Privacy Notice – Clients, Suppliers and Sub-contractors

What is the purpose of this document?

Bill Harvey Associates Limited is committed to protecting the privacy and security of your personal information.

We are a data controller. This means we are responsible for deciding how we hold and use personal information about you. This notice explains to you what decisions we have taken in relation to that information.

Our contact details are as follows:

Bill Harvey Associates Ltd.

Melrose House, Pynes Hill

Rydon Lane, Exeter

Devon EX2 5AZ

Telephone +44 330 912 4742

Email privacy@billharveyassociates.com

This privacy notice describes how we collect and use personal information about you in the context of our business relationship, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

It applies to:

Clients — individuals at organisations who commission BHAL for structural assessment or other professional services, and any individuals whose personal data is shared with us in the course of a commission.
Suppliers and sub-contractors — individuals at organisations who provide goods or services to BHAL, including freelancers, consultants, and professional advisors.
Others who appear in project correspondence — individuals whose contact details (name, email address, telephone number) appear in email chains, group messages, or forwarded correspondence relating to a project or engagement. Examples include other consultants or contractors on a project, representatives of the ultimate client, and other parties copied into technical discussions.

Where your personal data reaches us indirectly — for example because you were copied into a project email chain, are a member of a shared project messaging group, or your details appear in correspondence forwarded to us — UK GDPR (Article 14) requires us to inform you of the relevant details of our processing. We are not always able to contact you individually to do this; providing individual notice to every person who appears in project correspondence would in most cases involve disproportionate effort within the meaning of Article 14(5)(b) of the UK GDPR. We therefore make this notice publicly available as the appropriate safeguard. If you have questions about how we handle your data in this context, please contact us using the details above.

If you have any queries about how we hold and use your personal information, please contact us at privacy@billharveyassociates.com or +44 330 912 4742.

The kind of information we hold about you

We may hold the following categories of personal information about you:

Contact details: name, job title, organisation, email address, telephone number, postal address.
Financial records: invoice details, bank account details (suppliers and sub-contractors only), payment records.
Correspondence and project records: email and other communications relating to your engagement with us or your commission to us.
Contractual records: signed agreements, purchase orders, engagement letters.
Professional details: qualifications, professional registrations, or insurance information relevant to your role (sub-contractors and consultants).

We do not typically hold special category personal data (such as health or criminal records information) about clients, suppliers or sub-contractors. If we need to hold any such information, we will seek your consent and explain the specific purpose at the time.

How is your personal information collected?

We collect personal information:

Directly from you, when you make an enquiry, enter into a contract, or correspond with us.
From your organisation, for example when a colleague or employer provides your contact details as the relevant contact for a project or engagement.
From publicly available sources, such as your organisation's website or professional directories.
Indirectly, from project correspondence and group communications — for example, where you are copied into an email chain, are a member of a shared project messaging group (such as a WhatsApp group), or your details appear in a forwarded email chain. In this case your contact details and the content of your messages reach us as part of the normal flow of project communications rather than through any direct relationship with you.

How we will use your personal information

Legal basis

We rely on the following lawful bases depending on the nature of our relationship with you:

Contract performance — where you are a party to a contract with us, we process your personal information to enter into and perform that contract.
Legitimate interests — where you are a contact at a client or supplier organisation (rather than personally the contracting party), we process your contact and correspondence data to manage our business relationship with your organisation. Our legitimate interest is in administering engagements, maintaining project records, and protecting our professional position.
Legal obligation — where we are required by law to retain certain records (for example financial and accounting records under HMRC requirements).

Purposes of processing

We use your personal information to:

Manage our business relationship with you or your organisation.
Administer projects and commissions — including issuing and receiving instructions, sharing deliverables, and corresponding on technical matters.
Issue and process invoices and payments.
Maintain project records for professional indemnity purposes (see Retention below).
Comply with legal and regulatory obligations.

Third parties

We may share your personal information with:

Our internal staff involved in your project or engagement.
Professional advisors (accountants, solicitors) where necessary.
Operators of software-as-a-service tools used in our day-to-day operations, such as communication and collaboration platforms, accounting software, file storage, and project management tools, who act as processors under our instructions.

We do not sell your personal data or share it with third parties for their own marketing purposes.

Transferring information outside the UK

Some of our SaaS service providers process data in the USA or Switzerland. USA transfers rely on the UK Extension to the EU-US Data Privacy Framework (UK-US Data Bridge, in effect from 17 October 2023). Switzerland transfers rely on the UK adequacy decision for Switzerland.

Data retention

Project and commission correspondence

Email and other correspondence forming part of a structural assessment or engineering commission record is retained for the operational life of the structure assessed, or indefinitely where that cannot be determined. BHAL's work concerns infrastructure with indefinite operational lives (masonry bridges and similar structures), and the project record is necessary to support professional indemnity and public safety obligations. Personal data in this correspondence (names and contact details of parties to the correspondence) is incidental to the technical record; the retention is justified by the nature of the work rather than a need to retain the personal data specifically.

Contact and relationship data

Where our relationship with you or your organisation has ended, we retain your contact and contractual records for as long as is necessary to cover the professional liability period for the relevant project. Professional liability for structural work, and limitation periods under deeds of appointment, run from practical completion of the project — which is typically determined by the main contractor's programme and may occur significantly later than the conclusion of BHAL's own commission.

For structural assessment work on infrastructure with an indefinite operational life (bridges, retaining structures, and similar), contact and contractual records are part of the project record and are retained on the same basis as project correspondence — for the operational life of the structure, or indefinitely where that cannot be determined.

Where BHAL does not have visibility of the practical completion date, and the project does not involve a structure with an indefinite operational life, we apply a long-stop retention period of 15 years from the end of our commission. This is conservative but reflects the fact that BHAL cannot control when practical completion occurs and must retain records long enough to respond to any claim arising within the limitation period.

Financial records

Invoice and payment records are retained for 6 years from the end of the relevant financial year, in compliance with HMRC requirements.

Bank details (suppliers and sub-contractors)

Bank account details provided for payment purposes are retained for 6 years from the date of the last payment, and then securely deleted.

Your rights

Under UK GDPR, you have the right to:

Access the personal information we hold about you.
Correct any inaccurate or incomplete information.
Erasure — request that we delete your personal information where there is no longer a lawful basis for holding it.
Object to processing based on legitimate interests, where you have grounds relating to your particular situation. Note that for project correspondence retained for professional indemnity purposes, we will normally have compelling grounds to continue.
Restriction of processing in certain circumstances.
Portability of your data in a machine-readable format where processing is based on consent or contract.

To exercise any of these rights, please contact us at privacy@billharveyassociates.com.

Complaints

You have the right to make a complaint to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues, at ico.org.uk or by calling 0303 123 1113.

Changes to this notice

We may update this notice from time to time. The current version will be made available on request. If we make material changes that affect you, we will notify you directly where we hold your contact details. This notice was last updated on 24 April 2026.