How we use your information

What we collect and why

When NPP creates a project, we record the customer’s business name and the email address supplied for the portal invitation. During account setup, the customer provides their name, contact/business address and, optionally, a phone number. We also keep authentication and security events, project records, messages, files, approvals and activity needed to administer the account and deliver the project.

We use this information to take requested steps before a contract, perform our contract, meet legal and accounting duties, and pursue our legitimate interests in administering and securing genuine customer work. We do not use portal details for behavioural advertising or unrelated marketing.

The name and address fields are required because they identify the customer and support project documents, agreements and business records. Phone is optional. We do not use solely automated decisions that produce legal or similarly significant effects.

Cookies we need

We use secure cookies to keep you signed in, protect your customer session and lock the portal after one hour without activity. Local storage lets open tabs on this device share your latest activity time.

These are needed for the portal to work safely. We do not use them for advertising, profiling or tracking you across websites.

Trusted devices

If you choose “Remember this device”, we store a separate security token for up to seven days. It does not contain your password or authenticator key. To stop trusting the device, sign out everywhere, reset your password or authenticator, or clear this browser’s site data.

What we keep

We keep account, contact and project records while the work and customer relationship are active. Contract, transaction and related business records may normally be retained for up to six years after the relationship ends where needed for legal, tax, accounting or contractual purposes.

Invitation links expire after seven days, trusted-device tokens expire after seven days, and unfinished or rejected upload records are reviewed after 30 days. We review other records against their purpose and delete or anonymise them when they are no longer needed.

Who helps us run the portal

Cloudflare hosts and protects the portal. Supabase provides authentication and the portal database. Resend delivers account and service emails. Google Workspace handles business correspondence, and Google Drive stores project files. These suppliers act under their applicable data-processing terms.

Some suppliers or their subprocessors may make information accessible outside the UK. Where this is a restricted transfer, we rely on an applicable UK adequacy regulation or contractual safeguard and assess the protection required for the transfer.

Your rights and complaints

Depending on the circumstances, you may ask to access, correct or erase your personal information; restrict or object to its use; or receive certain information in a portable format. These rights are not absolute, and we will explain if a legal exception applies.

You can update ordinary contact details through the portal. A login-email change requires verification so that another person cannot silently take over the account.

To exercise a right, correct information or make a data-protection complaint, email hello@norsepantheonproductions.co.uk with “Data protection” in the subject. We normally respond to rights requests within one month. We acknowledge data-protection complaints within 30 days and respond without undue delay. You can also complain to the UK Information Commissioner’s Office at ico.org.uk.

More information about NPP’s wider handling of enquiries and website information is available at norsepantheonproductions.co.uk/privacy.