Privacy Policy
1. Who we are
Unda Consulting Limited (“Unda”, “we”, “us”) is a flood risk and drainage consultancy. We decide how and why your personal information is used, which makes us the controller of it under UK data protection law.
Unda Consulting Limited
Unit 3, Oak Cottage
County Oak Way
Crawley
West Sussex
RH11 7ST
Registered in England and Wales, company number 09360091. Registered with the Information Commissioner’s Office, registration number ZB127834.
For any question about your personal information, or to use any of your rights, contact:
- Email: privacy@unda.co.uk
- Phone: 01293 214444
- Post: the address above, marked for the attention of the Operations Director
2. Who this policy covers
This policy explains how we handle personal information about:
- people who contact us for a quote or advice
- our clients, and the people who work for them or act for them (architects, agents, planning consultants, solicitors)
- people connected with a site we assess, such as owners or occupiers named in the documents we are given
- people named in flood risk and drainage submissions we review for planning authorities and other public bodies
- people named in documents we receive when acting as an expert witness
- visitors to www.unda.co.uk
- people who apply for a job with us
- contacts at our suppliers and subconsultants
3. What information we collect
When you enquire or instruct us: your name, job title and company, phone number, email address, the address of the site, details of the proposed development or property purchase, and anything else you tell us in a form, email or call. We record phone calls to and from our office.
When we work for you: the above, plus the drawings, plans and documents you send, our correspondence, the reports, calculations, drawings and models we prepare, invoices and payment records. Card payments are handled by Stripe, so we never see or hold your full card number.
From other people: an architect, agent or other adviser may give us your details when they instruct us on your behalf. Clients confirm, when they instruct us, that they are entitled to pass on any personal information about other people in the documents they send. Planning authorities and other public bodies send us submissions to review, which can include the applicant’s and agent’s details. We also use public records, such as planning applications and Companies House.
When you use our website: your IP address, device and browser type, the pages you visit and how you use them. Our web server logs IP addresses for security. Beyond that, we only collect this information, through analytics and advertising cookies and Microsoft Clarity session recording, if you agree to it in our cookie banner. Our forms use Google reCAPTCHA to block spam.
When you apply for a job: your CV, covering letter, contact details, employment history and notes from any interview.
We do not need sensitive information, such as details of your health, to do our work. Please do not send it to us unless we ask for it.
4. How we use it, and why we are allowed to
UK data protection law only lets us use personal information where we have a lawful basis. The table sets out each use and the basis we rely on.
| What we use it for | Lawful basis |
|---|---|
| Answering your enquiry and preparing a quote | Steps you ask us to take before a contract. Where you enquire for a business, our legitimate interest in responding to it |
| Checking for conflicts of interest before accepting an instruction | Our legitimate interest in meeting our professional obligations and avoiding conflicts |
| Carrying out the work, keeping you updated and delivering reports | Performing our contract with you. Where our client is a business, our legitimate interest in working with its staff and advisers |
| Issuing design risk information to the project team where we act as a designer under CDM 2015 | Legal obligation (Construction (Design and Management) Regulations 2015) |
| Reviewing flood risk and drainage submissions for planning authorities and other public bodies | Our legitimate interest in providing that service. Where the authority’s contract makes us its processor, the authority is the controller and its own privacy notice applies |
| Recording phone calls | Our legitimate interest in keeping an accurate record of instructions, training staff and resolving disagreements |
| Invoicing, taking payment and keeping accounts | Legal obligation (tax and company law) |
| Recovering unpaid fees | Our legitimate interest in being paid for our work |
| Keeping project records, answering later queries and dealing with any claim or complaint about our work | Our legitimate interest in defending our work and meeting our professional indemnity insurance terms |
| Describing projects in de-identified case studies and other marketing | Our legitimate interest in showing the work we do |
| Website analytics, session recording and advertising | Your consent, given through the cookie banner. You can withdraw it at any time |
| Stopping spam on our website forms | Our legitimate interest in keeping the website secure |
| Considering a job application | Steps you ask us to take before an employment contract |
Where we rely on legitimate interests, we have weighed them against your interests and rights, and you can object (section 10).
Case studies may name the town, but never the address, the site name or anything else that would reasonably identify you or the property. If you do not want your project described at all, tell us in writing at any time before it is published.
We do not send marketing emails or newsletters. We do not sell personal information, and we do not make decisions about you by automated means alone.
5. Reports for planning applications are public
If our report supports a planning application, the local planning authority will normally publish it on its website with the rest of the application. That usually includes the site address, and can include the applicant’s name.
We keep personal details in reports to what the work needs. If there is anything in a report that you do not want made public, tell us before it is submitted.
6. Who we share it with
We only share personal information where we need to, and never sell it.
Organisations that provide services to us. They act on our instructions, under contract, and may not use your information for their own purposes except where noted:
- Microsoft (email, documents and file storage)
- our website host and developer
- Fluent (our phone system and call recordings)
- Xero (accounting and invoicing)
- Stripe (card payments)
- Google (website analytics and advertising) and Microsoft Clarity (website session recording), only where you have consented. Google and Microsoft also use this data under their own privacy policies, for example to measure and show adverts
- OpenAI and Anthropic (AI tools, see below)
Specialist subconsultants. Where a job needs one, for example for hydraulic modelling, hydrogeology or a survey, we share the site details and contact information they need for that part of the work. We remain responsible for their work.
The rest of the project team. Where the work needs it, your architect and other consultants and, once appointed, the principal designer and principal contractor, including the design risk information we issue under CDM 2015.
Public bodies, when we act for you. Local planning authorities, lead local flood authorities, the Environment Agency, water companies, Internal Drainage Boards, highway authorities and other consultees, when we submit or discuss work on your behalf.
Parties named in a reliance letter. If you ask us to extend reliance on a report to a lender, insurer or other named party, we share the report with them.
Others, where required. Our professional advisers and insurers, HM Revenue & Customs, regulators, the police or a court where the law requires it, and a prospective buyer of our business, who must keep it confidential.
AI tools. We use specialist software, automated data screening and AI tools to help draft, check and organise our work. Our AI tools run on business accounts with ChatGPT (OpenAI) and Claude (Anthropic), which act as our processors under contract and do not use our data to train their models. A consultant reviews every report and output before it is issued, and we remain responsible for the work.
7. Transfers outside the UK
Some of the organisations in section 6 store or process information outside the UK, mainly in the United States. Where they do, the transfer is protected in one of two ways: the UK government has confirmed that the country, or the US company under the UK–US data bridge, protects personal information adequately; or the provider has signed the UK’s approved contract terms for international transfers. Ask us if you would like more detail on a particular provider.
8. How long we keep it
We keep personal information only as long as we need it for the reason we collected it, then securely delete it or remove anything that identifies you.
| Information | How long we keep it |
|---|---|
| Enquiries and quotes that do not lead to work | 3 years from the quote |
| Reports, calculations, drawings and models | 15 years from the end of the project |
| Other project files and correspondence | 6 years from the end of the project |
| Invoices and accounting records | 6 years from the end of the financial year they relate to |
| Phone call recordings | 12 months from the call |
| Website analytics (Google Analytics) | 14 months |
| Website session recordings (Microsoft Clarity) | 30 days, or up to 13 months for a small sample Clarity keeps |
| Job applications that are unsuccessful | 6 months after the role is filled |
Reports and the calculations behind them are kept longer than other files because questions and claims about professional advice can arise many years after the work. Before the end of these periods, we do not return or delete project records on request, except where data protection law requires us to.
If you join Unda, your application becomes part of your employee record. We may keep information for longer than shown if it relates to a complaint, claim or legal requirement that is still open.
9. Keeping it secure
Your information is held in the business systems listed in section 6, under contracts that keep it confidential and secure, and only Unda staff who need it for their work can access it. Job applications sent to careers@unda.co.uk are seen only by Unda’s directors, unless you are invited to interview.
We will never change our bank details by email. If you receive a message asking you to pay a different account, do not pay it; call us on 01293 214444 to check.
If something goes wrong and it is likely to put you at high risk, we will tell you without delay.
10. Your rights
You have the right to:
- see the personal information we hold about you and get a copy of it
- correct information that is wrong or incomplete
- have it deleted, where we no longer have a good reason to keep it (project records are normally still needed for the periods in section 8)
- restrict how we use it, for example while a correction is checked
- object to us using it where we rely on legitimate interests, including in case studies
- take it with you, in a common electronic format, where we use it under a contract or your consent
- withdraw your consent at any time, where we rely on it (for website cookies, change your choices on our Cookie Policy page)
To use any of these rights, contact privacy@unda.co.uk. There is normally no charge. We will reply within one month, or tell you within that month if a complex request needs up to two more. We may need to confirm who you are before we act on a request.
11. Complaints
If you are unhappy with how we have handled your personal information, please tell us first, at privacy@unda.co.uk or on 01293 214444. We will acknowledge your complaint within 5 working days, look into it, keep you informed, and give you a full response within 20 working days, or tell you why it needs longer. Complaints about our service more generally go to complaints@unda.co.uk, under clause 17 of our Terms of Business.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection:
- Online: ico.org.uk/make-a-complaint
- Phone: 0303 123 1113
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
12. Cookies, our terms and changes to this policy
Our Cookie Policy lists the cookies our website uses and lets you change your choices.
Clause 14 of our Terms of Business covers how we handle client information and project records, and refers to this policy.
We will update this policy when the way we handle personal information changes. The date it was last updated is shown at the end of this policy.
Last updated: 7th October 2026
