Privacy notice
How the DelaControl Customer Portal uses personal information. Last updated 14 October 2026.
Who we are
The portal is run by DelaControl, Unit 2 Axis, Hawkfield Business Park. We are the controller for the personal information described here. You can contact us at Enquiries@delacontrol.co.uk.
What we collect
- Your full name, work email address, role and organisation, set up by DelaControl when you were invited.
- Which version of the terms of use you accepted, and when.
- What you enter in the portal: engineering change requests, comments and files, and the names of the people involved in each one.
- A record of sign-ins and administrative actions (your name and what happened, not your email address or sign-in codes).
- Standard technical logs kept by our hosting provider, such as IP address and browser type, for security and fault finding.
We do not collect special category data, such as health information, and ask you not to put any in the portal.
Why we use it, and our lawful basis
We use it to give you access, run the engineering change process between your organisation and ours, keep the portal secure and keep the records the work needs. Our lawful basis is performing our contract with your organisation and our legitimate interests in running the portal securely and keeping accurate engineering records.
Who can see it
- People at your organisation with a portal account can see your organisation's requests, comments and files, including who wrote them.
- DelaControl staff can see everything. They also keep internal notes on requests that your organisation never sees.
- The outside services below handle data on our behalf. We do not sell personal information or use it for marketing.
Services we use to run it
| Service | What it does | Where and how |
|---|---|---|
| Vercel Inc | Hosts the portal and stores its data in a private store. Functions and storage are in London. | Vercel is based in the US. Transfers are covered by its data processing agreement (UK IDTA and EU standard contractual clauses, and the Data Privacy Framework). |
| Zoho WorkDrive | DelaControl's own file storage. It holds the daily backup of the portal (encrypted, so it cannot be read without our key) and a folder for each request holding a readable copy of its PDF (never including internal notes) and the files uploaded to it. | DelaControl's Zoho account, in the Zoho EU data centre. Backups are kept for 30 days, plus the first backup of each of the last 12 months, so information deleted from the portal can remain in backups for up to 12 months. |
| DelaControl virus scanning service | Uploaded files are passed to a ClamAV virus scanner that DelaControl runs in the UK. It checks the file and answers clean or not clean. It does not keep the file. | None. It is run by DelaControl in the UK, not by a third party. |
| Resend | Delivers the portal's emails (sign-in codes and request notifications). It sees the recipient address and the email text. | Resend is a US company. Emails are sent from its Ireland region. Transfers are covered by its data processing agreement. |
What we store and how long we keep it
| What | How long |
|---|---|
| Portal accounts: full name, work email, role, organisation, last sign-in, which terms version was accepted, and for two-step sign-in an encrypted authenticator secret and one-way hashes of recovery codes | While the person has access. When someone leaves, access ends at once, their email is removed and their name stays on records as "Name (Left MM/YY)". |
| Sign-in code checks: a one-way hash of the current code, expiry time, attempt count and send times, kept per email | Codes expire after 10 minutes. The record is deleted 24 hours after its last use. |
| Engineering change requests: text, decision, deadline, comments, internal notes and history, with the names of the people involved | 6 years after the request is closed, then deleted. |
| Files uploaded to requests (drawings, photos, CAD and office files) | Deleted with the request, 6 years after it is closed. |
| Files that have been uploaded but not yet checked and attached to a request | Deleted as soon as the file is checked, and in any case after 1 day. |
| Reports about the portal itself (bugs, change and feature requests): the text, the page it was about, the portal version, the name and organisation of the person who sent it, and DelaControl's reply and private notes | Two years after the report is marked done or not doing, then deleted. |
| Which WorkDrive folders the portal uses, and a log of backup runs (the name of the admin who set them up) | Kept. The run log keeps the last 60 runs. |
| A copy of a backup while an admin is restoring from it | Deleted after 1 day. |
| The versions of files replaced by a restore, kept so the restore can be undone | Deleted after 30 days. |
| Sign-in and administrative log: who did what and when (names, no email addresses or code values) | 12 months, then deleted. |
Data is encrypted in transit and stored in a private store. Closed requests are kept for 6 years as engineering and contract records.
Cookies
The portal only uses the cookies it needs to work. There are no analytics, advertising or tracking cookies, so there is nothing to opt out of.
| Cookie | Purpose | Type |
|---|---|---|
dp_session | Keeps you signed in (up to 12 hours). | Essential |
dp_pending | Remembers which email you are signing in with for the 15 minutes while you enter your codes. | Essential |
Your rights
You can ask to see the personal information we hold about you, to have it corrected, or to have it deleted where we do not need to keep it. You can also object to how we use it. Ask us using the contact above, and we will respond within one month. If you are not happy, you can complain to the Information Commissioner's Office at ico.org.uk.
See also the terms of use.