top of page
Privacy Notice

​At Civil Studio, we are committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and share your personal information in compliance with the UK General Data Protection Regulation (UK GDPR) and other relevant data protection laws.

 

1. Who We Are

Civil Studio Limited

16 Bis Gandy Street, Exeter, Devon, EX4 6LS

info@civil.studio | 01392 984 100

For the purposes of the UK GDPR, we are the 'data controller' responsible for your personal data.

​

2. What Personal Data We Collect

We may collect and process the following types of personal data:

  • Contact Information: Name, address, email address, phone number, and professional titles.

  • Professional Information: Company name, job title, industry sector, and details relevant to civil engineering projects.

  • Communication Data: Records of your correspondence with us, including emails, phone calls, and meetings.

  • Project-Related Data: Information provided by you or third parties in connection with our civil engineering consultancy services, which may include details necessary for project delivery (e.g., land ownership details, site specific information, technical data).

  • Billing and Financial Information: Details required for processing payments for our services.

​

3. How We Collect Your Personal Data

We collect personal data from various sources:

  • Directly from you: When you contact us via our website, email, phone, or in person or when you engage our services.

  • From third parties: This may include professional networks, public sources, or from clients who provide your details as part of a project.

​

4. How and Why We Use Your Personal Data (Lawful Bases)

We process your personal data based on the following lawful bases under UK GDPR:

  • Performance of a Contract: To deliver our civil engineering consultancy services to you, including project management, design work, reports, and communication necessary for the contract.

  • Legitimate Interests: For our legitimate business interests, provided these do not override your rights and freedoms. This includes:

    • Communicating with you about our services and industry news.

    • Improving our services.

    • Managing our business operations, including financial and administrative functions.

    • Protecting our legal rights and interests, and for debt recovery.

    • Marketing our services to you where we have a legitimate interest to do so.

  • Legal Obligation: To comply with legal or regulatory obligations, such as tax laws, health and safety regulations, or professional body requirements.

  • Consent: Where you have given us explicit consent for a specific purpose (e.g., subscribing to a newsletter if offered). You have the right to withdraw your consent at any time.

Specifically, we use your personal data for:

  • Providing our civil engineering consultancy services (including but not limited to flood risk assessments, highway design, external levels, drainage design, planning support, tender & construction phase support).

  • Responding to your enquiries and providing information about our services.

  • Managing our client relationships and administrative processes.

  • Sending you relevant updates, newsletters, or marketing communications (where appropriate and with your consent or legitimate interest).

  • Recruitment purposes.

  • Complying with our legal and regulatory obligations.

​

5. Who We Share Your Personal Data With

We may share your personal data with:

  • Our employees and sub-consultants: Who require the information to perform their duties and deliver our services.

  • Clients and project partners: Where necessary for the delivery of a project (e.g., sharing contact details for project coordination).

  • Third-party service providers: Who assist us in our business operations, such as IT support, accounting services, and marketing platforms. These providers are bound by data processing agreements and are only permitted to process your data for specified purposes.

  • Regulatory bodies, government authorities, and legal advisors: Where required by law, court order, or to protect our legal rights.

  • Prospective buyers: In the event of a merger, acquisition, or sale of our business, we may share your data with relevant parties under strict confidentiality agreements.

We do not sell your personal data to third parties.

​

6. International Data Transfers

We primarily store and process your personal data within the United Kingdom and the European Economic Area (EEA). If we transfer your personal data outside the UK or EEA, we will ensure that appropriate safeguards are in place to protect your data, such as standard contractual clauses approved by the Information Commissioner's Office (ICO) or by ensuring the recipient country has an adequacy decision.

​

7. How We Protect Your Personal Data

We implement appropriate technical and organisational measures to protect your personal data from unauthorised access, alteration, disclosure, or destruction. These measures include:

  • Data encryption.

  • Access controls and authentication procedures.

  • Regular security assessments and updates.

  • Staff training on data protection.

  • Secure storage solutions.

​

8. How Long We Retain Your Personal Data

We will retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. This typically means:

  • For contract-related data, for the duration of the contract plus a period required by law or our professional indemnity insurance (12 years).

  • For marketing communications, until you unsubscribe or withdraw your consent.

  • For recruitment data, for a reasonable period following the completion of the recruitment process.

When your data is no longer required, we will securely delete or anonymise it.

​

9. Cookie Policy

Like most websites, we use cookies to help us understand how our site is used. A cookie is a small file that's stored on your browser or computer when you visit a website which helps us understand how you use our site, ensuring we make it easy to use. We only use analytical/performance cookies, which help us count visitors and see how they move around our website. This data helps us improve how our site works. We specifically use the following cookies:​

  • Google Analytics (_utma,_utmb,_utmc,_utmz): These cookies are provided by Google Analytics and help us understand how visitors use our website, allowing us to count visitors and see how they navigate our site. For more details, please visit Google's cookie guide. The expiry of these cookies is determined by Google, however typically ranges from 0-24 months. Please see Google's cookie guide for further information.

  • Wix (XSRF-TOKEN, hs, svSession, SSR-caching, TS*, bSession, fedops.logger.sessionld, _wixAB3|*, server-session-bind, client-session-bind): These cookies are placed by our website platform operated by Wix. These are for security, performance and tracking purposes. They expire anywhere between the end of your user session (when you close your browser) and 12 months. For further information on these cookies please visit Wix's cookie guide.​​

Please be aware that third party services such as Google Maps may also use cookies. We have no control over these, which are typically analytical/performance or targeting cookies. You can block cookies by adjusting your browser settings to refuse some or all cookies. Please refer to your browsers 'help' section for instructions on how to do this.​ For general information and advice on cookies & privacy, please visit a source like aboutcookies.org.uk.​​

​

10. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

  • Right to be informed: To receive clear and transparent information about how we process your personal data.

  • Right of access: To request a copy of the personal data we hold about you.

  • Right to rectification: To request that inaccurate or incomplete personal data about you is corrected.

  • Right to erasure (the "right to be forgotten"): To request the deletion of your personal data in certain circumstances.

  • Right to restrict processing: To request that we limit the way we use your personal data in certain circumstances.

  • Right to data portability: To receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller.

  • Right to object: To object to the processing of your personal data for direct marketing purposes or where processing is based on legitimate interests.

  • Rights in relation to automated decision-making and profiling: To not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

To exercise any of these rights, please contact us using the details provided below.

​

11. How to Make a Complaint

If you have any concerns about our use of your personal data, please contact us in the first instance. We will do our best to resolve your concerns.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues. Their website is https://ico.org.uk.

​

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will post any updates on this page with a revised "Last Updated" date. We encourage you to review this policy periodically.

Last Updated: July 2025

bottom of page