How we handle your data.

Who we are

This portal is operated by Ebury Engineering Ltd, trading as Ebury Fire Systems. Companies House registration 16942750. VAT 512 9580 88. Registered office 128 City Road, London EC1V 2NX. We are the data controller for the personal data described below.

Email hello@eburyfire.co.uk for any privacy question. Marked “Privacy” gets you to the right person first time.

What we collect

• Account & access. Your name, work email, and a record of every sign-in (timestamp, IP, browser) so we can detect and trace unauthorised access.
• Operational data on your sites. Site addresses, fire-safety device inventories, scheduled and completed visits, certificates we issue, log book entries, callouts you raise, and invoices we send. This is the data the portal is for.
• Payments. If you pay by card we hand you off to Stripe; we never see card numbers. If you pay by Direct Debit we hand you off to GoCardless; we store only the masked bank identifier (last four digits) and the account holder name.
• Communications. Emails you send us, callouts you raise via the portal, the audit trail of which documents you downloaded.

Why we hold it

We process this data under UK GDPR Article 6(1)(b) and (1)(c) — performing our contract with you, and meeting our regulatory obligations as a fire-safety contractor (BS 5839-1:2025 requires we keep service records, the Fire Safety Order 2005 requires you to be able to demonstrate compliance, and HMRC requires we keep invoices for seven years).

Who else sees it

• Supabase (EU-hosted Postgres + object storage) for the portal database and files.
• Resend for transactional email (sign-in links, invite emails, callout notifications).
• Stripe— for card payments only, only the minimum personal data needed to process the transaction.
• GoCardless— for Direct Debit only.
• Vercel hosts this portal application.
• Subcontracted fire-safety engineers we send to your sites, under a written subcontractor agreement that includes confidentiality.
• HMRC, our insurers, our auditors, the Building Safety Regulator and law enforcement — where required by law.

We never sell your data, never use it for marketing without your explicit opt-in, and never share it with anyone outside the list above without telling you first.

Where it lives

Customer-facing data is stored in Supabase’s EU-West region (London). Email passes through Resend (EU-West-1). Stripe and GoCardless are UK-incorporated.

How long we keep it

See our data retention schedule for the specific window per record type.

Your rights

Under UK GDPR you have the right to access, correct, port, restrict and (where applicable) erase the personal data we hold about you, and to object to processing. To exercise any of these, email hello@eburyfire.co.uk with “Privacy: subject access” in the subject line. We reply within one calendar month.

If you’re not happy with how we’ve handled your data, you have the right to complain to the Information Commissioner’s Office at ico.org.uk.

Cookies

The portal uses only the cookies it needs to keep you signed in (a session cookie scoped to portal.eburyfire.co.uk). No analytics cookies, no advertising cookies, no third-party tracking.