicitors, and anyone buying all or part of our business, each under a duty of confidentiality; and
(c) regulators, courts and law enforcement where the law requires.
6.2 Our service providers:
| Provider | Purpose | Data location |
|---|---|---|
| Vercel | Website hosting and visitor statistics | Global edge network |
| Supabase | Our business records | London |
| Microsoft | Our business email | UK and EU |
6.3 We will update this list before adding a new provider.
7. How long we keep it
7.1 We keep personal data only as long as we need it:
(a) website logs: up to 12 months;
(b) enquiries: 2 years after our last contact;
(c) business contact data: until you ask us to stop, or 2 years after our last contact, whichever is sooner;
(d) suppression list entries: for as long as needed to make sure we do not contact you again; and
(e) client and accounting records: 7 years, to meet tax and company law requirements.
8. How we protect it
8.1 Data is encrypted in transit using TLS 1.2 or higher and at rest using AES-256, through our hosting and database providers. Access is limited to the company director and anyone we authorise to help run our business, each under a duty of confidentiality.
8.2 If a personal data breach affects your personal data, we will report it to the ICO and tell you about it where the law requires us to.
9. Cookies
9.1 The Website does not use cookies. Its visitor statistics come from Vercel Web Analytics, which counts visits without cookies and without storing information that identifies you. Its fonts load from Google Fonts, which receives your IP address when a page loads.
10. Your rights
10.1 You have the right to:
(a) access a copy of your personal data;
(b) have inaccurate data corrected;
(c) have your data erased;
(d) restrict how we use it;
(e) receive it in a portable format;
(f) object to processing based on legitimate interests;
(g) object at any time to being contacted about our products, which we will always respect; and
(h) withdraw consent where we rely on it.
10.2 To use any of these rights, email contact@qcconsultancy.co.uk. We will reply within one month, or within three months for complex requests, and tell you if we need longer. We do not charge unless a request is clearly unfounded or excessive.
11. Complaints
11.1 You can complain to us about how we use your personal data by emailing contact@qcconsultancy.co.uk. We will acknowledge your complaint within 30 days, look into it, keep you informed of progress, and tell you the outcome without undue delay. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
12. Changes
12.1 We will post any change to this policy on the Website with a new version date.