Public Privacy Notice & Cookie Policy

Public Privacy Notice

Effective date: 5th January 2026

Last updated: 5th January 2026

1. INTRODUCTION

Architecture for London Ltd and AFL Build Ltd (“we”, “our”,“us”) are committed to protecting and respecting your privacy. This Privacy Notice explains how we collect, use, store, and disclose personal data relating to individuals who interact with us, including visitors to our website.

This notice complies with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other relevant privacy laws. By using our website or engaging with our services, you accept and consent to the practices described here.

2. WHO WE ARE

Architecture for London Ltd and AFL Build Ltd are two separate UK limited companies operating under common ownership and shared infrastructure. Depending on the context, we may act as joint or independent Data Controllers.

3. HOW WE COLLECT PERSONAL DATA

We may collect personal data in the following ways:

a) Information you give us:

When contacting us through website forms, email, phone or post
When interacting with us as a client, consultant, or stakeholder
When supplying us with bank details for payment
When signing up for newsletters or submitting enquiries
When applying for a job or sending us a CV

b) Information we collect automatically:

Website usage data (IP address, browser, pages visited, time on site, device info)

c) Information from third parties:

Collaborators or consultants involved in projects
Public sources (e.g. Companies House)
Referees during recruitment

4. TYPES OF PERSONAL DATA WE COLLECT

Depending on the context, we may collect and process the following data:

Name, title, and contact details
Project-related data, including correspondence
Photographs of completed projects that may incidentally include individuals
Website usage information (e.g. IP address, device/browser info)
Financial data such as bank details (for payment purposes)
Job application data (CVs, portfolios, references)
Any other personal data you voluntarily provide

5. LAWFUL BASIS FOR PROCESSING

We process data under the following lawful bases, as defined by UK GDPR:

Legitimate Interests – communicating with clients, managing our business, or promoting our services
Contractual Necessity – to fulfil agreements with clients, suppliers, or employees
Legal Obligation – compliance with financial, regulatory, or health and safety duties
Consent – for email marketing or optional communications (which can be withdrawn at any time)

6. HOW WE USE PERSONAL DATA

a) Project & Business Purposes:

Providing architectural, design, and construction services
Communicating with clients, collaborators, and consultants
Managing project records, correspondence, and documentation
Submitting tenders or bid proposals
Publishing completed projects (with care to avoid personal identification)
Maintaining financial records and issuing/receiving payments

b) Marketing (with consent):

Sending you news, updates, or promotional material
Informing you of new services or relevant projects
Carrying out surveys or market research

c) Recruitment:

Processing job applications and CVs
Contacting referees and evaluating suitability for roles
Keeping CVs on file (for up to 12 months) for future vacancies

7. SHARING YOUR DATA

We may share your data with:

Clients, consultants, or contractors on relevant projects
Professional service providers (e.g. IT support, accountants)
Recruitment platforms or referees during hiring
Government bodies, regulators, or law enforcement if required by law
Other trusted third parties who help us operate our business (e.g. website developers)

We do not sell your personal data. Where we use third parties, they are contractually bound to protect your data and only process it on our instructions.

Due to shared infrastructure, data may be accessed by both Architecture for London Ltd and AFL Build Ltd for business purposes, such as joint project delivery or internal admin. Access is restricted to authorised personnel only.

8. INTERNATIONAL DATA TRANSFERS

Some of the personal data we collect may be transferred to or accessed by individuals or services located outside the United Kingdom. This includes:

Staff working remotely outside the UK
Cloud-based software providers that may store or process data on international servers

We rely on reputable third-party providers that implement appropriate legal safeguards to protect your data in accordance with UK GDPR. These safeguards may include approved contractual terms or data protection frameworks that ensure your personal information remains protected, even when processed outside the UK.

9. DATA SECURITY

We take appropriate technical and organisational measures to safeguard your data. This includes:

Secure servers and firewall protection
Password-protected IT systems and email
Access controls to limit internal access
Risk assessments and security reviews

While we take all reasonable precautions, transmission of data over the internet can never be fully secure. Any data sent to us is at your own risk.

10. DATA RETENTION

We retain data only as long as necessary for its intended purpose or to comply with legal and regulatory obligations. For example:

Project data may be retained indefinitely for future reference or regulatory purposes
Financial data (e.g. invoices, payment details) are kept for 6 years
CVs from unsuccessful applicants are kept for up to 12 months

The retention periods above apply to primary storage locations where personal data is actively used or processed. Data that is no longer required for its original purpose is securely deleted or anonymised from primary storage.

Copies may persist in backups, snapshots, or recycle bins for up to one year beyond the stated retention periods for recovery purposes. All personal data, including backups, is handled in accordance with this notice.

11. YOUR RIGHTS

Under UK GDPR, you have the following rights:

Access – to request a copy of the personal data we hold
Rectification – to correct any inaccurate data
Erasure – to request deletion of your data
Restriction – to limit processing of your data
Objection – to object to certain types of processing
Withdraw Consent – at any time (for marketing or optional processing)
Complain – to the Information Commissioner’s Office (ICO) if you’re concerned about how your data is handled

To exercise your rights, contact us at:

Architecture for London Ltd: mail@architectureforlondon.com

AFL Build Ltd: build@architectureforlondon.com

ICO contact:

Web: https://ico.org.uk

Tel: 0303 123 1113

12. SOCIAL MEDIA POLICY

We may operate profiles on social media platforms such as Instagram or LinkedIn. Please note:

We do not request or store sensitive personal data via social media
Any interaction on third-party platforms is subject to their privacy policies
Use of social sharing tools is at your own discretion

13. EXTERNAL LINKS

Our website may link to third-party sites. We are not responsible for their privacy practices.

14. UPDATES

We may update this notice from time to time to reflect changes in the law or our business practices. The latest version will always be available at architectureforlondon.com/privacy.

COOKIE POLICY

Last updated: 5th January 2026

1. WHAT ARE COOKIES?

Cookies are small files placed on your device that store information. They help websites function efficiently and collect usage data.

2. WHY WE USE COOKIES

We use cookies to:

Enhance user experience
Understand how visitors use our site
Store preferences (e.g. language, cookie consent settings)

3. TYPES OF COOKIES WE USE

Necessary – to enable core functions like security and accessibility
Preference – to remember your settings and choices
Analytics – to track website usage via tools like Google Analytics
Session – temporary cookies that expire after your visit

4. MANAGING COOKIES

You can manage or block cookies through your browser settings. Most browsers allow you to:

Delete existing cookies
Block all cookies
Set alerts before cookies are saved

Note: disabling cookies may affect website functionality.

5. THIRD-PARTY COOKIES

We may use third-party tools that set cookies (e.g. Google Analytics). These providers have their own privacy policies.

6. LEARN MORE

For detailed information on cookies, visit: allaboutcookies.org

If you have any questions, requests or concerns about privacy or cookies, please contact:

Architecture for London Ltd: mail@architectureforlondon.com

AFL Build Ltd: build@architectureforlondon.com