Website privacy notice

This website is operated by Ricardo Rocha, trading as CIAS, a sole trader based in the United Kingdom. Ricardo Rocha is the data controller for the processing described in this notice.

CIAS is the trading name of Ricardo Rocha, not a limited company.

Contact routes are listed under Contact and changes.

This notice covers two things: visitors to the cias.io website, and business enquiries sent to CIAS by email.

The PropFolio app has its own privacy policy, which covers the data handled inside the app. This notice does not replace it.

CIAS does not set marketing or analytics cookies on this website. There is no analytics script, no advertising tag, no enquiry form, no customer account and no payment process on the site.

Hosting and security providers may set essential cookies, or use similar techniques, in order to deliver the site and protect it from abuse. Because of that, this is not a claim that a visit to cias.io involves no cookies at all.

Requests to cias.io are processed by Cloudflare, which provides edge network, CDN and security services, and by an origin server in the United Kingdom operated by CIAS.

Handling a request can involve:

• the IP address and network information the request arrives with;
• browser and device information sent with the request;
• the URL requested;
• the date and time of the request;
• records of errors and security events.

There is no enquiry form on this website, so enquiries arrive by email. Email for CIAS is provided through Microsoft 365 and Exchange Online.

When you write in, CIAS receives:

• the sending email address and the name attached to it;
• any business or contact details you choose to include;
• the message you write and any attachments you send.

This website does not automatically pass enquiries to an external AI service.

• To read and reply to your message, and to take steps you ask for before any contract.
• To deliver, maintain and protect the website.
• To deal with rights requests, security matters, and legal or regulatory matters.

• Legitimate interests. Operating and protecting the website, and responding to business communications sent to CIAS.
• Contract, and steps before a contract. Where an individual asks CIAS to provide services, the processing needed to take steps at their request and to carry out the work.
• Legal obligations. Where business records have to be kept, or where the law otherwise requires it.

Where CIAS relies on legitimate interests, you have a right to object. See Your rights.

Information is available to the authorised operator of CIAS. Beyond that, it is processed by:

• Cloudflare, for delivering and protecting the website;
• Microsoft 365, for receiving, sending and storing email.

Information may also be shared with professional advisers, or with an authority or a court, where that is necessary, for example to take legal advice or to meet a legal obligation.

CIAS does not sell enquiry data.

Processing may take place outside the United Kingdom.

Cloudflare and Microsoft publish data protection addenda setting out their safeguards for international transfers, including adequacy mechanisms where those apply and standard contractual clauses with the UK addendum where appropriate. CIAS relies on those published terms. It does not independently certify or audit them, and it does not claim that all data stays in the United Kingdom.

• Cloudflare customer data protection addendum
• Microsoft Products and Services Data Protection Addendum

If you want more detail about which arrangements apply to your enquiry, ask and CIAS will explain what it can.

Routine server logs on the UK origin are rotated daily while the site is in use, and up to 14 rotated files are kept alongside the current log.

That describes ordinary log rotation. It is not a guarantee that every copy of the information is erased within 14 days:

• evidence connected to a security incident may be kept longer, for investigation or for legal claims;
• information held by Cloudflare or Microsoft for security, logging or backup purposes follows those services' own retention, not the origin limit above.

Email is kept for as long as it is needed to handle the correspondence, any agreed work, any outstanding dispute, and applicable record-keeping. It is reviewed and cleared when it is no longer needed, rather than on a fixed automatic timetable.

This website does not make decisions about you based solely on automated processing that produce legal effects for you, or that affect you in a similarly significant way.

If your personal data is processed as described here, UK data protection law gives you rights you can exercise. To use any of them, get in touch using the routes under Contact and changes.

Where CIAS relies on legitimate interests, you have the right to object to that processing. If you object, CIAS will stop processing your personal data for those purposes unless it can show compelling legitimate grounds that override your interests, rights and freedoms, or unless the processing is needed to establish, exercise or defend legal claims.

Depending on the circumstances, you may also be able to ask for access to the personal data held about you, correction of data that is wrong or incomplete, erasure, restriction of processing, and portability of data you provided, where that right applies.

Where CIAS relies on consent for a specific thing, you can withdraw that consent at any time. Withdrawing it does not affect processing already carried out beforehand. Consent is not the usual basis for the processing described in this notice.

These rights are not absolute. Whether a particular right applies depends on the lawful basis and the circumstances, and making a request does not guarantee a particular outcome. CIAS will explain the response it gives.

If you are unhappy with how your personal data has been handled, you can complain to the Information Commissioner's Office, the UK data protection regulator, using its make a complaint pages.

You are welcome to raise it with CIAS first, so it can be looked at directly. That is optional, and you do not have to do it before contacting the ICO.

For anything in this notice, use the contact page, or write to hello@ at cias.io.

This notice describes the arrangements in place on the date shown at the top of the page. If the providers or processes change, the notice will be updated and the date changed with it.