Privacy Policy

Last updated 2 September 2026

Sonnet Building Advisors Ltd ("Sonnet", "we", "us" or "our") respects your privacy. This policy explains how we collect and use personal information in connection with our website, consultancy services, business development, recruitment and employment activities.

1. Who we are

Sonnet is the controller of the personal information described in this policy unless we tell you otherwise. This means that we decide why and how that information is used.

Sonnet Building Advisors Ltd is registered in England and Wales under company number 17314481. Our registered office is Moor Park House, Bawtry Road, Wickersley, Rotherham, England, S66 2BL.

For privacy-related enquiries, please contact us at info@sonnetba.co.uk.

2. Who this policy applies to

This policy applies to website visitors and enquirers, clients and prospective clients, consultants, contractors, suppliers and members of project teams, business contacts, job applicants, and Sonnet's employees and directors.

3. Personal information we collect

We may collect identity and contact details, including names, addresses, email addresses and telephone numbers; professional details, including job titles, organisations, qualifications and employment history; project and service records, including correspondence, meeting records, appointments, instructions, reports and other project documentation; and commercial and financial information, including contracts, fee information, invoices, bank details and payment records.

Where relevant, we may also collect recruitment and employment information, including CVs, references, right-to-work documents, performance information, disciplinary records and emergency contacts. This may include special category information such as health, sickness, disability, workplace-adjustment and equality and diversity information. We may also process criminal-conviction or offence information where a lawful and proportionate check is required for a role or engagement.

When you use our website or interact with our marketing, we may collect technical information including your IP address, device and browser information, cookie identifiers, pages viewed and interactions with our website or marketing. We may also collect your marketing preferences and records of communications with us.

We seek to collect only information that is relevant and necessary for the applicable purpose. Please do not send sensitive or confidential information through the general website enquiry form unless we have specifically requested it.

4. How we obtain personal information

We obtain information directly from you through our website enquiry form, email, telephone calls, meetings, professional appointments, contracts and job applications.

We may also receive information from clients, consultants, contractors, suppliers, project teams, recruitment providers, referees, professional networks and referrals, and publicly available professional sources such as company websites, Companies House and LinkedIn.

5. How and why we use personal information

We use personal information to respond to enquiries, prepare proposals and take steps requested before entering into a contract. We do this where necessary to take steps in connection with a contract and for our legitimate business interests.

We use personal information to provide and manage project management, Employer's Agent, contract administration and related consultancy services, and to manage appointments, instructions, meetings and project records. We rely on contractual necessity, our legitimate interests and, where applicable, our legal obligations.

We use personal information to manage relationships with clients, consultants and suppliers, including professional appointments, procurement, payments and communications. We do this where necessary for contractual purposes, our legitimate interests and compliance with legal obligations.

We may use personal information for business development and marketing, including maintaining professional contacts, sending relevant business communications, newsletters and event invitations, and measuring marketing effectiveness. We generally rely on our legitimate interests for these activities and on consent where consent is required.

For recruitment, we use personal information to assess applications, conduct interviews and checks, obtain references and make recruitment decisions. We rely on steps taken in connection with a potential contract, our legitimate interests and legal obligations.

For employees and directors, we use personal information to manage pay, benefits, attendance, performance, health and safety, workplace adjustments and other legal and administrative obligations. This processing may be necessary for contractual purposes, legal obligations and our legitimate interests.

We use financial and commercial information to process invoices and payments, maintain accounting, tax, insurance and corporate records, and prevent fraud. We rely on contractual necessity, legal obligations and our legitimate interests.

We use website information to secure and operate our website, respond to forms, understand how the website is used and improve our content and marketing. We rely on our legitimate interests for essential website operation and on consent for optional cookies where required.

We may also process personal information to obtain professional advice, manage complaints or claims, protect our legal rights and cooperate with regulators and other authorities. We do this where necessary to comply with legal obligations or for our legitimate interests.

6. Special category and criminal-offence information

Where we use health, disability, equality or other special category information, we identify both a lawful basis and an additional condition under UK data protection law. Depending on the circumstances, this will usually be necessary for employment, social security or social protection obligations and rights, occupational health or assessment of working capacity, the establishment, exercise or defence of legal claims, substantial public interest, or explicit consent where appropriate.

We process criminal-conviction or offence information only where authorised by law and necessary for a relevant role, engagement, legal obligation or safeguarding purpose. Access is restricted and the information is retained only for as long as necessary.

7. Business development and marketing

Sonnet may contact existing and prospective business contacts by individual email, newsletter, LinkedIn message or advertising, telephone or event invitation where the communication is relevant to their professional role.

We rely on legitimate interests for proportionate business-to-business relationship management and marketing, and on consent where consent is required by applicable electronic-marketing rules.

You can object to direct marketing or unsubscribe at any time by using the unsubscribe facility in a message or emailing info@sonnetba.co.uk. We may keep a minimal suppression record so that we can respect your request.

8. Sharing personal information

We may share personal information where necessary with clients, prospective clients, consultants, contractors, suppliers and other members of project teams. We may also share information with professional advisers, auditors, insurers and claims handlers; accountants, banks, payment providers and QuickBooks; Microsoft 365 and other IT, email, security, hosting and cloud-service providers; and Squarespace, Google and LinkedIn in connection with the website, analytics, maps and marketing.

Where relevant, we may share information with recruitment providers, referees, occupational-health advisers and benefit providers. We may also disclose information to HM Revenue & Customs, Companies House, courts, regulators, law-enforcement bodies and other public authorities where required or permitted by law.

If Sonnet is involved in a proposed sale, merger, restructuring or transfer of its business, we may share appropriate information with a purchaser, investor or adviser, subject to appropriate confidentiality safeguards.

We do not sell personal information. Service providers may use personal information only in accordance with their contracts, applicable law and their own responsibilities as controllers where relevant.

9. International transfers

Some of our technology and professional-service providers may process personal information outside the United Kingdom. Where this happens, we require an appropriate lawful transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another safeguard permitted by law.

You may contact us for further information about the safeguards relevant to your information.

10. How long we keep personal information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, insurance and reporting requirements.

Enquiries and unsuccessful proposals are usually retained for two years after the last meaningful contact.

Client, appointment and project records are usually retained for 12 years after completion or termination where appointments may be executed as deeds, or for a shorter period where appropriate, subject to contractual, limitation and insurance requirements.

Accounting, tax and payment records are usually retained for six years after the end of the relevant financial year, or longer where legally required.

Business-development contact information is retained while the relationship remains active and is normally reviewed after three years without meaningful contact. Suppression records may be retained for longer where necessary to ensure that marketing preferences continue to be respected.

Information relating to unsuccessful job applicants is usually retained for six months after the recruitment process unless the applicant agrees to a longer talent-pool period.

Employee and director records are usually retained for six years after employment or appointment ends, although particular records may be retained for longer or shorter periods where required by law or in connection with pensions, tax, health and safety or legal claims.

Website and cookie information is retained as described in our Cookie Policy and the settings of the relevant service providers.

We may retain records for longer where a dispute, complaint, investigation or legal claim is reasonably anticipated or ongoing. We may also retain anonymised information that no longer identifies an individual.

11. Security

We use proportionate technical and organisational measures intended to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

These measures include access controls, secure Microsoft 365 services, appropriate device security, backups, staff confidentiality and restrictions on access according to business need. No internet transmission or storage system can be guaranteed to be completely secure.

12. Your rights

Depending on the circumstances, you may have the right to request access to your personal information, ask us to correct inaccurate or incomplete information, ask us to erase information, ask us to restrict processing, object to processing based on legitimate interests, and object at any time to direct marketing.

You may also have the right to receive certain information in a portable format and to withdraw consent at any time, without affecting processing carried out before your consent was withdrawn.

These rights are not absolute and exemptions may apply. We may ask for information to verify your identity. We normally respond within one month.

To exercise any of these rights, please email info@sonnetba.co.uk.

13. Complaints

Please contact us first so that we can try to resolve your concern.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority. You can visit ico.org.uk/make-a-complaint or telephone 0303 123 1113.

14. Cookies

Our website uses cookies and similar technologies. Please see our Cookie Policy for information about the cookies used, their purposes and how to manage your choices.

15. Changes to this policy

We may update this policy when our activities, systems, service providers or legal obligations change. The latest version will be published on our website and identified by the date shown above.

16. Contact us

Sonnet Building Advisors Ltd
Moor Park House, Bawtry Road, Wickersley, Rotherham, England, S66 2BL
Company number: 17314481
Email: info@sonnetba.co.uk