Who We Are
EvacPlan is a service operated by Ommateum Ltd, a company registered in England and Wales (Company No. 16805861). Our registered address is 16 Antona Drive, Raunds, Northamptonshire, NN9 6DZ.
For the purposes of UK data protection law, Ommateum Ltd is the data controller in respect of personal data collected through the EvacPlan platform. Our clients (building managers, housing associations, and care providers) are also data controllers in respect of resident data they input into EvacPlan, and we act as their data processor for that data.
If you have any questions about this policy or how we handle your data, please contact us at privacy@evacplan.co.uk.
What Data We Collect
Account & User Data
When you or your organisation signs up for EvacPlan, we collect:
- Full name and email address
- Organisation name and address
- Phone number (optional)
- Role within your organisation
- Login credentials (passwords are hashed and never stored in plain text)
Resident & PEEP Data
EvacPlan is designed to store Personal Emergency Evacuation Plans (PEEPs). This data is entered by our clients about the residents of their buildings and may include:
- Resident name, unit number, and floor
- Mobility status and evacuation requirements
- Health conditions relevant to evacuation planning
- Next of kin contact details
- Consent records
Special Category Data: Mobility and health information constitutes special category data under UK GDPR Article 9. We only process this data on the lawful bases set out in Section 3 below, and only to the extent necessary for evacuation planning purposes.
Usage Data
We automatically collect certain technical data when you use EvacPlan, including IP address, browser type, pages visited, and session duration. This is used solely for security monitoring and platform improvement.
Lawful Basis for Processing
| Type of Data | Lawful Basis | Basis Detail |
|---|---|---|
| Account data | Contract | Article 6(1)(b) — necessary to provide the service |
| Resident PEEP data (general) | Legal obligation | Article 6(1)(c) — Fire Safety (Residential Evacuation Plans) (England) Regulations 2025 |
| Health & mobility data | Vital interests / Legal obligation | Article 9(2)(c) vital interests; Article 9(2)(b) legal obligation under FSO 2005 and 2025 Regulations |
| Consent records | Legal obligation | Article 6(1)(c) — required for GDPR accountability |
| Usage / analytics data | Legitimate interests | Article 6(1)(f) — improving and securing the service |
Where we rely on consent for any processing activity, you have the right to withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.
How We Use Your Data
We use the personal data we collect for the following purposes:
- Providing and operating the EvacPlan platform
- Enabling building managers to create, maintain, and share PEEP records
- Generating evacuation plans, fire zone charts, and GEEP documents
- Sending service emails (account setup, password resets, trial notifications)
- Providing customer support via Zoho SalesIQ live chat
- Monitoring platform security and preventing misuse
- Meeting our legal obligations under fire safety legislation
- Improving the platform through aggregated, anonymised analytics
We do not sell your data. We do not share personal data with third parties for marketing purposes, and we do not use resident data for any purpose other than evacuation planning.
Data Retention
We retain personal data for as long as necessary to provide our services and meet our legal obligations:
- Active account data — retained for the duration of your subscription
- PEEP and resident data — retained for the duration of your subscription, plus 30 days following termination to allow data export
- Trial accounts — data deleted 33 days after trial expiry if no conversion to a paid plan
- Audit logs — retained for 12 months from creation
- Financial records — retained for 7 years as required by HMRC
Upon account closure, we will delete all personal data within 30 days unless we are required to retain it by law.
Your Rights
Under UK GDPR, you have the following rights in relation to your personal data:
- Right of access — request a copy of the personal data we hold about you
- Right to rectification — request correction of inaccurate data
- Right to erasure — request deletion of your data in certain circumstances
- Right to restrict processing — request we limit how we use your data
- Right to data portability — receive your data in a machine-readable format
- Right to object — object to processing based on legitimate interests
- Rights related to automated decision-making — EvacPlan does not make automated decisions that significantly affect you
To exercise any of these rights, contact us at privacy@evacplan.co.uk. We will respond within one month. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
Note for residents: If you are a resident of a building managed via EvacPlan, your data is held by the building manager (our client), who is the data controller for your PEEP records. Please contact your building manager in the first instance to exercise your rights. We will co-operate fully with such requests.
Security
We take the security of personal data seriously and implement appropriate technical and organisational measures, including:
- All data encrypted at rest (AES-256) and in transit (TLS 1.2+)
- Row-level security policies ensuring users can only access their own organisation's data
- Role-based access controls (super admin, manager, warden, viewer, fire service)
- Audit logging of all significant actions within the platform
- Passwords hashed using industry-standard algorithms — never stored in plain text
- Regular security reviews of our codebase and infrastructure
In the event of a personal data breach that is likely to result in a risk to individuals' rights and freedoms, we will notify the ICO within 72 hours and affected individuals without undue delay.
Children's Data
EvacPlan is a professional B2B service not intended for use by children under 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us immediately at privacy@evacplan.co.uk and we will delete it promptly.
Note that PEEP records may include data about child residents of buildings managed via EvacPlan. Such data is collected and held by the building manager under their own legal obligations and our data processor agreement with them.
Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify active users by email and update the "Last updated" date at the top of this page. Your continued use of EvacPlan after any changes constitutes your acceptance of the updated policy.
Previous versions of this policy are available on request.
Contact Us
For any questions, requests, or concerns relating to this Privacy Policy or how we handle your data: