Privacy Policy
What we collect, why we collect it, who we share it with, and how long we keep it. Written to be read rather than to be defensible.
Template, not legal advice. This document is a structural starting point. Have your counsel review and complete it — particularly the data-transfer, retention and jurisdiction clauses — before you publish.
01Who we are
The Builders Desk provides remote back-office support services to US design and construction companies. Our head office is at 4500 Forbes Blvd., Lanham, MD 20706, USA. Our support professionals are our own employees.
For questions about this policy or how we handle your information, contact privacy@thebuildersdesk.net. If you are in the EEA or UK, our data protection contact is reachable at the same address.
02Information we collect
When you contact us, we collect the details you provide: name, work email, telephone number, company, the role you are enquiring about, and the content of your message. We collect this because we cannot respond to an enquiry without it.
When you use our website, we collect standard technical information including IP address, browser and device type, referring page, and pages viewed. We use privacy-respecting analytics and do not build advertising profiles.
If you apply for a role with us, we collect the information in your application together with anything you disclose during screening, including work history, education and, where local law permits, background check results.
As part of delivering services to a client, we may process information about that client's own personnel or customers. In those cases we act as a processor on the client's instructions, and the client's own privacy notice governs that information.
03How we use it
To respond to enquiries, scope engagements, and provide the services set out in your agreement with us. To administer employment and contractor relationships. To meet legal, tax and regulatory obligations. To secure our systems and investigate misuse.
We do not sell personal information, and we do not share it with advertising networks or data brokers.
We send commercial email only to people who have asked us to. There is no automatic newsletter subscription attached to our contact form.
04Legal bases
Where the UK GDPR or EU GDPR applies, we rely on: performance of a contract, for delivering our services; legitimate interests, for responding to business enquiries and securing our systems; consent, for optional communications, which you may withdraw at any time; and legal obligation, where retention or disclosure is required by law.
Where Nigerian law applies, we process personal data under the Nigeria Data Protection Act 2023 on the equivalent bases: performance of a contract, our legitimate interests, your consent, and compliance with a legal obligation.
Most of our processing of your information is contractual: we hold it because you asked us to do something, or because we are delivering a service you are paying for. Where we rely on legitimate interests, you may object and we will stop unless we have a compelling reason not to.
06International transfers
We operate from two locations: Lanham, Maryland in the United States, and Life Camp, Abuja in Nigeria. Personal information you give us, and client information we process on a client's instructions, is accessible from both. This is not incidental — our professionals in Abuja are the people delivering the work.
Where personal data originating in the EEA or UK is transferred to either location, we rely on the UK International Data Transfer Addendum or EU Standard Contractual Clauses as applicable, together with the supplementary measures described under Security below.
If you are a US client and your data will be accessible from Nigeria, we say so plainly rather than burying it. Our Data Processing Addendum sets out the specifics for your engagement, and we will provide it on request before you commit.
07Retention
We keep enquiry records for 24 months from last contact. Client records are kept for the duration of the agreement plus the period required by tax and limitation law. Unsuccessful applicant records are kept for 12 months unless you ask us to delete them sooner.
Signed agreements and their signature records are kept for the life of the relationship and for six years afterwards, because that is how long a contractual claim can be brought in most of the jurisdictions we work in.
Files you upload to the client portal are kept for the duration of your engagement and for 12 months afterwards, so that a dispute about what was delivered can be settled. You may ask us to delete them sooner and we will, unless we are required to retain them.
08Your rights
Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, restrict or object to certain processing, receive a portable copy, and withdraw consent.
To exercise any of these, email privacy@thebuildersdesk.net. We will respond within one month, or tell you if we need longer and why. We will not charge you for a request or treat you differently for making one.
If you are unhappy with our response, you may complain to your local supervisory authority. In the UK that is the Information Commissioner's Office.
09Security
We maintain administrative, technical and physical safeguards appropriate to the information we hold, including encryption in transit and at rest, least-privilege access control, multi-factor authentication, managed and monitored endpoints, and annual penetration testing.
No system is perfectly secure. Our current control set and compliance status, including what we have not yet completed, are published in our Trust Center.
11Changes
We will update this policy when our practices change. Material changes will be notified to clients by email and reflected in the date at the top of this page. Previous versions are available on request.