Privacy Policy

1. Who We Are

Arbtech Consulting Ltd is a UK-based ecological consultancy. We are the data controller for personal data processed through our survey platform and associated services.

Registered in England and Wales. If you have any questions about this policy or how we handle your data, please contact us using the details at the bottom of this page.

2. What Data We Collect

We collect and process the following categories of personal data:

• Account information: your name, email address, and password (stored securely via Firebase Authentication)
• Survey data: ecological survey records, site assessments, habitat data, species records, photographs, and associated field notes that you create within the platform
• Location data: GPS coordinates and site boundary information recorded during surveys
• Usage data: log data, device type, app version, and error reports used to maintain and improve the platform
• Communications: messages you send us, including bug reports or support requests

3. How We Use Your Data

We use your personal data for the following purposes:

• To provide, operate, and maintain the ecological survey platform
• To generate survey reports and documents on your behalf
• To authenticate your identity and manage your account
• To diagnose technical problems and improve the reliability of the platform
• To communicate with you about your account or our services
• To comply with legal obligations

4. Legal Basis for Processing

We process your personal data on the following legal bases under UK GDPR:

• Contract: processing necessary to provide the platform services you have signed up for
• Legitimate interests: maintaining platform security, preventing fraud, and improving our services
• Legal obligation: where we are required to process data to comply with applicable law
• Consent: where you have given specific consent, which you may withdraw at any time

5. Data Storage and Security

Your data is stored securely using Google Firebase (Firestore, Firebase Storage, and Firebase Authentication), hosted in Google Cloud data centres within the European Economic Area. Google Cloud is certified to ISO 27001 and SOC 2 standards.

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, or disclosure, including:

• Encrypted data transmission (TLS/HTTPS)
• Firebase Security Rules restricting data access to authorised users
• Firebase App Check to prevent unauthorised API access
• Role-based access controls within the platform

6. Data Sharing

We do not sell your personal data. We may share data with the following categories of third parties where necessary to operate the platform:

• Google Firebase / Google Cloud Platform – cloud infrastructure and authentication services
• Google Gemini / AI services – used to assist with automated report generation (data is processed but not retained for model training)
• Atlassian Jira – used internally to manage bug reports and support requests

All third-party processors are bound by data processing agreements and are required to protect your data in accordance with applicable law. We may also disclose data where required by law, court order, or regulatory authority.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide our services. Survey data is retained for the duration of your engagement with us and may be kept for up to 7 years thereafter to comply with professional and legal obligations applicable to ecological consultancy.

You may request deletion of your account and associated data at any time, subject to any legal retention obligations.

8. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you
• Rectification: request correction of inaccurate or incomplete data
• Erasure: request deletion of your personal data in certain circumstances
• Restriction: request that we limit processing of your data
• Portability: receive your data in a structured, machine-readable format
• Objection: object to processing based on legitimate interests
• Withdraw consent: where processing is based on consent, withdraw it at any time

To exercise any of these rights, please contact us using the details below. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

9. Cookies and Tracking

Our platform is primarily a mobile and web application. We use essential session cookies required for authentication and platform operation. We do not use advertising or marketing cookies, and we do not use third-party tracking or analytics services beyond Firebase Analytics, which is configured to anonymise IP addresses.

10. Changes to This Policy

We may update this privacy policy from time to time. Where changes are material, we will notify users via the platform or by email. The date at the top of this page reflects when the policy was last updated. Continued use of the platform after changes take effect constitutes acceptance of the updated policy.