1. Who we are
Dynamic4 ("the Platform") is operated by Dynamic Management Services (UK) Ltd, company number 10887719, registered office Unit 2A, Swordfish Business Park, Swordfish Close, Higgins Lane, Burscough L40 8JW ("we", "us"). We are the data controller for the personal data of people who use the Platform.
Contact for anything in this notice: admin@dynamic4.co.uk, or by post to the registered office above. Where a client engages us to run a programme and provides its own data (its people, its site information, its programme), we process that data on the client's behalf as a processor under our engagement and Data Processing terms with that client. This notice covers what we do as controller.
2. Who this notice applies to
- Owners — our staff and people we appoint to run programmes.
- Clients — people at organisations that have engaged us, who view their programmes.
- Assignees — contractors, consultants and other delivery partners who hold tasks.
- Reporters — people given access to a close-out register to raise items.
- Enquirers — anyone who uses the contact form on the public site.
3. What we collect and where it comes from
Account and profile — name, email address, organisation, role, job title, phone number(s), whether you have chosen to share your phone and email with others on your projects, appearance and notification preferences. Provided by you, or by the person who invited you.
Sign-in and security — email address, sign-in codes (held briefly), password hash (owners and clients only), session records, device and browser type, IP address, times and outcomes of sign-in attempts. Generated when you use the Platform.
Programme activity — the tasks you hold or own, progress and status updates, dates, comments and @mentions, checklists, close-out items you raise, are appointed to or close, photographs and files you upload, downloads you make, and a history of every change with who made it and when. Generated as you use the Platform. This history is part of the programme record and is kept permanently (see section 8).
Contact details on the Project Contacts list — name, organisation, role, and, if you have chosen to share them, email and phone. Shown to owners and other assignees on the same project. Client users do not appear on the list and see owners' details only.
Calendar feeds — if you create a calendar link, a personal token and a record of which tasks have been sent to your calendar.
Emails we send — a log of notification and summary emails sent to you (recipient, subject, time, delivery result), kept to diagnose delivery problems.
Enquiries — name, organisation, email, phone and message from the public contact form.
Technical — standard server logs (IP address, pages requested, errors) kept for security and troubleshooting.
We do not collect special category data and ask you not to put any in the Platform. We do not use the Platform to profile or make automated decisions about you.
4. Why we use it and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Creating and running your account, signing you in, sending sign-in codes | Performance of a contract (the Platform Terms) |
| Showing you the programmes, tasks and files your role allows | Performance of a contract |
| Sending task assignments, reminders, mentions, digests and client summaries | Performance of a contract; legitimate interests in running programmes effectively |
| Keeping the change history and audit trail of a programme | Legitimate interests (ours and our clients') in an accurate programme record; legal obligations where records must be kept |
| Showing your contact details to others on your project, subject to your sharing choice | Legitimate interests in coordinating the works; you can limit this in your profile |
| Generating written summaries and impact assessments with an AI model (section 6) | Legitimate interests in efficient reporting; no decisions about you are made this way |
| Security, fraud prevention, diagnosing faults | Legitimate interests; legal obligations |
| Responding to enquiries | Steps taken at your request before a contract |
| Backups | Legitimate interests in continuity and recovery |
You can object to processing based on legitimate interests (section 9). Where we rely on legitimate interests we have considered the impact on you and concluded it is proportionate to the purpose.
5. Who we share it with
Our clients. The client whose programme you work on sees the tasks, dates, progress and documents the owner has published to them, and comments the owner has chosen to share. Clients do not see assignees' contact details through the Platform.
Other people on your project. Owners and assignees on the same project see your name, organisation and role, and your contact details if you have shared them.
Service providers (processors) who host and run the Platform for us, acting on our instructions:
- Lovable — application hosting and the managed database and file storage behind the Platform (built on Supabase). Project data is stored in the EU (AWS eu-central-1, Frankfurt, Germany).
- Anthropic — provider of the Claude AI model used for summaries and impact assessments, which the Platform calls directly under Anthropic's commercial API terms. AI requests are processed outside the UK and EU (in the United States). Only the programme data needed for the request is sent (task names, numbers, dates, status, history); names and contact details are never sent. Anthropic retains request and response content for abuse and safety monitoring for up to 30 days before automatic deletion, or longer only where a request is flagged by its safety systems or subject to a legal hold. Anthropic does not use this data to train its models. The Platform keeps its own record of each request (route, model, token counts and cost) but not the content.
- IONOS — our domain, mailbox and SMTP service, through which all Platform emails are sent from admin@dynamic4.co.uk.
Professional advisers, insurers and authorities where necessary to deal with a dispute, claim, legal obligation or lawful request.
We do not sell personal data and do not share it with anyone for their own marketing.
6. AI-generated summaries and assessments
The Platform can produce plain-English progress summaries for clients and "what-if" impact assessments for owners. These are written by Anthropic's Claude model from the programme data described above. The model is given structured plan data only — never your name, email or phone — and its output is checked against the Platform's own calculations before it is shown. Summaries are marked as generated by Dynamic4. They are not used to make decisions about any individual.
7. International transfers
Programme data and personal data are stored in the EU (Frankfurt, Germany), which the UK recognises as providing adequate protection. AI model requests (section 6) are processed by Anthropic in the United States and contain no names or contact details; that transfer is made under Anthropic's data processing addendum, which incorporates the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. Email is sent through IONOS, a German provider, within the EU.
8. How long we keep it
| Data | Retention |
|---|---|
| Account and profile | While your account is active, then 12 months after it is closed, after which it is deleted or anonymised |
| Sign-in codes | 10 minutes |
| Session and sign-in records | 12 months |
| Programme data and change history | For the life of the programme and 6 years afterwards (12 years where the underlying contract is a deed), as part of the programme record; your name remains in the history as the person who made a change |
| Close-out photographs and uploaded files | As above, as part of the programme record |
| Items in the Bin | 30 days, then permanently deleted |
| Calendar feed records | Until you regenerate or remove your calendar link; stale entries are cleared nightly |
| Email log | 12 months |
| Backups | Nightly copies kept for 90 days, then monthly copies for 2 years |
| AI assistant usage log (route, model, cost; no request content) | 24 months, then purged |
| AI request content held by Anthropic | Up to 30 days, then deleted; longer only if flagged for safety or legal reasons |
| Enquiries | 12 months from last contact, unless they become a client |
| Server logs | 90 days |
When you leave a programme, your account is closed and your contact details are removed from the Project Contacts list. Your name stays against the tasks and changes you made, because the record of who did what is part of the programme.
9. Your rights
You have the right to: ask for a copy of your personal data; have inaccurate data corrected; have data deleted where there is no longer a reason to keep it; restrict or object to processing based on legitimate interests; receive data you provided in a portable form; and withdraw consent where we rely on it (we generally do not).
To exercise any of these, email admin@dynamic4.co.uk. We will respond within one month. We may need to confirm your identity first. Some rights are limited where data forms part of a programme record we must keep.
You can change your contact-sharing choice, notification preferences and appearance in your profile at any time, and remove your calendar link from the same place.
If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113. We would welcome the chance to put things right first.
10. Cookies and local storage
The Platform uses only what it needs to work: a session token to keep you signed in, and local storage for your preferences (appearance, last view, column layout, whether you have seen the onboarding tour) and for offline caching in the installed app. These are essential and do not need consent. We do not use advertising or third-party tracking cookies.
11. Security
Access is controlled by role at the database level, so each user can see only the projects and data their role permits. Data is encrypted in transit (HTTPS) and at rest by our hosting provider. File downloads use short-lived signed links. Assignees sign in with a one-time code rather than a password. We keep an audit trail of changes and sign-in attempts and take nightly backups. No system is perfectly secure; tell us at once at admin@dynamic4.co.uk if you suspect a problem with your account.
12. Children
The Platform is for people working on construction and fit-out programmes and is not intended for anyone under 18.
13. Changes to this notice
We will post changes here and, for significant changes, tell you by email or in the Platform. The date at the top shows the current version.