ProjectFiles Privacy Policy

Last updated: 11 October 2026

1. Who we are

ProjectFiles Ltd provides the ProjectFiles project and portfolio governance platform. We are registered in England and Wales under company number 16055081. Our registered address is 52 Parkfield Street, Rowhedge, Colchester, Essex, CO5 7EL, England.

For privacy enquiries or requests, contact pmo@project-files.com.

This notice covers our website, application and related business communications. It applies to users worldwide, subject to applicable local laws.

2. Our role

We are a data controller for information used to administer our business, accounts, subscriptions, enquiries and service security.

For personal information entered into a company workspace, we generally act as a data processor on that customer's instructions. Your employer or the organisation managing the workspace generally determines the purposes of that processing and authorised access. Its privacy notice also applies. This notice does not replace the customer's data-processing agreement.

Contact your workspace administrator first about organisation-controlled data. You can also contact us and we will help direct your request appropriately.

3. Information we handle

Depending on the features you use, information may include:

• Names, email addresses, company details, job titles, contact details and profile preferences.
• Account identifiers, password hashes, authentication records and Microsoft identity identifiers when Microsoft sign-in is used. We do not receive your Microsoft password.
• Information about resources, allocations, assignments, timesheets, rates, costs, approvals and project activities, including personal information in comments or uploaded content.
• Subscription details, billing contacts and transaction or payment-status records.
• Technical information needed for service operation and security, such as IP addresses, access times, device/browser details, activity and error records, where collected by configured systems.
• Enquiries, support communications and feedback.

We receive information from you, your organisation and its authorised users, authentication/payment providers where used, and service operation. Resource records may include people without a PF account.

Required account information is necessary to provide the relevant service. If it is not supplied, we may be unable to create or administer an account. Optional fields need not be completed.

4. Purposes and lawful bases

Where we act as controller, we use information to:

• Provide a service contracted directly with an individual: performance of that contract.
• Administer business subscriptions, support users and manage customer relationships: legitimate interests in delivering business services, or contract where applicable.
• Authenticate users, maintain reliability, investigate faults and prevent abuse: legitimate interests in operating and protecting the service.
• Maintain legally required records and respond to binding legal requests: legal obligations.
• Provide optional consent-based features: consent where personal-data processing requires it.

Where we rely on legitimate interests, we consider individuals' rights and the necessity of processing. Workspace processing follows the customer's instructions; the customer is responsible for its own lawful basis.

5. Providers and disclosures

We use Microsoft Azure to host and operate the application and databases, and Squarespace for website and domain services. Microsoft processes authentication information where Microsoft sign-in is used. Payment or Marketplace providers process relevant subscription and transaction information where those purchase routes are used.

Providers supporting optional AI text assistance receive the limited input needed for that feature when you choose to use it. Other relevant recipients may include email delivery, technical support or diagnostic providers where these are used to operate the service.

Authorised users within your organisation can access workspace information according to their permissions. Administrators manage account membership and access.

We may disclose information to professional advisers, where legally required, to address security incidents or protect legal rights, or in connection with a business transfer, subject to applicable law.

Using technical service providers is distinct from making workspace data publicly available. We do not make customer workspace information available to unrelated parties for their own use.

6. Hosting and international access

Our core application and workspace databases are currently hosted in Microsoft Azure UK South. Alternative hosting locations may be agreed separately with customers.

This location statement applies to the core application and databases; it does not guarantee that every provider operation, backup or optional service is confined to that region. Provider locations and terms depend on the services used. Contact us for information about the relevant arrangements before enabling a feature or agreeing particular residency requirements.

If processing involves a restricted international transfer, applicable law requires an appropriate transfer mechanism and any necessary supporting safeguards. Consent to an optional feature does not by itself establish that those transfer requirements have been met.

7. Optional AI assistance

Some features offer optional AI assistance, such as completing text. These features are used with your consent. We limit the input sent and aim to remove identifying information before sending it.

Removing names alone may not make free text anonymous. Do not include personal, sensitive or confidential information in AI inputs unless your organisation has authorised its use under the relevant arrangements. AI suggestions can be inaccurate and should be reviewed before use.

Contact our privacy address for information about the provider and processing arrangements for the feature. You may stop using the optional feature at any time; this does not affect processing already lawfully undertaken.

8. Cookies and analytics

The application uses essential authentication and security cookies or similar storage to support sign-in and service operation. Blocking these can prevent features from working.

We do not currently use optional page-interaction analytics within the application. If introduced, the notice and relevant controls will be updated, with consent obtained where required. The public website operates through Squarespace and can have its own cookie settings; application and website settings are separate.

9. Retention and deletion

Retention depends on the purpose, account status, customer instructions, contractual requirements and applicable law. We have not yet implemented automatic deletion after fixed periods of account inactivity.

For active workspaces, retention supports the subscribed service, ongoing projects and customer-required history. For closed or inactive accounts, the relevant criteria are whether information remains needed for customer-requested recovery or export, unresolved support matters, security investigations, legal claims or required records. These criteria do not justify keeping every record indefinitely.

Authorised users can delete supported application records. For other deletion requests, contact the workspace administrator or pmo@project-files.com. Requests involving personal information are assessed under applicable law. Referential integrity alone is not a blanket reason to refuse erasure; removing identifiers while retaining necessary audit records may be appropriate.

Billing, tax and legal records may require separate retention. Protected backups may contain deleted information until they expire or are overwritten. Backup duration depends on the configured backup policy; contact us for the applicable recovery window. Deletion from a live database does not mean immediate erasure from every backup.

10. Security

We use the access controls and security features configured for our application, authentication and cloud services to protect information. No online service can guarantee absolute security. Protect your credentials and report suspected unauthorised access promptly.

11. Privacy rights

Subject to applicable law and its exceptions, you may have rights to access, correct, erase or receive a portable copy of information, restrict or object to processing, and withdraw consent. You may object to processing based on legitimate interests, including direct marketing if undertaken.

Send requests to pmo@project-files.com. We may request proportionate identity or authority verification. For organisation-controlled workspace data, we coordinate with the organisation responsible.

Under UK/EU rules, requests normally require a response within one month, with extensions permitted in specified circumstances. Other local deadlines may apply.

You can complain to the UK Information Commissioner's Office at https://ico.org.uk/make-a-complaint/ or your competent local authority. You do not need to contact us first.

12. Children and changes

ProjectFiles is intended for business use, not for children. Contact us if you believe a child has improperly supplied personal information.

We update this notice when practices change and revise the date above. Material changes will be communicated appropriately. Publishing a revised notice does not replace any consent or other legal step required for a new use of information.

Privacy contact: pmo@project-files.com.