Privacy Policy

This notice explains what personal information we collect about you, why we collect it, how we use it, who we share it with, and the rights you have over it. It applies whether you visit our website, sign up to our communications, attend our events, or use the Sownd certification platform as a client, a partner or a specifier.

We have tried to write it in plain English. If anything is unclear, please email us at privacy@sowndaffects.co.uk and we will do our best to explain.

1. Who we are

We are Sownd Affects Ltd ("Sownd", "we", "our", "us"), a company registered in England and Wales (company number 16577658) with our registered office at 86-90 Paul Street, London, England, EC2A 4NE. We are registered with the Information Commissioner's Office (ICO) under registration number IZC041439. Our data protection lead can be reached at privacy@sowndaffects.co.uk.

When you use our website or our communications, we are the "controller" of your personal data - meaning we decide why and how it is processed. When you upload information about other people (for example, your own clients or building occupants) to the Sownd certification platform, you are the controller of that information and we act as a "processor" on your behalf. We explain this in more detail in section 5.

2. What this notice covers

This notice covers personal data we collect through:

• our website at sowndaffects.com and any subdomains;
• our marketing communications, including emails, newsletters and event invitations;
• the Sownd certification platform (the "Platform"), including any data uploaded by clients, partners and specifiers; and
• any other interaction you have with us - for example, by email, phone, social media, or in person at events.

It should be read alongside our Cookie Notice (which sets out how we use cookies and similar technologies) and, for Platform users, our Platform Terms of Use and (where applicable) our Partner Data Processing Agreement.

Our website and the Sownd certification platform are intended for professional use. They are not directed at children, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at privacy@sowndaffects.co.uk and we will remove it.

3. The information we collect

3.1 If you visit our website

When you visit sowndaffects.com we automatically collect limited technical information about your device and visit - for example, IP address, approximate location, browser type, the pages you view, and how you arrived at our site. This is collected through cookies and similar technologies (see section 11 and our Cookie Notice).

3.2 If you contact us, subscribe to updates, or attend our events

We collect the information you give us directly - for example, your name, work email, employer, job role, the message you send us, and any preferences you tell us about (such as whether you want to hear from us by email).

3.3 If you use the Sownd certification platform

When you sign up to the Platform as a client, partner or specifier, we collect:

• your account information - name, work email, employer, role, professional credentials and any other details you give us at registration;
• information you upload or enter on the Platform about a project being assessed or certified ("Project Data") - including acoustic measurements and surveys, drawings, specifications, photographs, addresses, occupant information, commercial terms, and assessment data;
• your activity on the Platform - sign-in times, audit logs, document version history, and how you interact with project workspaces.

3.4 Information about other people you upload to the Platform

If you upload information about other individuals - for example, your own client, occupants of a building, or members of your team - that information may include their personal data. When you do this, you are the controller of that personal data and we act on your instructions as your processor. You are responsible for telling those individuals about how their information will be processed and for having a lawful basis to share it with us.

3.5 Information from other sources

Occasionally we may collect personal information about you from public sources (for example, your employer's website or your public LinkedIn profile), from a partner who has referred you to us, or from contact data providers - typically to make initial business-to-business contact about Sownd Certification.

4. Why we use your information, our legal basis, and how long we keep it

Under UK data protection law we need a lawful basis to use your personal information. The table below sets out, for each purpose, why we use your information, which lawful basis we rely on, and how long we keep it.

Where we rely on legitimate interests, we have carried out a balancing test and concluded that our interests do not override your rights and freedoms. You can ask us for a summary of that assessment.

5. When we are the controller, and when we are the processor

We are the controller of:

• your account information when you sign up to our website, communications, events or the Platform;
• your communications with us;
• marketing and analytics data;
• the data we use to run our business.

We are the processor of:

• Project Data uploaded to the Platform by a client or partner - including any personal data of that organisation's own client, employees, occupants or third parties contained within it.

When we act as a processor, we only use Project Data on documented instructions from the controller (typically the partner or client who uploaded it), in line with our Platform Terms of Use and our Partner Data Processing Agreement. We do not use Project Data for our own purposes.

6. Who we share your information with

We share personal information only where we need to, and only with parties bound by confidentiality and data protection obligations no less protective than ours. The categories of recipient are:

• Sub-processorswho provide the technology behind the Platform - for example, cloud hosting, database, email delivery, file storage, identity and authentication, and analytics. We maintain a current list of our sub-processors, which we make available to partners and clients on request. We give 30 days' prior notice of any new or replacement sub-processor and allow you to object on reasonable grounds.
• Professional advisers - lawyers, accountants, auditors, and insurers - under duties of confidentiality, where their advice is necessary.
• Public authorities - where we are legally compelled to disclose information. Where lawful, we will challenge over-broad or improperly served requests, and we will tell you before we disclose so that you can seek a protective order.
• An acquirer or successor - in the context of a sale, merger or restructuring of our business, subject to equivalent confidentiality and data protection commitments.

We do not sell, rent, or licence your personal information. We do not share information uploaded by one partner with any other partner or third party, except as that partner has instructed.

7. Where your information is stored, and international transfers

We host the Platform on infrastructure located in the United Kingdom and/or the European Economic Area. Some of our sub-processors may process personal data outside the UK or EEA - for example, support, monitoring or email infrastructure provided from elsewhere.

Where this happens, we put in place a recognised UK transfer mechanism, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or reliance on a UK adequacy regulation. We also apply supplementary measures (such as encryption) where appropriate to the risk. We will tell you, on request, where each of our sub-processors processes data.

8. How we keep your Project Data confidential

Project Data uploaded to the Platform is confidential to you (and, where applicable, to your underlying client). We treat it as such. Specifically:

• we use Project Data only to deliver the Platform and the certification services agreed with you - and never for our own marketing, public case studies, benchmarking products, or other commercial purposes - unless you have given separate written, opt-in consent;
• each client and partner has a dedicated workspace; one cannot see another's data;
• internal access at Sownd is strictly need-to-know and least-privilege;
• all our personnel and contractors are bound by written confidentiality undertakings that survive termination of their employment;
• our sub-processors are subject to equivalent confidentiality and security obligations;
• we will return or delete Project Data within 30 days of your written request, and remove it from backups within our standard backup retention cycle, save where retention is required by law.

These confidentiality commitments are reflected in our Platform Terms of Use, giving you contractually enforceable rights against us.

9. Artificial intelligence and machine learning

We do not use Project Data, account information, or any other personal data of our users to train, fine-tune, evaluate or benchmark any general-purpose artificial intelligence or machine-learning model, whether ours or a third party's.

Where the Platform uses AI-assisted tooling (for example, to help summarise documents or surface insights from your own data back to you), that processing takes place within our tenancy, operates only on your data, and is performed for your benefit. The inputs and outputs are not used to improve any general-purpose model.

A qualified person at Sownd reviews and is responsible for any certification outcome - we do not certify projects by algorithm alone.

10. Automated decision-making

We do not make decisions about you that produce legal effects or similarly significant effects based solely on automated processing.

11. Cookies and similar technologies

We use cookies and similar technologies to operate our website, to remember your preferences, to understand how our website is used, and (with your consent) to support our marketing.

You can manage your cookie preferences at any time through the consent banner on our website. For a full list of the cookies we use, their purpose and how to control them, please see our Cookie Notice available on request.

12. Marketing communications

We may send you information about Sownd Certification, our events, and developments that we think will be of interest to you in your professional capacity. Every marketing email we send includes a one-click unsubscribe link, and you can also email privacy@sowndaffects.co.uk to opt out at any time.

Where required by law (for example, for individual subscribers who are not a business contact), we will ask for your prior consent. Where we rely on the "soft opt-in" under the Privacy and Electronic Communications Regulations, we will only do so where you have enquired about or used a similar product, and we always give you the chance to opt out at the point we collect your details.

Opting out of marketing does not stop us sending you transactional or service messages (for example, security notices, certification status updates, or invoice reminders).

13. Security

We protect your information with appropriate technical and organisational measures, including encryption in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent), multi-factor authentication for staff access, role-based access controls, audit logging, segregation of partner and client workspaces, regular vulnerability scanning and independent penetration testing, and documented incident-response procedures.

We currently hold (or are working towards) the following independent assurance: Cyber Essentials target Q4 2026; ISO/IEC 27001 working towards, target 2027. A more detailed Security & Confidentiality Overview is available to partners and clients on request.

We maintain cyber liability and professional indemnity insurance.

If we become aware of a personal data breach affecting your information, we will notify you and (where required) the ICO without undue delay, and in any event within the timescales set out in our Platform Terms of Use.

14. Your rights

Under UK data protection law you have the right to:

• be informed about how we use your personal data - this notice is part of how we do that;
• access the personal data we hold about you;
• have inaccurate personal data corrected;
• have your personal data erased, in certain circumstances ("right to be forgotten");
• restrict the way we use your personal data, in certain circumstances;
• object to our use of your personal data, including for direct marketing;
• receive a copy of your personal data in a portable format, where it has been provided by you and is processed by automated means under contract or consent;
• withdraw consent at any time where we are relying on it - this does not affect the lawfulness of anything we did before you withdrew it.

To exercise any of these rights, please email privacy@sowndaffects.co.uk. We will respond within one calendar month. For complex requests, we may extend this by up to two further months and will tell you if we need to. We may need to verify your identity before we can comply.

If you are not happy with how we have handled your personal data, you have the right to complain to the Information Commissioner's Office:

• online: ico.org.uk
• telephone: 0303 123 1113
• post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

We would, however, appreciate the chance to address your concerns first.

15. If you are a client of one of our partners

Where your personal information has been uploaded to the Platform by one of our partners (for example, your acoustic consultant or architect) in connection with a project, that partner is the controller of your information and we act as their processor.

In that case, please contact the partner in the first instance to exercise your rights. We will support the partner in responding, in line with our written agreement with them. You may also contact us at privacy@sowndaffects.co.uk if you cannot reach the partner or you have specific concerns about how we are handling your information.

16. Changes to this notice

We may update this notice from time to time. If we make material changes - for example, changes to the categories of data we collect or the purposes we use it for - we will let you know by email (if we have your email address) and by a prominent notice on our website at least 14 days before the changes take effect, unless the change is required for legal or security reasons in which case it may take effect sooner.

The "last updated" date at the top of this notice tells you when it was most recently changed.

17. How to contact us

For any question about this notice, or to exercise any of your rights:

This notice is provided by Sownd Affects Ltd and should be read alongside our Platform Terms of Use and our Cookie Notice.