1. Who we are
BI22 I.T Consultancy Ltd (trading as CongruityDocs) ("we", "us", "our") is the data controller responsible for your personal data. We are a company registered in England and Wales, company number 10064896, ICO registration ZC206973. For any data protection matter, contact Privacy@congruitydocs.co.uk.
2. What this policy covers
This policy explains how we collect, use, store and protect personal data when you use the CongruityDocs client portal (portal.congruitydocs.co.uk), visit our website, or engage us for consultancy services. It also explains your rights under UK data protection law (the UK GDPR and the Data Protection Act 2018).
3. The personal data we collect
Information you give us
- Account details: your name and email address (required to create and use your account).
- Optional profile details: your company name, job title, industry, company size, website and phone number. These are never required — the portal works without them.
- Notification preferences: whether you would like to receive email notifications about your projects.
- Project information: the details of the work you ask us to carry out, and any documents or files you upload in connection with a project.
Information we collect automatically
- Authentication and session data, handled by our authentication provider, to keep your account secure.
- Basic technical and usage information necessary to operate and secure the service.
Payment information
Payments are processed by Stripe. We do not see, handle or store your full card details — these are handled directly by Stripe under their own security standards. We receive only confirmation of payment status and limited transaction details.
4. How we use your personal data
We use your personal data to:
- create and manage your account and provide access to the portal;
- deliver the consultancy services you request, communicate with you about your projects, and provide the resulting deliverables;
- send you notifications about the status of your work by email and through the portal;
- issue invoices and process payments;
- keep a record of the work we have carried out for you (see section 6);
- comply with our legal and regulatory obligations.
5. Our legal bases for processing
Under the UK GDPR, we rely on the following legal bases:
- Contract: to provide the services you have engaged us for.
- Legitimate interests: to operate, secure and improve our service, and to keep a record of work carried out.
- Consent: for any optional communications, where you have opted in. You can withdraw consent at any time.
- Legal obligation: where we must retain certain records (for example, financial records for tax purposes).
6. How long we keep your data
Documents you send us are deleted within 90 days of delivery of your work, or earlier at your request.
We do not retain the source documents, files or materials you upload beyond this period, and you can request earlier deletion at any time through the portal. Every deletion is recorded.
We do keep a limited record of the engagement itself — your account details, the description of what you asked us to do, and what we delivered — so that both you and we have a record of the work carried out, should either party need to confirm it. This record does not include the source documents you uploaded.
Exception — financial records: we are required by law to retain invoicing and payment records for approximately six years for tax and accounting purposes.
7. Where your data is stored and processed
We use the following service providers (processors) to operate the portal. Where they store and process data is set out below.
- Authentication: Clerk — USA; safeguarded by Standard Contractual Clauses, the UK Addendum, and EU-US Data Privacy Framework certification.
- Database and document storage: Supabase — United Kingdom (London, eu-west-2); no international transfer.
- Document upload handling: Uploadcare — USA; safeguarded by Standard Contractual Clauses and the UK International Data Transfer Addendum.
- Document conversion: CloudConvert — Germany; processing pinned to the EU region, covered by UK adequacy regulations.
- Email notifications: Resend — USA; safeguarded by Standard Contractual Clauses and the UK Addendum.
- Payments: Stripe Payments Europe Ltd, Ireland; covered by UK adequacy regulations.
- Application hosting: Vercel — USA; safeguarded by Standard Contractual Clauses and the UK Addendum.
Where any provider processes data outside the UK, we ensure appropriate safeguards are in place (UK/EU adequacy, or Standard Contractual Clauses with the UK International Data Transfer Addendum).
8. Who we share your data with
We do not sell your personal data. We share it only with the service providers listed above, strictly to operate the service, and where required by law. All providers are bound by data processing agreements requiring them to protect your data.
9. How we protect your data
- Access to the portal is protected by secure authentication.
- Personal data is encrypted in transit (TLS) and at rest.
- Documents are stored in private, access-controlled storage with row-level security on the database.
- Deliverable previews are watermarked, and the clean version is withheld until payment is confirmed (or the engagement is agreed as complimentary).
- We delete source documents within 90 days of delivery (earlier on request), minimising the data we hold.
10. Your rights
Under UK data protection law you have the right to:
- access the personal data we hold about you;
- ask us to correct inaccurate data;
- ask us to delete your data (subject to legal retention requirements such as financial records);
- restrict or object to certain processing;
- request a copy of your data in a portable format;
- withdraw consent for optional communications at any time.
To exercise any of these rights, contact us at Privacy@congruitydocs.co.uk. If you are unhappy with how we have handled your personal data, you can also complain directly to us at the same address: we will acknowledge your complaint within 30 days and respond without undue delay. You additionally have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113 at any time.
11. Changes to this policy
We may update this policy from time to time. Where changes are significant, we will notify you. The version number and date at the top show when it was last revised.
BI22 I.T Consultancy Ltd (trading as CongruityDocs) · Company number 10064896 · ICO registration ZC206973
Data protection contact:
Privacy@congruitydocs.co.uk