Privacy Policy

LAST UPDATED: 02 SEPTEMBER 2026

Thinking Buildings Limited (“Thinking Buildings”, “we”, “us” or “our”) is committed to protecting your privacy and respecting your rights in relation to your personal data.

This Privacy Policy explains how we collect, use, store and protect personal data when you visit or use our website at www.thinking-buildings.co.uk (the “Website”), contact us, submit information through our Website, or otherwise interact with us in connection with the services we provide.

This Privacy Policy should be read alongside any other privacy notices or information we may provide to you at the point we collect your personal data.

For the purposes of applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Thinking Buildings Limited is the data controller responsible for your personal data.

WHO WE ARE

Thinking Buildings

Cromford Creative, Cromford Mill, Mill Road, Cromford, MATLOCK, Derbyshire, DE4 3RQ, United Kingdom

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us using the details above.

WHAT PERSONAL DATA DO WE COLLECT?

The personal data we collect depends on how you interact with us and may include the following:

Information you provide to us

You may provide personal data when you:

complete a form on our Website;
contact us by email, telephone or other means;
request information about our services;
make an enquiry;
subscribe to a newsletter or other marketing communications;
communicate with us regarding an existing or potential business relationship; or
otherwise provide information to us voluntarily.

This information may include:

your name;
business name;
postal address;
email address;
telephone number;
information relating to your enquiry or requirements;
information contained in correspondence with us; and
any other information you choose to provide.

Please do not provide sensitive or special category personal data through the Website unless we specifically request it and provide an appropriate method for doing so.

INFORMATION WE AUTOMATICALLY COLLECT

When you visit our Website, certain information may be collected automatically through technical means, including cookies and similar technologies.

Depending on the Website configuration and your cookie preferences, this may include:

IP address;
browser type and version;
device type;
operating system;
time zone;
language preferences;
approximate geographical location;
pages visited;
time spent on pages;
referring website;
links or buttons you interact with;
Website navigation information;
technical information about your device; and
information about how you use and interact with our Website.

Some of this information may constitute personal data where it can be used to identify, directly or indirectly, an individual.

We use this information to operate, secure, maintain and improve the Website and, where applicable, to understand how visitors use the Website.

COOKIES AND SIMILAR TECHNOLOGIES

Our Website may use cookies and similar technologies.

Cookies are small text files placed on your device when you visit a website. They can be used for a variety of purposes, including ensuring that a website operates correctly, remembering preferences, analysing website usage and supporting certain functionality.

We may use the following categories of cookies:

Strictly necessary cookies – required for the Website to operate correctly and cannot normally be disabled through our cookie management system.
Analytics or performance cookies – used to understand how visitors use the Website and help us improve its performance.
Functional cookies – used to remember preferences and provide enhanced functionality.
Marketing or advertising cookies – where applicable, used to support marketing, advertising or measurement activities.

Where consent is required by applicable law, we will ask for your consent before placing non-essential cookies on your device.

You can manage your cookie preferences through the cookie consent mechanism provided on our Website and through your browser settings.

Further information about the cookies used on the Website, their purposes and how long they remain on your device should be provided in our Cookie Policy/cookie preference centre.

HOW WE USE YOUR PERSONAL DATA

We may use your personal data for the following purposes:

to respond to enquiries and requests;
to provide information about our services;
to communicate with you;
to manage our relationship with you or your organisation;
to provide services where you have engaged us;
to administer and operate our Website;
to maintain the security of our Website, systems and information;
to monitor and improve Website performance and functionality;
to analyse Website usage where appropriate;
to send marketing communications where permitted and, where required, where you have provided consent;
to maintain appropriate business and administrative records;
to comply with legal and regulatory obligations;
to establish, exercise or defend legal claims; and
to prevent fraud, misuse, security incidents and other unlawful activity.

We will not use your personal data for purposes that are incompatible with the purposes described in this Privacy Policy unless we have a lawful basis to do so and provide any additional information required by law.

OUR LAWFUL BASES FOR PROCESSING PERSONAL DATA

Under the UK GDPR, we must have a lawful basis for processing your personal data. Depending on the circumstances, we may rely on one or more of the following lawful bases:

CONSENT

We may process your personal data where you have given us consent to do so. For example, where applicable, we may rely on consent for certain marketing communications or non-essential cookies.

Where we rely on consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

CONTRACT

We may process your personal data where processing is necessary to enter into or perform a contract with you, or to take steps at your request before entering into a contract.

LEGAL OBLIGATION

We may process your personal data where necessary for us to comply with a legal or regulatory obligation.

LEGITIMATE INTERESTS

We may process personal data where this is necessary for our legitimate interests, or the legitimate interests of a third party, provided that those interests are not overridden by your interests or fundamental rights and freedoms.

Our legitimate interests may include:

operating and managing our business;
responding to enquiries;
managing relationships with clients and prospective clients;
improving our Website and services;
maintaining information and network security;
preventing fraud and misuse;
managing business administration; and
establishing, exercising or defending legal claims.

Where we rely on legitimate interests, we will consider and balance those interests against your rights and interests before processing your personal data.

MARKETING COMMUNICATIONS

Where permitted by law, we may contact you about our services, news, updates or other information that may be relevant to you.

Where consent is required, we will only send electronic marketing communications where you have provided the required consent.

You can opt out of marketing communications at any time by:

using the unsubscribe option included in the relevant marketing communication; or
contacting us using the details provided in this Privacy Policy.

You can object to direct marketing at any time. If you object, we will stop processing your personal data for direct marketing purposes.

WHO WE MAY SHARE YOUR PERSONAL DATA WITH

We do not sell your personal data.

We may share personal data with trusted third parties where this is necessary for the purposes described in this Privacy Policy and where we have a lawful basis for doing so.

These may include:

website hosting and technical service providers;
website developers and IT support providers;
email and communications providers;
customer relationship management or business administration systems;
analytics and website performance providers;
marketing service providers, where applicable;
professional advisers such as lawyers, accountants and insurers;
business partners, suppliers and subcontractors where necessary to provide services;
search engine and technology providers where applicable; and
regulatory authorities, law enforcement agencies or other organisations where we are legally required or permitted to do so.

Where a third party processes personal data on our behalf, we will take appropriate steps to ensure that the processing is carried out in accordance with applicable data protection law and that appropriate confidentiality and security measures are in place.

INFORMATION OBTAINED FROM OTHER SOURCES

In some circumstances, we may receive personal data about you from sources other than directly from you.

These sources may include:

business partners;
professional advisers;
publicly available sources;
organisations with which we have a business relationship;
service providers; and
other third parties where they are legally permitted to provide us with the information.

Where we obtain personal data from another source, we will provide you with the relevant privacy information as required by applicable data protection law.

INTERNATIONAL TRANSFERS

Some of the service providers we use may process personal data outside the United Kingdom.

Where personal data is transferred outside the UK, we will ensure that the transfer is made in accordance with applicable UK data protection legislation.

Depending on the destination and circumstances, this may include relying on a UK adequacy regulation, appropriate safeguards such as the UK International Data Transfer Agreement or UK Addendum, or another lawful transfer mechanism.

The ICO confirms that restricted international transfers must be covered by UK adequacy regulations, appropriate safeguards or a relevant exception.

Where required, further information about relevant international transfers and safeguards can be provided on request.

HOW LONG WE KEEP YOUR PERSONAL DATA

We will only retain personal data for as long as it is reasonably necessary for the purposes for which it was collected, including for the purposes of satisfying legal, accounting, reporting or regulatory requirements.

The appropriate retention period will depend on factors including:

the purpose for which the information was collected;
the nature of the information;
whether we have an ongoing business relationship with you;
legal and regulatory requirements;
whether the information may be required to establish, exercise or defend legal claims; and
our legitimate business requirements.

When personal data is no longer required, we will securely delete, destroy or anonymise it, where appropriate.

HOW WE PROTECT YOUR PERSONAL DATA

We take appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

These measures may include:

secure hosting and systems;
access controls;
appropriate authentication and password controls;
encryption where appropriate;
regular security assessments;
staff training on data protection;
restricted access to personal data;
appropriate staff and supplier confidentiality requirements; and
procedures for identifying, managing and responding to data protection and security incidents.

However, no method of transmission over the internet or method of electronic storage is completely secure. While we take reasonable steps to protect your personal data, we cannot guarantee the absolute security of information transmitted to or through our Website, but we are committed to protecting your data to the highest standard possible.

YOUR DATA PROTECTION RIGHTS

Subject to certain legal conditions and exemptions, you may have the following rights under UK data protection law:

RIGHT OF ACCESS

You have the right to request a copy of the personal data we hold about you.

RIGHT TO RECTIFICATION

You can ask us to correct inaccurate or incomplete personal data.

RIGHT TO ERASURE

In certain circumstances, you can ask us to delete your personal data.

This is sometimes referred to as the “right to be forgotten”. This right is not absolute and certain information may need to be retained where we have a lawful reason to do so.

RIGHT TO RESTRICT PROCESSING

In certain circumstances, you can ask us to restrict how we process your personal data.

RIGHT TO DATA PORTABILITY

Where applicable, you may have the right to receive certain personal data you have provided to us in a structured, commonly used and machine-readable format and to request that it is transmitted to another data controller.

RIGHT TO OBJECT

You may have the right to object to certain processing of your personal data, including processing based on legitimate interests.

You have an absolute right to object to the processing of your personal data for direct marketing purposes.

RIGHT TO WITHDRAW CONSENT

Where we rely on your consent to process your personal data, you may withdraw that consent at any time.

These rights are not always absolute and may be subject to specific legal conditions and exemptions.

Further information about individual data protection rights is available from the Information Commissioner’s Office (ICO).

HOW TO EXERCISE YOUR RIGHTS

If you wish to exercise any of your data protection rights, please contact us at:

Thinking Buildings

Cromford Creative, Cromford Mill, Mill Road, Cromford, MATLOCK, Derbyshire, DE4 3RQ, United Kingdom

When making a request, we may need to ask for additional information to verify your identity and ensure that personal data is not disclosed to the wrong person.

We will respond to valid requests within the timescales required by applicable data protection law.

COMPLAINTS

If you have concerns about how we use your personal data, we would encourage you to contact us first, using the details in section 21, so that we can investigate and try to resolve your concern.

You also have the right to complain to the UK’s data protection supervisory authority, the Information Commissioner’s Office (ICO).

Information about making a complaint can be found on the ICO’s website at: Information Commissioner’s Office (ICO)

LINKS TO OTHER WEBSITES

Our Website may contain links to third-party websites, services or resources.

These websites are operated independently from Thinking Buildings and may have their own privacy policies and terms.

We are not responsible for the privacy practices, content or security of third-party websites. We recommend that you review the privacy policy of any third-party website before providing it with personal data.

CHILDREN’S PRIVACY

Our Website is not specifically directed at children, and we do not knowingly collect personal data from children through the Website unless this is necessary for a specific service or purpose and appropriate safeguards are in place.

If you believe that a child has provided personal data to us without appropriate authorisation, please contact us so that we can review the circumstances and take appropriate action.

AUTOMATED DECISION-MAKING AND PROFILING

We do not currently intend to make decisions about individuals based solely on automated processing, including profiling, which produce legal or similarly significant effects.

If this changes, we will provide the information required by applicable data protection law and update this Privacy Policy where appropriate.

DATA PROTECTION AND THIRD-PARTY SERVICES

Our Website may use third-party services and technologies to provide functionality, analyse Website usage, process enquiries, deliver communications, maintain security or provide other services.

Where such services involve personal data, we will take appropriate steps to ensure that their use complies with applicable data protection requirements.

The specific third-party services used by the Website may change from time to time. Where appropriate, information about such services may also be provided through our cookie consent mechanism or Cookie Policy.

CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes to our business, Website, services, technology, legal requirements or data processing activities.

When we make changes, we will update the “Last updated” date at the top of this Privacy Policy. Your continued use of our Website following the posting of revisions constitutes your acceptance of those changes.

We recommend that you review this page periodically to ensure that you are aware of how we process and protect your personal data.

CONTACT US

If you have any questions, concerns or requests regarding this Privacy Policy or the way we process personal data, please contact us at:

Thinking Buildings

Cromford Creative, Cromford Mill, Mill Road, Cromford, MATLOCK, Derbyshire, DE4 3RQ, United Kingdom

Website: www.thinking-buildings.co.uk