Privacy notice

Revivio – Home Improvements & Renovations provides residential renovation and home improvement services in London.

Website: revivioldn.co.uk
Email: info@revivioldn.co.uk

If you have any questions about this Privacy Notice or how we use your personal information, please contact us using the email address above.

Contact information, including your name, email address, telephone number, company name where applicable, billing address and property address.

Enquiry and quotation information, including information you provide about your property, proposed works, requirements, budget, specifications and correspondence with us.

Project information, including project details, scope of works, areas of the property, programme information, selections, approvals, variations, project updates and completion information.

Client Portal information, including your account details, your project information, the documents and photographs we publish to your project, the project updates we post, and the selections, approvals and acknowledgements you submit. The Portal has no messaging or chat feature: what it records from you are the decisions you make on the items we ask you to decide.

Financial and transaction information, including quotations, invoices, payments received, outstanding balances and other information necessary to administer your project and our accounting records. The Client Portal does not take card payments and does not store payment-card details. Where we record a payment, we record the amount, the date, the method — a bank transfer, for example — and any reference.

Photographs and documents, including photographs of your property and the works, drawings, specifications, schedules and other documents supplied by you or generated during the project.

Technical information, including what is needed to keep your account and your project secure: your sign-in details, the session that signs you in, and records of activity on your project and on our commercial documents — who created or changed something, when, and what was sent, viewed or accepted. When a quotation is accepted online we also record the browser information sent with that request, together with a one-way cryptographic hash of the IP address it came from, as evidence of the acceptance; we do not store that IP address itself. Your IP address is necessarily handled by the platform that hosts and delivers the site in order to answer a request from your browser, in the ordinary way that any website works.

Website usage information, including information collected through cookies and through the advertising tag on our public website, where you have given the consent required for it. Section 11 sets out exactly what that covers.

• contact us by telephone, email, website form or another communication method;
• request a quotation;
• provide information during a site visit;
• accept a quotation or enter into a contract with us;
• use the Client Portal;
• provide photographs or documents to us;
• approve selections or variations, or acknowledge something we have asked you to confirm;
• arrange or make a payment; or
• otherwise communicate with us about your project.

Two notes on that list, so it is not read as claiming more than it does. Uploading is not something the Client Portal asks of you: photographs and documents are published to your project by Revivio and by the site manager, and anything you send us arrives by email or another channel and is filed against your project by us. And payments are arranged and made outside the Portal — the Portal shows you what is due and what has been received, and the button on that screen opens an email or a phone call to us. No payment is taken through it.

We may also receive relevant information from people involved in your project, such as another property owner, authorised representative, designer, architect, property manager or other professional. Where someone is recorded as a contact on your project, we hold their name, role, organisation, telephone number and email address for that purpose.

• respond to enquiries and arrange site visits;
• prepare, revise and send quotations;
• plan and deliver renovation and home improvement projects;
• communicate with clients;
• provide and operate the Client Portal;
• manage project programmes, scope, selections and approvals;
• record project progress;
• administer variations;
• create and manage invoices and payments;
• provide project documents and records;
• coordinate contractors, trades and suppliers where necessary;
• maintain appropriate business, accounting and tax records;
• protect the security and integrity of our website and Client Portal;
• prevent misuse, fraud or unauthorised access;
• comply with legal and regulatory obligations; and
• understand and improve our website and services.

UK data protection law requires us to have a lawful basis for processing personal information.

Depending on the circumstances, we generally rely on:

Contract — where processing is necessary to provide a quotation at your request, enter into a contract with you or carry out our contractual obligations.

Legitimate interests — where processing is reasonably necessary to operate and protect our business, communicate with clients, administer projects, improve our services and maintain appropriate business records, provided those interests are not overridden by your rights.

Legal obligation — where we need to process or retain information to comply with legal, tax, accounting or regulatory requirements.

Consent — where consent is specifically required, including for certain non-essential cookies and tracking technologies.

The appropriate lawful basis may vary according to the particular information being processed and the purpose for which it is used.

Clients may be provided with access to the Revivio Client Portal to help manage and follow their renovation project.

The Portal may contain information including:

• project details and progress;
• estimated programme information;
• project updates;
• photographs;
• documents;
• selections and approvals;
• variations;
• payment milestones, invoices and outstanding balances; and
• contact details for the people working on your project.

How access works

Portal accounts are created by invitation only — you cannot register yourself. Access is granted to a named email address against a specific project, and it is checked on our servers on every request rather than in your browser, so a Portal address cannot be opened by someone who has not been granted access to that project.

Access comes in two kinds. A client sees their own project and makes the decisions they are asked to make. A site manager working on your project sees the build and posts progress, and is not shown the financial side of it. We can suspend or withdraw either at any time, and that takes effect everywhere at once.

What the Portal deliberately does not do

Portal pages are not indexed by search engines, are not held in shared caches, and send no referrer information to anywhere you click through to. They carry no advertising or analytics tags at all: the advertising tag described in section 11 is on our public website only, and never behind the login.

Documents and photographs are not public files with hard-to-guess names. They are served through an endpoint that first checks who is asking, then checks the audience recorded against that individual document — so a document meant for you is refused to a site manager, and a file with no record behind it is refused to everyone.

A quotation we send you by email opens through a private link containing an unguessable token, rather than through the Portal. That page is not indexed, is not stored by shared caches, and sends no referrer, so the link cannot leak to a third party through anything on the page. The link can be given an expiry date and can be revoked. Please do not forward it.

We keep personal information for as long as it is needed for the purposes described in this notice, and no longer than is necessary.

In practice that means enquiry and quotation information is kept while an enquiry is live and for a reasonable period afterwards, in case it is picked back up. Project records — documents, photographs, selections, approvals, variations and the progress record — are kept for the life of the project and for a period after completion, because they are the record of what was agreed and what was done, and may be needed if a question about the works arises later. Accounting, invoicing and tax records are kept for the period we are required to keep them by UK law.

Where information is no longer needed, we delete it or archive it. Nothing in our systems deletes records automatically on a timer: retention is applied by us. If you would like your information removed, please contact us — see section 12.

We do not sell your personal information, and we do not share it for anyone else’s marketing. We do not operate a marketing mailing list.

We share personal information only where there is a reason to:

• Contractors, trades and suppliers working on your project, with the information they need for their part of it — typically the property address, access arrangements, the relevant part of the scope and the dates involved.
• Our service providers, who process information on our behalf and on our instructions. These are: the platform that hosts our website and the Client Portal, and which also provides the website enquiry form, the sign-in service, the database and the file storage behind them; the email service that sends your quotations, invoices and Portal invitations, which runs on our own domain; and our advertising provider, for the tag on our public website and only where you have consented to it.
• Professional advisers and authorities, such as our accountant or HMRC, where we are required or permitted to share information.
• Other people involved in your project, such as a co-owner, your authorised representative, or a designer, architect or property manager, where that is necessary to deliver the project.

Our website and the Client Portal, along with the database and file storage behind them, are provided by our hosting platform and delivered from its network.

Some of our providers, or their own sub-processors, may store or process personal information outside the United Kingdom. Where that happens, UK data protection law requires an appropriate safeguard to be in place — such as UK adequacy regulations, or the International Data Transfer Agreement or Addendum — and we rely on the arrangements our providers put in place for that purpose.

• Sign-in is handled by a managed identity service. We never see or store your password. Accounts are invitation-only, and a password must be at least eight characters.
• You are signed in by a session cookie set by the server. The pages themselves never handle a login token.
• Every request for project data is authorised on the server against the access you actually hold. Nothing about access is decided in your browser.
• Responses containing your project data are marked private and must not be stored by shared caches.
• Uploaded files are limited by size and file type, are served only through an authorised endpoint, are never held in shared caches, and are checked against the audience recorded for each document.
• Financial information is kept from site managers by the queries that fetch the data, so it is never sent to them in the first place, rather than being fetched and then hidden.
• Quotations and invoices are locked once accepted or issued, so the record of what was agreed cannot be edited afterwards. Changes are handled as variations instead.
• Actions on projects and on commercial documents are recorded in an append-only audit trail. What goes into it is chosen deliberately, so that request contents and private links do not end up sitting in a log.

No system can be guaranteed to be completely secure, and we do not claim otherwise. If you believe your Portal account has been accessed by someone else, please tell us straight away.

Our public website sets one strictly necessary first-party cookie to remember your cookie choice. It is called revivio_consent, it records only your choice and the day you made it, and it lasts about six months — after which we ask again rather than assume your answer indefinitely.

Everything else is off until you switch it on. Nothing in the analytics or advertising categories is loaded before you consent, and the consent signals are set before any tag runs, using Google Consent Mode. The categories are:

• Necessary — always on. Remembers the cookie choice you make, and lets the enquiry form submit securely and guard against spam. These do not track you and are not used for advertising.
• Analytics — off unless you allow it. Aggregated statistics about which pages people read and where they arrive from. Nothing here is used to contact you or identify you personally.
• Marketing and advertising — off unless you allow it. Lets us see which Google Ads brought someone to the site and whether an enquiry followed, and allows Google to use that visit for advertising audiences. Set by Google.

The only advertising tag on the site is a Google Ads tag. While advertising consent is denied, the advertising identifiers in what it sends are redacted. You can change or withdraw your choice at any time using Cookie Settings in the footer of any page on the public website.

The Client Portal, the sign-in page and the private quotation page carry no cookie banner and no advertising or analytics tags, because they set none of those cookies. The only cookie in use behind the login is the one that keeps you signed in.

• ask for access to the personal information we hold about you;
• ask us to correct information that is inaccurate or incomplete;
• ask us to delete information where there is no longer a reason for us to keep it;
• ask us to restrict how we use your information, or object to our using it where we rely on legitimate interests;
• ask us to transfer certain information to you or to another organisation in a portable form; and
• withdraw your consent at any time where we rely on consent, including for non-essential cookies.

These rights are not absolute. Where we are required by law to keep something — accounting and tax records in particular — or where we need it as the record of a contract, we may not be able to delete it, and we will explain why if that is the case.

To exercise any of these rights, email info@revivioldn.co.uk. We will respond within one month, and we do not charge a fee in ordinary circumstances.

We may update this notice from time to time, to reflect changes to how we work, to the Client Portal, or to legal requirements. The date at the top of this page shows when it was last updated, and the current version is always the one published here. Where a change is significant, we will take reasonable steps to tell affected clients.

For anything to do with this notice or your personal information, email info@revivioldn.co.uk or call 020 4614 7891.

If you are unhappy with how we have handled your personal information, please tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection, at ico.org.uk or on 0303 123 1113.