Privacy Policy
Version 2.0 | Effective date: 23 October 2018 | Last reviewed 18 September 2025
1. About this notice
ZED PODS Limited ("ZED PODS", "we", "us", "our") designs, manufactures and delivers modular affordable homes. We take the privacy of the people we work with seriously, and this notice explains how we collect, use, share and protect personal data.
This notice tells you:
-
what personal data we collect and where it comes from;
-
why we use it and the legal basis we rely on;
-
who we share it with, and whether it leaves the UK;
-
how long we keep it;
-
what rights you have, and how to exercise them or complain.
We are the data controller for the personal data described in this notice. That means we are responsible for deciding how and why it is used.
We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025, and the Privacy and Electronic Communications Regulations 2003 (PECR).
2. Who this notice covers
This notice applies to you if you are:
-
a visitor to our website at zedpods.com;
-
someone who contacts us or makes an enquiry, including through our enquiry form or brochure download;
-
a client, or a representative of a client — including local authorities, housing associations, developers and their advisers;
-
a job applicant or someone who sends us a speculative CV;
-
a supplier, subcontractor, consultant or professional partner, or an employee of one;
-
a resident, occupier or neighbour of a scheme we have designed, built or maintain;
-
a visitor to our offices, factory or a construction site we operate.
If you are an employee or worker of ZED PODS, your personal data is covered by our separate internal staff privacy notice, available from Connie Jenion.
3. What we collect, why, and our legal basis
We only collect personal data we actually need. The tables below set out what we collect about each group of people, why, and the lawful basis under Article 6 UK GDPR that permits it.
3.1 Website visitors
What we collect
IP address, approximate location, browser and device type, operating system, referring website
Pages viewed, time on page, links clicked, downloads, and other usage data collected through analytics cookies
Your cookie preferences
Why
To keep the site secure, prevent abuse, and make sure it displays correctly
To understand how the site is used and improve it
To remember what you have and have not agreed to
Lawful basis
Legitimate interests — operating a secure, functioning website
Consent (for the cookies), then legitimate interests for the analysis
Legal obligation (PECR)
Analytics and other non-essential cookies are only set after you agree through our cookie banner. See section 4.
3.2 Enquirers and prospective clients
When you complete our enquiry form or contact us directly, we collect:
What we collect
Name, email address, telephone number, organisation and job role
Details of your site or scheme — site address and postcode, site status, number of units, unit mix, project timeline, and any site maps, plans or documents you upload
Correspondence with us, and notes of calls and meetings
Why
To identify you and respond to your enquiry
To assess feasibility and prepare a response, proposal or quotation
To keep an accurate record of what was discussed and agreed
Lawful basis
Legitimate interests, or performance of a contract / taking steps prior to entering into one
Legitimate interests, or steps prior to entering into a contract
Legitimate interests — managing our business relationships
Where an enquiry becomes a project, this information is used to deliver it. Note that documents you upload — such as site plans or surveys — may incidentally contain personal data about third parties; we ask that you only send us what is necessary.
3.3 Clients and project delivery
What we collect
Contact details and role of client representatives, consultants and their staff
Project correspondence, meeting minutes, approvals, instructions and variations
Signatories' names and signatures on contracts and certificates
Billing contacts, payment and invoicing details
Design, handover and building safety records that identify individuals
Why
To deliver the project, communicate and manage the contract
To manage delivery and keep an auditable record
To execute and evidence agreements
To invoice and be paid, and to meet accounting duties
To comply with construction, building safety and warranty duties
Lawful basis
Performance of a contract, or legitimate interests where the contract is with your employer
Performance of a contract; legitimate interests
Performance of a contract; legal obligation
Performance of a contract; legal obligation
Legal obligation (including the Building Safety Act 2022); legitimate interests
3.4 Marketing and brochure downloads
What we collect
Name, email address, organisation and role given when downloading our brochure or requesting information
Records of what we sent you, whether it was opened, and links clicked
Your marketing preferences and any objection or unsubscribe
Why
To send you the material requested and, where appropriate, follow up about our products and services
To measure whether our communications are useful and avoid contacting you unnecessarily
To respect your choices
Lawful basis
Legitimate interests where you are a business contact at a corporate organisation; consent or the PECR "soft opt-in" where you are an individual or sole trader
Legitimate interests; consent where required
Legal obligation; legitimate interests
You can opt out at any time. Every marketing email includes an unsubscribe link, or you can email projects@zedpods.com and we will stop. Unsubscribing does not affect emails we need to send you about a live project or contract.
3.5 Job applicants
What we collect
Name, contact details, CV, covering letter, employment and education history, qualifications and professional memberships
Interview notes, assessment or test results
References
Right to work documentation, including passport or immigration details
Information about a disability or health condition, where you tell us or where we need to make adjustments
Equal opportunities monitoring information, where you choose to give it
Criminal records information, where a role requires it
Why
To assess your suitability and manage recruitment
To make and evidence a fair selection decision
To verify your history before an offer is confirmed
To confirm you can lawfully work in the UK
To make reasonable adjustments to the recruitment process and workplace
To monitor and improve the diversity of our recruitment
To assess suitability for specific roles
Lawful basis
Legitimate interests; steps prior to entering into a contract
Legitimate interests
Legitimate interests
Legal obligation
Legal obligation (Equality Act 2010), with the special category condition at Schedule 1 Part 1 DPA 2018 (employment)
Legitimate interests, with the special category condition at Schedule 1 Part 2 DPA 2018 (equality of opportunity). This is voluntary, anonymised where possible, and never used in selection decisions
Legal obligation or legitimate interests, with a Schedule 1 DPA 2018 condition and an appropriate policy document in place
If you are unsuccessful, we will ask whether we may keep your details to tell you about future openings. If you say no, we delete them at the end of the retention period in section 7.
3.6 Suppliers, subcontractors and professional partners
What we collect
Contact details, role, and company information for you and your staff
Due diligence, accreditation, insurance and competency information — including CSCS or equivalent cards, trade qualifications and training records
Bank details and payment records
Modern slavery, anti-bribery and sanctions screening records
Why
To procure goods and services and manage the relationship
To confirm competence and meet our duties as a client or principal contractor
To pay you
To meet our legal and supply chain duties
Lawful basis
Performance of a contract; legitimate interests
Legal obligation (CDM Regulations 2015); legitimate interests
Performance of a contract; legal obligation
Legal obligation; legitimate interests
3.7 Residents, occupiers and neighbours of our scheme
What we collect
Name, address, contact details
Defect reports, service and maintenance records, warranty claims
Correspondence, complaints, and records of consultation or engagement
Health and safety incident records
Why
To arrange access, handover, aftercare and remedial works
To investigate and resolve issues and honour warranties
To respond properly and keep a record
To investigate incidents and comply with reporting duties
Lawful basis
Legitimate interests; performance of a contract with your landlord or developer
Legitimate interests; legal obligation
Legitimate interests; legal obligation where planning conditions require it
Legal obligation (including RIDDOR); vital interests in an emergency
In most cases we act as a contractor or manufacturer for your landlord, developer or local authority. Where they decide how your data is used, they are the controller and their privacy notice will also apply.
3.8 Visitors to our premises and sites
What we collect
Name, organisation, vehicle registration, arrival and departure times, and emergency contact details
CCTV footage at construction site
Site induction and safety briefing records
Why
To manage access, account for everyone on site in an evacuation, and keep our premises secure
To protect people and property and deter and investigate crime
To evidence that we have discharged our health and safety duties
Lawful basis
Legal obligation (health and safety); legitimate interests
Legitimate interests; legal obligation
Legal obligation
3.9 Where our information comes from
Most personal data we hold comes directly from you. We also obtain it from:
-
your employer or organisation, where they put you forward as a contact;
-
our clients and their consultants, on project matters;
-
publicly available sources such as Companies House, planning portals, professional registers and organisation websites;
-
recruitment agencies, job boards and referees, in relation to job applications;
-
credit reference, sanctions and due diligence providers, in relation to suppliers and clients;
-
our website analytics and, where you have agreed, cookies.
4. Cookies and similar technologies
Cookies are small files placed on your device. We also use similar technologies such as pixels, tags and local storage. Together we call these "cookies".
We only set non-essential cookies with your consent. When you first visit zedpods.com you will see a cookie banner. You can accept all, reject all, or choose which categories to allow. Rejecting non-essential cookies will not stop you using the site. You can change your mind at any time via the "Cookie settings" link in our website footer, or by clearing cookies in your browser.
4.2 Analytics
We use Google Analytics 4, provided by Google Ireland Limited, to understand how visitors use our website — for example which pages are most read and how people find us. Analytics cookies are only set if you consent.
We have configured Google Analytics to anonymise / truncate IP addresses and disable google signals and ads personalisation. We do not use Google Analytics data to target advertising at you, and we do not sell it. Analytics data is retained for 14 months, after which it is deleted automatically.
You can also opt out of Google Analytics across all websites using Google's browser opt-out add-on. Google's own privacy notice is at policies.google.com/privacy.
5. Who we share your data with
Cookies are small files placed on your device. We also use similar technologies such as pixels, tags and local storage. Together we call these "cookies".
We never sell your personal data. We share it only where there is a proper reason to, with:
-
Our website host and IT providers — for hosting, email, file storage, backup and support;
-
Google — for website analytics, where you have consented;
-
Our email providers — to manage enquiries and send communications you have asked for;
-
Professional advisers — solicitors, accountants, auditors and insurers, where needed for advice, claims or audits;
-
Clients, developers, local authorities and housing associations — where necessary to deliver a project;
-
Design consultants, subcontractors, manufacturers and installers — where necessary to deliver a project;
-
Building control bodies, warranty providers, planning authorities and regulators — where required for approvals, certification or building safety records;
-
Recruitment agencies, referees and right-to-work or DBS checking services — in relation to job applications;
-
Banks and payment processors — to make and receive payment;
-
Law enforcement, courts, HMRC and other public bodies — where we are legally obliged, or where it is necessary to establish, exercise or defend legal claims;
-
A buyer or successor — if we sell or reorganise all or part of our business, subject to appropriate confidentiality protections.
Where a third party processes personal data on our behalf, we put a written contract in place requiring them to keep it secure, use it only on our instructions, and not use it for their own purposes.
6. Sending data outside the UK
We are based in the UK and store personal data here wherever we can. Some of our providers — including Google and certain cloud and email services — process data outside the UK, including in the European Economic Area and the United States.
Whenever personal data leaves the UK, we make sure one of the following protections applies:
-
the country has UK adequacy regulations, meaning the government has decided it offers an equivalent standard of protection (this includes the EEA);
-
the recipient is certified under the UK Extension to the EU–US Data Privacy Framework;
-
we have entered into the International Data Transfer Agreement (IDTA) or the UK Addendum to the European Commission's standard contractual clauses, supported by a transfer risk assessment; or
-
another safeguard permitted by the UK GDPR applies.
You can ask us for details of the safeguard used for a particular transfer, and for a copy of the relevant clauses, by contacting projects@zedpods.com
7. How long we keep your data
We keep personal data only as long as we need it. Where the law sets a minimum period, we follow it; otherwise we apply the periods below and then securely delete or anonymise the data.
What we collect
Enquiries that do not proceed
Client and project records
Building safety, design and handover information
Resident aftercare, defect and warranty records
Marketing contacts and preferences
Unsuccessful job applications
Right to work checks
Supplier and subcontractor records
Accounting and tax records
Health and safety and accident records
Visitor and site access logs
CCTV footage
Website analytics
Records of data protection requests and complaints
Why
24 months from last contact
12 years after practical completion or the end of the contract
15 years
Duration of the warranty plus 1 years
Until you unsubscribe, and reviewed every 24 months
6 months after the decision, or up to 12 months if you agree to be kept on file
Duration of employment plus 2 years
6 years after the end of the relationship
6 years plus the current financial year
3 years from the date of the incident, longer for RIDDOR reportable or exposure records
12 months
31 days, unless retained for a specific incident
14 months in Google Analytics
3 years from closure
Lawful basis
To pick up a conversation if the scheme is revived, and to understand our pipeline
Contractual limitation periods, including contracts executed as deeds
Building Safety Act 2022, Defective Premises Act 1972 limitation periods and warranty obligations
To honour warranties and handle claims
To respect your choices and avoid holding stale data
To answer queries or a discrimination claim, and to consider you for future roles
Home Office guidance
Limitation periods and audit
Companies Act 2006 and HMRC requirements
RIDDOR and other health and safety law
Security and evacuation records
Proportionate to the security purpose
To compare year-on-year performance
To evidence how we handled them
8. How we protect your data
8.1 Our certifications
Cyber Essentials. ZED PODS is certified under the UK Government-backed Cyber Essentials scheme, which is overseen by the National Cyber Security Centre and administered by IASME. Our certification covers our whole organisation, was issued on 8 April 2026 by Lucidica, an accredited certification body, and is valid until 8 April 2027, when we recertify. Certificate number d3a925d3-17aa-47c5-b64b-7ac3417fc3d7.
ICO registration. We are registered with the Information Commissioner's Office as a data controller under registration reference ZA784674, and we pay the annual data protection fee.
8.2 Our wider measures
Alongside certification, we take appropriate technical and organisational measures to keep personal data secure, including:
-
access controls, so staff only see the data they need for their role;
-
encryption of data in transit and, where appropriate, at rest;
-
multi-factor authentication on our business systems;
-
managed, patched devices and endpoint protection;
-
regular backups and tested recovery arrangements;
-
written contracts and due diligence with providers who handle data on our behalf;
-
staff data protection and security awareness training;
-
an incident response process, under which we investigate suspected breaches promptly, notify the ICO within 72 hours where the breach is likely to result in a risk to people's rights and freedoms, and tell affected individuals directly where the risk is high.
No system can be guaranteed completely secure, and information sent over the internet is never entirely risk-free. If you believe your data may have been compromised, please tell us straight away at projects@zedpods.com
9. Your rights
Under data protection law you have the following rights, free of charge:
-
Be informed — to know how your data is used, which is what this notice is for.
-
Access — to receive a copy of the personal data we hold about you (a "subject access request").
-
Rectification — to have inaccurate data corrected and incomplete data completed.
-
Erasure — to have your data deleted where there is no good reason for us to keep it.
-
Restrict processing — to ask us to pause how we use your data, for example while a dispute about its accuracy is resolved.
-
Object — to object to processing based on our legitimate interests. You have an absolute right to object to direct marketing, and we will stop immediately.
-
Data portability — to receive data you gave us, in a machine-readable format, where we rely on consent or contract and process it automatically.
-
Withdraw consent — where we rely on consent, you can withdraw it at any time. This does not affect processing already carried out.
-
Not be subject to solely automated decisions that have a legal or similarly significant effect on you. We do not make such decisions — see section 10.
How to exercise a right. Email projects@zedpods.com or write to the Data Protection Person, ZED PODS Limited, 44–50 Royal Parade Mews, Blackheath, London SE3 0TN. You do not need to use a particular form or wording.
What happens next. We will respond within one month. If your request is complex, or you have made several, we may extend this by up to two further months — we will tell you within the first month if so, and explain why. We may ask you to confirm your identity before we release information. We will carry out reasonable and proportionate searches for your data; if we cannot do something you have asked for, we will explain why.
Some rights are not absolute. For example, we may need to keep certain records for building safety, tax or legal reasons even if you ask us to delete them. We will always explain our reasoning.
10. Automated decision-making and profiling
We do not make decisions about you by solely automated means that have a legal or similarly significant effect. We do not use profiling to make such decisions. If this changes, we will update this notice and tell you what safeguards apply before it starts.
11. Children
Our website and services are aimed at organisations and professionals, not children, and we do not knowingly collect personal data from children through them. We may hold limited information about children who are members of a resident household, where a client or landlord passes it to us in connection with occupation, access or safety — we treat this with particular care and keep it to a minimum. If you believe we hold data about a child that we should not, contact us and we will look into it.
12. Links to other websites
Our website contains links to other websites — for example partner organisations, clients, and the platforms we publish content on. This notice does not apply to those sites, and we are not responsible for their content or privacy practices. We recommend reading the privacy notice of any site you visit.
13. Complaints
If you are unhappy with how we have handled your personal data or a request you made, please tell us first — we would like the chance to put it right.
-
Email: projects@zedpods.com
-
Post: Data Protection Person, ZED PODS Limited, 44–50 Royal Parade Mews, Blackheath, London SE3 0TN
We will acknowledge your complaint within 30 days of receiving it and respond substantively without undue delay.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at any time:
-
Website: ico.org.uk/make-a-complaint
-
Helpline: 0303 123 1113
-
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Complaining to us does not affect your right to complain to the ICO, or to seek a remedy through the courts.
14. Changes to this notice
We review this notice at least annually and whenever our processing changes. The current version, its version number and effective date are always shown at the top of this page. Where a change materially affects how we use your personal data, we will take reasonable steps to bring it to your attention — for example by a notice on our website or, where appropriate, by contacting you directly.
15. Contact us
Data protection queries and requests: projects@zedpods.com
General enquiries: projects@zedpods.com
Telephone: +44 (0)20 3983 3114
Post: ZED PODS Limited, 44–50 Royal Parade Mews, Blackheath, London SE3 0TN