Privacy Policy

PlanPost respects your privacy and is committed to handling personal data lawfully, fairly, and transparently under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy explains what personal data we collect, why we collect it, how we use it, and what rights you have.

1. Who we are

PlanPost is a B2B platform that helps UK building contractors find and contact homeowners who have recently received planning permission.

For the purposes of UK GDPR, PlanPost is the data controller for the personal data described in this policy.

• Registered address: Flat 7, 455–455A New Cross Road, London, SE14 6TA
• ICO registration number: [ZA###### — to be added]
• Data protection contact: sherif@joinplanpost.com

2. What personal data we collect

2.1 Homeowner data (from public planning portals)

We collect the following from publicly accessible UK local authority planning portals:

• Homeowner name (where published)
• Property address
• Planning application reference number
• Application type, description, and status
• Decision date and decision notice
• Agent or applicant contact details (where published)

Source: Data is collected exclusively from public planning portals operated by UK local authorities (councils). We do not purchase data, use third-party brokers, or collect data from private sources.

2.2 Builder (customer) data

When a builder signs up to PlanPost, we collect:

• Name, business name, email address, phone number
• Business address and trading details
• Payment information (processed by Stripe — we do not store full card details)
• Account activity, letter history, and subscription status
• IP address and device information for security and fraud prevention

2.3 Website visitor data

When you visit planpost.uk or joinplanpost.com, we collect:

• IP address, browser type, device information
• Pages visited and time spent
• Referrer URL and basic analytics data

3. Why we collect personal data (lawful basis)

3.1 Homeowner data — Legitimate interests (UK GDPR Article 6(1)(f))

We process homeowner data under the legitimate interests lawful basis. Our legitimate interest is to operate a marketplace that connects homeowners with local building contractors at a time when many homeowners are actively seeking building services (following a planning permission grant).

We have conducted a Legitimate Interests Assessment (LIA) balancing our interest against homeowner rights. Key factors:

• The data is already public on local authority portals
• Homeowners have a reasonable expectation that their recently approved planning application may attract commercial interest
• We only use the data to enable a single physical letter per builder, not mass marketing or digital intrusion
• Homeowners can opt out at any time (see Section 7)

You can request a copy of our full LIA by contacting us.

3.2 Builder data — Contract and legitimate interests

We process builder data to:

• Perform our contract with you (UK GDPR Article 6(1)(b)) — providing the PlanPost service
• Meet legal obligations (UK GDPR Article 6(1)(c)) — tax, accounting, anti-fraud
• Pursue legitimate interests (UK GDPR Article 6(1)(f)) — service improvement, security

3.3 Website visitor data — Legitimate interests

To operate a secure, functional website and understand how it is used.

4. How we use personal data

4.1 Homeowner data

• Display planning applications on the PlanPost platform to verified builders
• Generate personalised physical letters (postal mail only — we do not email or call homeowners)
• Track whether a letter has been sent, to enforce our "one letter per builder per homeowner" policy
• Delete data 90 days after a letter is sent, or after the retention period below

4.2 Builder data

• Provide access to the PlanPost platform
• Process subscription payments and letter credits
• Send service notifications, account updates, and relevant product communications
• Respond to support requests
• Detect and prevent fraud

5. Who we share personal data with

We share personal data only with the following categories of recipients, all of whom act as data processors under contract:

Where processors are located outside the UK, transfers are protected by UK International Data Transfer Agreements, the UK Addendum to EU Standard Contractual Clauses, or adequacy decisions.

We do not sell personal data to third parties.

6. How long we keep personal data

7. Your rights

Under UK GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — ask us to delete your data ("right to be forgotten")
• Restriction — ask us to limit how we use your data
• Objection — object to processing based on legitimate interests (including our processing of homeowner data)
• Portability — receive your data in a portable format
• Withdraw consent — where processing is based on consent

7.1 How to exercise your rights

Email sherif@joinplanpost.com with your request. Include enough information for us to identify you (typically your name and property address for homeowners, or your account email for builders).

We will respond within one month. There is no fee for most requests.

7.2 Homeowners — opt-out

If you are a homeowner and you do not want your planning data to appear on PlanPost or to receive letters from builders via our platform, email sherif@joinplanpost.com with:

• Your name
• Your property address
• The planning application reference (if known)

We will remove your record from our active database within 7 days and add your address to a suppression list so no future planning applications at that address are processed.

7.3 Complaints

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would appreciate the chance to resolve your concern directly first.

8. Security

We take appropriate technical and organisational measures to protect personal data, including:

• Encryption in transit (TLS) and at rest
• Row-level security on our database
• Access controls and authentication
• Regular security monitoring via Sentry
• Principle of least privilege for system access

No system is perfectly secure. In the event of a personal data breach likely to risk your rights and freedoms, we will notify the ICO within 72 hours and affected individuals without undue delay.

9. Cookies

We use essential cookies to operate the site and a small number of analytics cookies (Google Analytics) to understand how the site is used. See our Cookie Policy for details. Non-essential cookies require your consent on first visit.

10. Children

PlanPost is a B2B service for UK building contractors. We do not knowingly collect data from anyone under 18. If you believe we have collected data from a child, contact sherif@joinplanpost.com immediately.

11. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent change. Material changes will be notified to builders by email.

12. Contact and legal identity

For any privacy question: sherif@joinplanpost.com

PlanPost is a trading name of Mohamed Soltan, operating as a sole trader in the United Kingdom, registered with the Information Commissioner's Office under registration number [ZA###### — pending].