— Policies
Privacy Policy.
1. Who we are
Evolve Planning and Design Ltd (“Evolve”, “we”, “us”, “our”) is an independent town planning, environment and design consultancy. We are the data controller for the personal data described in this policy.
- Registered address: Unit 1, Tollgate Business Centre, Blithbury Road, Hamstall Ridware, Rugeley, WS15 3RT
- Registered in England and Wales, company number: 09195499
- ICO registration number: ZA747291
- Email: info@evolvepad.co.uk
- Telephone: +44 (0)1889 504136
This policy explains what personal data we collect through evolvepad.online and in the course of our consultancy work, why we collect it, who we share it with, and what rights you have. It should be read alongside our Cookie Policy.
We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).
2. The personal data we collect
2.1 Information you give us
When you complete an enquiry form on this website, we collect:
- your first name and last name;
- your email address;
- your telephone number (optional);
- your company or organisation (optional);
- the service or services you are interested in — Planning, Environment or Design (optional); and
- the content of your message.
Enquiry form submissions are sent to us by email. They are not stored in a database on this website.
We also collect personal data you provide when you email us, telephone us, connect with us on LinkedIn, or engage us to act on your behalf. For client engagements this may include billing details, site and property information, correspondence and any documents you send us.
2.2 Information we collect automatically
- Website analytics. We use a self-hosted, privacy-focused analytics tool (Umami, hosted at analytics.weboptic.com by our web developer) to understand how the site is used. It records page views, referring site, approximate country, device type and browser. It does not use cookies, does not track you across other websites, and does not build a profile of you. The data it produces is aggregated and is not used to identify individuals.
- Server logs. Our web server and content management system record technical information for security, error diagnosis and abuse prevention. This can include your IP address, the date and time of your request, the page requested, and your browser and operating system.
- Cookies and similar technologies. See our Cookie Policy for full details of what is stored on your device and why.
2.3 Information from third parties
In the course of planning work we may receive personal data from local planning authorities, publicly available planning registers, land registry records, our clients and their professional advisers. Planning is a public process: information submitted in support of a planning application, appeal or local plan representation is normally placed on a public register by the relevant authority.
We do not buy marketing lists.
2.4 Spam and abuse prevention
Our forms are protected by Cloudflare Turnstile, which checks that submissions come from a person rather than an automated system. Turnstile runs invisibly — there is no puzzle to solve and, in most cases, nothing for you to click — and collects a limited set of technical signals: your IP address, TLS fingerprint, browser User-Agent, and the site key of the page you are visiting. Cloudflare states that these signals are used only to detect and block bots and to improve that detection, and not to identify, profile or target individuals. This processing is described in the Cloudflare Turnstile Privacy Addendum.
Our lawful basis is our legitimate interest in protecting our website and our inbox from automated abuse. Turnstile is necessary for our forms to work: if it is blocked by your browser, your enquiry cannot be submitted, but you can always contact us by email or telephone instead.
3. Why we use your personal data, and our lawful basis
| What we use it for | Lawful basis |
|---|---|
| Responding to your enquiry and providing information about our services | Legitimate interests (responding to a request you have made), or steps taken at your request before entering into a contract |
| Providing planning, environment and design consultancy services, and administering the client relationship | Performance of a contract |
| Preparing and submitting planning applications, appeals and representations | Performance of a contract; legitimate interests of our client; legal obligation where the authority requires the information |
| Checking that form submissions are genuine, and preventing spam and automated abuse | Legitimate interests (protecting our systems and our users) |
| Keeping the website secure and diagnosing faults | Legitimate interests (protecting our systems) |
| Understanding how the website is used, using aggregated analytics | Legitimate interests (improving our website) |
| Sending marketing or insight updates to business contacts | Consent, or the “soft opt-in” where you are an existing client, in each case with an unsubscribe option in every message |
| Meeting our accounting, tax, professional and regulatory obligations | Legal obligation |
| Establishing, exercising or defending legal claims | Legitimate interests (protecting our legal position) |
Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights and freedoms, and we have concluded that they are not. You can ask us for more detail about that assessment at any time.
We do not carry out automated decision-making or profiling that produces legal or similarly significant effects.
4. Who we share your personal data with
We do not sell your personal data, and we do not share it with advertising networks or customer relationship management platforms. We share it only where necessary, with:
- Web Optic – our website developer and host, which maintains this website, its content management system and its analytics platform. The web server and its logs are located in the United Kingdom.
- Bunny.net (Bunny Way d.o.o.) – the content delivery network that serves images and files on this website, configured to use its United Kingdom region. Your IP address is processed by the CDN edge server nearest to you in order to deliver those files.
- Cloudflare, Inc. – provides the Turnstile anti-spam check on our forms, as described in section 2.4.
- SMTP2GO – the service that delivers enquiry form submissions to our inbox as email. It processes the contents of those messages in transit.
- Our email provider – enquiry emails and correspondence are stored in our business mailboxes.
- Vimeo and YouTube – where a page contains an embedded video, the video is only loaded from Vimeo or YouTube when you choose to play it. See our Cookie Policy.
- Local planning authorities, the Planning Inspectorate, statutory consultees and other professional advisers – where this is necessary to deliver the work you or our client has instructed.
- Our professional advisers – accountants, insurers, auditors and lawyers, where required.
- Regulators, law enforcement and other authorities – where we are legally required to disclose information.
Where a third party acts as our processor, we have a written contract in place requiring them to keep your data secure and to use it only on our instructions.
5. International transfers
This website, its database and its analytics are hosted in the United Kingdom, and our content delivery network is configured to use its United Kingdom region. Most of your personal data therefore stays in the UK.
A limited number of our providers may process data outside the UK. In particular, Cloudflare operates a global network and its Turnstile check may be handled by a server outside the UK; our email delivery provider (SMTP2GO) operates internationally; and Vimeo and YouTube are based in the United States if you choose to play an embedded video.
Where personal data is transferred outside the UK, we rely on one of the safeguards permitted by the UK GDPR, normally the UK International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework where the recipient is certified under it. You can request a copy of the relevant safeguard by contacting us.
6. How long we keep your personal data
- Website enquiries that do not lead to an engagement: up to [24] months from your last contact with us, after which the email is deleted.
- Client files and project records: for the duration of the engagement and then for [6] years, reflecting the limitation period for contractual claims and our professional indemnity insurance requirements. Some planning records are kept longer where a site remains live or a permission remains capable of implementation.
- Accounting and tax records: 6 years from the end of the relevant financial year, as required by HMRC.
- Marketing contact records: until you unsubscribe or ask us to stop, and then only a suppression record so that we do not contact you again.
- Server and security logs: typically [12] months.
Where data is no longer needed we delete it or irreversibly anonymise it.
7. How we protect your personal data
This website is served over HTTPS. Access to our content management system is restricted to authorised users, and administrative actions are logged. We apply access controls, encryption in transit, and regular updates to our systems. No transmission over the internet can be guaranteed to be completely secure, but we take appropriate technical and organisational measures to protect your data and to detect and respond to any breach.
8. Your rights
Under UK data protection law you have the right to:
- Be informed about how we use your personal data — this policy is part of that;
- Access a copy of the personal data we hold about you;
- Rectification of inaccurate or incomplete data;
- Erasure of your data in certain circumstances;
- Restrict our processing of your data in certain circumstances;
- Data portability — to receive data you gave us in a machine-readable format;
- Object to processing based on our legitimate interests, and to object at any time to direct marketing; and
- Withdraw consent at any time, where we rely on consent. Withdrawing consent does not affect the lawfulness of processing carried out beforehand.
To exercise any of these rights, email info@evolvepad.co.uk or write to us at the address above. We will respond within one month. There is normally no charge. We may need to verify your identity before we act on a request.
Please note that where personal data has been placed on a public planning register by a local planning authority, that authority — not Evolve — controls the data on the register, and any request to amend or remove it should be directed to them.
9. Complaints
If you are unhappy with how we have handled your personal data, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
ico.org.uk/make-a-complaint
10. Links to other websites
Our website contains links to other websites, including LinkedIn and the websites of professional bodies and partner organisations. This policy does not apply to those websites, and we are not responsible for their content or their privacy practices. Please read their own privacy notices.
11. Children
Our website and services are aimed at businesses and professionals. We do not knowingly collect personal data from children.
12. Changes to this policy
We may update this policy from time to time to reflect changes in our practices or in the law. The date at the top of this page shows when it was last revised. Where a change is significant we will draw attention to it on this page.
