Privacy Policy

Who we are

P&B Perspective Ltd (we, us, our) is the controller for the personal data described in this policy. We operate the O&M Manuals platform at om-manuals.co.uk and we are registered in England and Wales.

Privacy contact: patrick@om-manuals.co.uk. Write to that address for anything in this policy, including any of the rights set out below.

What personal data we collect

When you send the enquiry form

If you complete the enquiry form on this site, we record the information you type and a small amount of technical information about how you arrived:

your company name;
your name, job title and work email address;
your telephone number, if you choose to give one - it is optional;
the project name or reference you give;
your trade, and the optional free-text detail if you pick another trade;
your handover deadline and your client deadline;
which categories of file you already have, and the optional free-text detail if you pick another category;
your message, if you write one - it is optional;
your confirmation that your team will author the handover;
the campaign information carried in the link you followed (five campaign fields), the intent of the page you started from, the route you landed on, and the hostname that referred you - not the full referring address;
a salted, one-way hash of your IP address, used to rate-limit abuse. We do not store the IP address itself.

We ask you not to put passwords, access codes, payment details, building-security details, special-category data or confidential file contents into the form, and the form says so above the submit button.

Cookieless measurement on the public pages

We keep a first-party count of how the public pages are used. It is deliberately narrow. Each entry holds only: the name of the event, taken from a fixed internal list; the path of the page, with any query string and fragment removed before it is stored; three campaign fields (source, medium and campaign); and the time. There is no field for your IP address, your browser, a referring address, an account, or any identifier that could link one entry to another or to you.

If you use the platform itself

Account data: name, email address and role, recorded when a workspace administrator invites you.
Manual content: any personal data inside the O&M manual content a workspace uploads, such as contact names, telephone numbers or photographs. For that content the workspace is the controller and we act as its processor.
Usage data: per-project view counts and a last-accessed date. We do not track individual people through the product.
Technical data: server and email-delivery logs, which include IP address, user agent and request path.

Why we use it, and our lawful bases

To receive, assess and answer your enquiry. Where you are asking us to take steps before entering a contract, Article 6(1)(b) UK GDPR. Otherwise our legitimate interests under Article 6(1)(f) in answering a genuine business enquiry.
To manage the opportunity and follow it up. Our legitimate interests in keeping an accurate business record, avoiding duplicate contact, honouring any restriction you ask for, and continuing a relevant discussion. Every marketing message keeps its opt-out.
To operate your account and deliver the service. Performance of our contract; our legitimate interests in administering the business; and our legal obligations where records must be kept.
To prevent fraud, abuse and security incidents. Our legitimate interests, using the minimum technical data that works.
To measure whether our public pages and campaigns work. Our legitimate interests in aggregate measurement, with the narrow data set described above and no reconstruction of any individual visit.
To send transactional email and keep a CRM record. The same basis as the enquiry, customer-service or record-keeping purpose it belongs to. Using a supplier to do this does not create a new purpose.

Where we rely on legitimate interests, we have weighed them against your rights, and they do not override them. Objections and opt-outs are applied and are not overridden by any of these interests.

Cookieless measurement is not behavioural analytics

The measurement described above is aggregate and cookieless. We do not operate session analytics, visitor identifiers, session replay, heatmaps, keystroke capture, advertising audiences or automated profiling, and we do not reconstruct an individual visitor's journey. Because there is no non-essential analytics technology on this site, there is nothing of that kind for you to consent to, and we do not ask you to.

Who else sees your data

We use the following recipients and suppliers today:

Render - application hosting and stored data. The live service runs in Render's EU region (Frankfurt). Render Privacy Policy.
Resend - delivery of enquiry notifications and service email. Resend Privacy Policy.
Google Workspace - our business correspondence, so any email exchange with us is held there.

Approved for later use, and not receiving anything yet. We are telling you about these in advance rather than after the fact. As things stand, no enquiry has been sent to either of them, and the only place your enquiry goes is our own stored record and the notification email described above.

HubSpot - intended to hold our CRM record of an enquiry and the email activity attached to it. This starts only once the connection has been set up and checked, and we will not send enquiries there before then.
Clay - approved for business-contact and company enrichment only, and it is not connected yet. When it is, it receives approved business-contact and company fields, the source of the record and any restriction on it. It never receives your enquiry message, your project details, uploaded material, payment data or customer manual content, and it never sends or enrols anyone.

We do not sell your personal data, and we do not make any decision about you that produces a legal or similarly significant effect using automated processing alone.

Where your data is held

The application and its stored data run in Render's EU region (Frankfurt). Our other suppliers may process data outside the UK. Where they do, we rely on the transfer safeguards those suppliers publish in their own terms. We describe here only what we have actually checked; we do not claim a region, safeguard or contractual arrangement we have not verified.

How long we keep it

Enquiries that do not convert, and their CRM record: 12 months after the last meaningful contact, then deleted or anonymised, unless a dispute, a legal duty or a suppression record requires us to keep a limited part for longer.
An optional telephone number, and the salted IP hash: 30 days, unless an abuse investigation or an active discussion you asked for is still running.
Customer account, contract and financial records: for the relationship, and up to six years afterwards where tax, accounting, contract or legal claims require it.
Customer-authored manual content: under the customer contract and the product's own retention controls, with export and deletion as the service terms describe.
Server and email-delivery logs: 30 days, or the shortest period the supplier makes available.
Cookieless measurement entries: 13 months, then deleted or irreversibly aggregated.
Enrichment working data at Clay, once that is connected: deleted within 30 days of the record being accepted or rejected. Nothing is held there today.
Suppression and objection records: kept as long as we need them to honour your objection, which means keeping the minimum identifier, the reason and the date. We review that need at least every 24 months.
Backups: removed on a rotation of at most 35 days. If we ever restore one, an operator re-applies the deletions and the suppression register before returning to normal running. This is a procedure a person runs, not an automatic step, and a suppression recorded after the backup was taken has to be re-entered from our own record of the request.

Stated plainly, because it is true today: we have built and tested the deletion routines for the periods above, and we run them ourselves. They are not on a timer. Nothing deletes automatically on a schedule, so a record can sit past its period until the routine is next run. The measurement store is append-only by design, so entries there are removed by a controlled rebuild rather than edited in place. We also act on any erasure request you make, and we do not widen what we collect.

Your rights

Under UK GDPR and the Data Protection Act 2018 you can ask us to:

give you a copy of the personal data we hold about you;
correct it if it is wrong;
erase it, where that right applies;
restrict how we use it, or object to our using it under legitimate interests;
give it to you, or to someone else, in a portable format.

Objecting to direct marketing is a separate and absolute right. You can tell us at any time to stop sending you marketing, for any reason or none, and we will stop. You do not have to justify it, we will not ask you to, and we will keep the minimum record needed to make sure the objection is honoured in future. Every marketing email also carries an opt-out.

To exercise any of these, email patrick@om-manuals.co.uk.

Complaints

If you think we have handled your data badly, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk.

Cookies

We use one strictly-necessary cookie to keep you signed in. We do not use analytics, advertising or tracking cookies. Our Cookie Policy sets out the detail.

Security

We use technical and organisational measures to protect your data, including encrypted connections (TLS), hashed passwords (argon2id), and access control enforced on every request.

Changes to this policy

We may update this policy. Where a change is material we will tell workspace administrators by email. The date at the top of this page is the date of the most recent revision.