Get a demo

COMMONPLACE DIGITAL LTD are committed to protecting and respecting your privacy.

Who are we

COMMONPLACE DIGITAL LTD with a registered office at:

Cardinal House
20 St Mary's Parsonage
Manchester
M3 2LG

For the purposes of the Data Protection Act 2018 we are the data controller of the personal data we collect for certain purposes as described in this privacy policy.

We also act as a data processor of personal data that initiators collect using our engagement platform. In those cases it is the initiator that is the data controller. (See the “Teams” section below for more information on initiators and the other organisations in the Team as identified on the Team page of the Commonplace.)

We are registered with the Information Commissioner’s Office in the United Kingdom with registration number: ZA074797

What we do

We want to be really clear about what we do, because it sets the scene for how and why we collect and process personal data.

Personal data means any information about a living individual from which that person can be identified (but not data where the identity has been removed, like anonymous data).

Commonplace.is (referred to as our site or a Commonplace in this document) is an online engagement platform, which helps developers, councils and city managers initiators)engage with individuals in local communities – people just like you.

Initiators use our platform to gather information that may reveal issues and suggest solutions, as well as for statutory consultation and formal planning applications. use the information gathered for the purposes specified in their own privacy policies and they are the controllers of the personal data collected via our platform for their purposes.

We also help communities use the platform to plan their neighbourhoods, co-design solutions and analyse the social impact of new developments. We collect personal data in order to do this and where we do so we are the controller of that personal data.

We can’t make good community engagement happen without collecting, using and sharing personal data.

In this privacy policy, each individual engagement project is called a Commonplace. Each Commonplace is publicly available and you can see them on the Commonplace places page.

We explain all the details about how we collect, use and process personal data below. If you have any questions, please email privacy@commonplace.is.

Teams

We make it clear to you who initiated the Commonplace. It could be a developer, council or city manager, or it could be an architect or agency working for them, or it could even be someone who wants to make something happen in their community. In this policy we refer to a number of people and organisations:

The initiator of the Commonplace

The organisation that commissions the Commonplace in order to engage members of the community about a place or project.

Team

The organisations listed on the Team page of the Commonplace (e.g. developers, councils, city managers). These organisations may process the information you provide.

We or Us

Commonplace Digital Limited, provider of the platform for the Commonplace.

You

a visitor to our website or a Commonplace.

 

The initiator chooses the questions for each Commonplace and it’s up to them to decide what they would find helpful for engagement purposes. We are the platform that makes it happen, but it’s their project or community and they choose the questions. We process personal data and information gathered via the Commonplace on behalf of initiators and under their instruction.

As well as being transparent about who started a Commonplace, you will also be able to manage your communications preferences for each Commonplace. See Managing your contact preferences below. And by the way, all our communications are opt-in – we won’t spam you!

How we collect information

We collect data from you in a number of different ways, depending on how you interact with us.

You can interact with us directly, for example through one of our Commonplaces. Or you can interact with us via someone else, for example by filling in a paper or digital questionnaire in your local area (this data is then provided to us for use in the Commonplace).

If you interact with us directly, we may collect data from you:

  • Via a Commonplace
  • By email
  • Over the phone
  • In person

We may also be given data about you from third parties:

  • From an initiator and the team (this will include people you interact with locally who may ask you for feedback and record it on a Commonplace).
  • From service providers who we engage on our behalf.
  • From publicly available sources.

We may also automatically collect some technical data about your equipment, browsing actions and patterns.

 

Information we collect and why

We may collect the following data about you when you visit a Commonplace or if you contact us by other means:

  • If you contact us, we may keep a record of that correspondence.
  • We may also ask you to complete surveys that we use for research purposes, although you do not have to respond to them.
  • Details of your visits to our Commonplaces including, but not limited to, traffic data, location data, weblogs and other communication data and the resources that you access (see IP addresses and cookies below).

The specific data categories vary for each Commonplace and it’s up to the initiator of each Commonplace to decide what they would find helpful for their engagement purposes. The categories of data collected by the initiator will be described in more detail in their privacy policy which is linked from the applicable Commonplace page.

Typically, the categories of data collected and processed by the initiator of each Commonplace include those listed below. We may also collect and process some of the data listed below for our own purposes which are also stated below. This is shared data and each of Commonplace and the initiator are Controllers in common (i.e. we share the same set of data but we use it for different purposes)  of this information. For more information on how we managed the Shared Personal Data you can contact us at privacy@commonplace.is or contact the initiator using the contact information in their privacy policy.

Category of data

Initiator purpose

Commonplace purpose

Information that you provide by participating, for example your email address.

To ensure that feedback is obtained from real people.

To contact you with updates and about other Commonplaces that you might be interested in participating in.

Information that you provide by filling in the About you page as part of responding to a Commonplace (or if you update it later). Depending on the individual Commonplace this might include:

Your postcode

For each Commonplace, this information helps the initiator identify which roads/estates have and haven’t responded. On rare occasions, this is also required in order to prove that you live in the area – this is usually for statutory consultations.

To identify if there is another Commonplace or upcoming project in the same area which may impact you or in which we think you might be interested and for other reasons which we will usually inform you about on the “Stay Informed” page of a Commonplace, and for the purpose of building up an aggregate understanding of a community’s needs across many individual projects to  better articulate these for future projects.

Age range

For each Commonplace, this information helps identify how many residents have been reached in a particular age group.

So that we can inform only the age range of individuals that we think may be impacted by another that we know about and think they might be interested in, and for the purpose of building up an aggregate understanding of a community’s needs across many individual projects to  better articulate these for future projects.

 

Your gender

For each Commonplace, it helps ensure that it has reached a balanced group of people. It’s totally up to you if you share that information.

Because we also join up conversations in an area, it also helps us to know if we have a representative sample of people across these joined up conversations, and for the purpose of building up an aggregate understanding of a community’s needs across many individual projects to  better articulate these for future projects.

Information about your connection to the area

Knowing whether are a resident or visitor, or if you work in the area helps the initiator to understand the context of your comments.

To work out which other Commonplaces to notify you about, and for the purpose of building up an aggregate understanding of a community’s needs across many individual projects to  better articulate these for future projects

Other information about how you use an area: for example whether you tend to walk, drive or take public transport

To help inform the initiator of projects that are improving mobility, connectivity or public space.

To build up an aggregate understanding of a community’s needs across many individual projects to  better articulate these for future projects.

 

Information that you add as the content of your comment or comments, which might include:

Generally, information that you provide by filling in questions on a Commonplace or a paper questionnaire that is recorded on a Commonplace – some of this information is mandatory and some voluntary. The screens or pages will always make it clear which is which and why.

To enable the initiator to confirm that your feedback is genuine.

 

 

The content of any agreements and comments you make on a Commonplace.

To gain insight into a community’s requirements and reactions in relation to the initiator’s project.

To build up an aggregate understanding of a community’s needs across many individual projects to  better articulate these for future projects.

 

The questions that you fill in for each Commonplace are bespoke for that project, so there may also be project specific information requested which will be used by both Commonplace and the initiator for the purposes outlined above.

For more detailed information on the lawful basis on which of your personal data is collected by us (Commonplace Digital) and the purposes or how we use that data, please see the table above on “How and why we use information”.

 

Special category data

Special category data may be collected via a Commonplace.

European law identifies the following categories of personal data as special category data:

  • personal data revealing racial or ethnic origin;
  • personal data revealing political opinions;
  • personal data revealing religious or philosophical beliefs;
  • personal data revealing trade union membership;
  • genetic data;
  • biometric data (where used for identification purposes);
  • data concerning health;
  • data concerning a person’s sex life; and
  • data concerning a person’s sexual orientation.

It also includes personal data revealing or concerning the above types of data.

Special category data may collected via a Commonplace by the initiator and they may share it with their partners who are also other controllers and who are identified on the Commonplace team page.

We do not use this special category data for our own purposes. We are only responsible for facilitating its collection for initiators and for processing it in accordance with their instructions.

It is not mandatory for you to provide special category data. If you chose to provide special category data you can withdraw your consent to its use at any time by logging into and changing your profile on the Commonplace or you should contact the party that started the Commonplace. Their details can be found in their privacy policy.

However, you need to be aware that special category data is generally anonymised (see the section on “Keeping data secure” below) on collection and once it has been anonymised it cannot be linked to you which would make it impossible to identify it for the purposes of you exercising your rights in relation to such data.

The specific categories of special category data collected by initiators on a Commonplace vary depending on the type of project but typically the following types of special category data are collected by initiators on a Commonplace:

    • Ethnicity: For each Commonplace, it helps identify how many residents have been reached in an ethnic group. 
    • Health: For some Commonplaces, it helps identify if the needs of people with disabilities or other health issue are being properly and fully considered.

More information on the purposes for which any special category data is collected for each Commonplace, who the controllers will be and what they will do with this data is available on the demographics page on the Commonplace where this information is collected.

You should be aware that responses you might give to some questions on the Commonplace may reveal or concern special category data. You should bear this in mind when responding. Also see the section below on remaining publicly anonymous.

If you wish to remain publicly anonymous

If you do not want to be identified with material posted by you then you should not include your name or any identifying information in the material posted. We don’t review feedback before it’s published, so it’s important that you take responsibility for this yourself.

Managing your contact preferences

When you first contribute to a Commonplace, you are given the opportunity to subscribe to updates about that Commonplace and updates about other Commonplaces in your area. You don’t get any updates without asking for them, so be sure to say Yes please, if you do!

You can manage your preferences for a Commonplace at any time on your Commonplace profile. We only want you to be contacted when you want to be, so we will always get your consent to contact you. You can withdraw your consent to receive communications from us by updating your preferences at any time on your Commonplace profile, or by contacting us at privacy@commonplace.is. You can also use the unsubscribe links on any email.

You will need to look at the privacy policy of the party setting up the Commonplace (which can usually be accessed via a link on the Commonplace) for information on how to manage how they use your data and to tell them if you want to withdraw your consent to their use of your data, or to update it or to stop using it.

Generally, Commonplaces have the following options:

  • Direct contact – you can consent to be contacted by an initiator or their project team about specific issues raised by you in your feedback and responses.
  • Project news and updates – you can consent to be contacted by an initiator or their project team with news and updates about the project.
  • Newsletter – you can consent to be sent newsletters which may be relevant to your area.
  • New Commonplaces – you can consent to be told about new Commonplaces in your local area.

IP addresses

We may collect information about your computer, including where available: your IP address, operating system and browser type. This may be used for system administration and to report aggregate information to initiators. This is statistical data about our users' browsing actions and patterns, and does not identify any individual.

Cookies

Our Commonplaces use cookies to distinguish you from other users and help us to provide you with a good experience when you browse our sites and allows us to improve our sites. For detailed information on the cookies we use and the purposes for which we use them see our cookie policy.

Keeping personal data secure

We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy.

Where you have chosen a password (for example if you are an  individual setting up a Commonplace or surveyor) which enables you to access certain parts of a Commonplace, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

Special category data is encrypted at rest and where possible anonymised when collected via a Commonplace.

You should look at the privacy policy of, or contact, the initiator of a Commonplace to find out what security they apply to your special category data as they are the controller of that data.

Unfortunately, the exchange of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our sites; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

Where we store your personal data

Our servers where we store personal data gathered from people who participate in Commonplaces are located in Europe. If we ever need to transfer personal data outside of Europe, we will follow the rules which govern that.

How and why we use information

For each use of personal data, the law requires something that is called a ‘lawful basis for processing’. This defines what each use of personal data is for, which category it fits into and why that’s allowed.

We use information held about you in the following ways:

  • Where we need to perform a contract – that’s the way the law puts it, but it’s essentially using your personal data to carry out something we’ve made a contract with you to do (for example, publishing your comments on a Commonplace).
  • Where it’s necessary for our legitimate interests – this is where we or a third party have a legitimate interest in using your personal data and your interests or fundamental rights don’t override it (for example, including your identifiable comments in a Commonplace as part of a planning application). You have the right to object to this processing if you wish, and if you wish to do so please see the “Your Rights” section below. Please bear in mind that if you object this may affect our ability to carry out the tasks identified in the table above for your benefit and may defeat the object of your participation in the Commonplace.
  • Where we have your consent to do so – this is where you clearly say to us it’s OK to do something (for example, you ask us to send you news and updates in your preferences).
  • Where we need to comply with a legal or regulatory obligation – this one is probably self-explanatory, but if there’s a law that says we need to keep or hand over some personal data, or if someone in authority asks us to, we’ll follow the rules.

Those are generally the categories under the law which we rely on for it to be OK for us to process personal data. If you’d like to read more about these categories, please refer to the ICO website.

The table below is a bit more detail on the how and why, and then tells you the lawful basis.

 

The sort of data we might use

When we might ask you for it

How and why we might use it

The legal basis on which we use it

Your identity and contact data (email address and/or password)

 

When you contribute to, or log into a Commonplace site.

Your email address is our primary method to identify you, and the contributions and information that belong to you.

Perform a contract – we need to do this to provide our site to you and to initiators.

 

Your identity, contact data (email address and/or password), technical data, profile, usage, marketing and communications and technical data.

When you use our services on the site.

To provide you with the services and functionality on our site.

Perform a contract – we need to do this to provide our site to you and to initiators.

 

Your identity, contact data (email address and/or password), technical data, profile, usage, marketing and communications and technical data.

When you subscribe to news, newsletters or contact emails.

To provide you with information that you request from us (for example, to be kept up to date about your local Commonplaces).

Consent – where you have consented to communications.

 

Your identity, contact data (email address and/or password), technical data, profile, usage, marketing and communications and technical data.

When you subscribe to news, newsletters or contact emails.

To provide you with information which we feel, based on the options you have selected, may interest you (for example, to tell you about new Commonplaces or other initiatives which may be of interest to you).

Legitimate interests – it is in our legitimate interests to consider what may interest you.

 

Consent – where you have consented to communications

Your identity, contact data (email address and/or password), and technical data

 

 

When you contribute to, or log into a Commonplace site.

To ensure that content from our site is presented in the most effective manner for you and for your device.

Legitimate interests – it is in our legitimate interests to make sure our site is presented nicely

Your identity, contact data (email address and/or password), technical data, profile, usage, marketing and communications and technical data.

When you contribute to, or log into a Commonplace site.

To provide you with services that you request from us (for example, to participate in a Commonplace).

Perform a contract – we need to do this to provide out site to you and to initiators.

 

Your identity, contact data (email address and/or password), technical data, profile data, usage, marketing and communications and technical data.

When you contribute to, or log into a Commonplace site.

To allow you to participate in interactive features of our service, when you choose to do so.

Legitimate interests – it is in our legitimate interests to offer features on our site which we consider will enhance our service.

 

 

Your identity, contact data (email address and/or password), and technical data

When you contribute to, or log into a Commonplace site.

To notify you about status and changes to our service.

Legitimate interests – it is in our legitimate interests to keep users of our site updated about the site.

Your identity, contact data (email address and/or password), technical data, profile data, usage, marketing and communications and technical data.

When you contribute to, or log into a Commonplace site.

To manage and improve our day-to-day operations.

Legitimate interests – it is in our legitimate interests to analyse how our site is being used and use that information to improve our business operations.

Your identity, contact data (email address and/or password), technical, and usage data

When you contribute to, or log into a Commonplace site.

To help to develop and improve our services, information technology systems and know-how.

Legitimate interests – it is in our legitimate interests to monitor our site is being used and use that information to improve our technology systems and know-how.

Your identity and contact data (email address and/or password)

When you contribute to, or log into a Commonplace site.

To contact you about a comment that you have made on a Commonplace site.

Consent - where you have consented to communications about feedback you have made.

Your identity, contact data (email address and/or password), technical, usage and profile data

When you contribute to, or log into a Commonplace site.

To deal with feedback and complaints about our site.

Legitimate interests – it is in our legitimate interests deal with feedback and complaints.

Your identity, contact data (email address and/or password), technical data, profile data, usage, marketing and communications and technical data.

When you contribute to, or log into a Commonplace site.

To respond to law enforcement or regulators about users of our site.

Legal or regulatory obligation – we need to do this so that we do not break the law.

Anonymised information

All Commonplaces are publicly available on the internet.

If you contribute to a Commonplace, your feedback and any agreements added by you, are anonymised before being made available publicly to anyone who has an interest in the information. The words of your feedback and your agreements may be used for further analysis, but they won’t know your identity unless you shared something in your comment that reveals that (see section ‘If you wish to remain publicly anonymous’ above).

Sharing your information

In addition to sharing information with Initiators and the Team as identified and described in the “Information We Collect and Why” section above, we also share it as follows:

Who is it shared with?

Why?

Other users of the site.

It might be a bit obvious saying this, but: if it’s on the site, it’s public – so that’s like sharing it with the world.

Service providers (e.g. technology providers).

To enable us to run our business and provide the site.

For example, companies that we buy IT services from (storage, software and connectivity).

Where we engage a third party to process personal data on our behalf, we enter into a contract with them which contains standard clauses to ensure they process personal data in compliance with the law.

Our key service providers are below and you can learn more about the privacy of their services at each of their websites:

  • Amazon Web Services
  • Sendgrid
  • MongoDB Atlas
  • Helpscout
  • Hubspot
  • Sendgrid
  • Google (Drive and Gmail)

HM Revenue & Customs, regulators and other authorities

Compliance and reporting

Professional advisers, including lawyers, bankers, auditors and insurers

They provide consultancy, banking, legal, insurance and accounting services to us.

 

Third party links

Our site may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility for these third parties.

Please check their privacy policies before you submit any personal data to these websites (and that includes checking the privacy policies of the initiator of the Commonplace and the parties identified on the Team page of the Commonplace).

Advertising on websites invariably involves some form of tracking. We don’t place any of these trackers ourselves, but many third parties do. Learn more about this on the Your Online Choices Website.

Disclosure of your information

We may disclose your personal information to any member of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries.

We may disclose your personal information to third parties, including:

  • In the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets.
  • If Commonplace Digital Ltd, or substantially all of its assets, are acquired by a third party, in which case personal data held by it about its customers will be one of the transferred assets.
  • If we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms of use and other agreements; or to protect the rights, property, or safety of Commonplace Digital Ltd, our customers, or others.

If we are asked to as part of them seeking to exercise of defend their legal rights (for example, as part of a planning application or a judicial review).

How long we keep your information

We will only keep your information for as long as necessary to carry out the purposes for which we collected it. This will depend on the type of information and the types of legal and contractual obligations we must comply with.

We don’t want to keep personal data for longer than is necessary, so when we are deciding how long to keep each category of personal data, we think about the following things: how much data we have, whether it’s sensitive or not, what kind of harm there could be if there were an unauthorised disclosure.

We use also use the following criteria to determine how long we should keep your data for:

  • Whether or not you are actively using your Commonplace profile;
  • Whether or not you are opening emails that we send to you with communications we think you are interested in;
  • If we are required by law to keep your information for a certain period of time;
  • If we will need to keep copies of correspondence with you to resolve complaints.

If you have not logged-into a Commonplace website or you have not opened emails from us for a period of 2 or more years we may close your account and delete your information. We will contact you before we do this to ask you if you want us to do this or if you want us to keep your account open and if you want us to continue to communicate with you.

The periods for which initiators will keep your data will vary by Commonplace, so if you have a question about how long personal information is kept for each Commonplace, please check the privacy policy of the initiator of the Commonplace. The initiator of the Commonplace will have their own periods for which they keep personal data. As a rule of thumb, you should expect them to keep personal data for as long as any planning process or appeals may be ongoing. For more information you should check the privacy policies of the initiator of the Commonplace, which you can find on the Team page of that Commonplace.

Your rights

Under the General Data Protection Regulation you have the following rights:

  • The right to be informed – that’s us telling you what we do with your personal data (which we do in our screens and forms and via this privacy policy).
  • The right of access – it’s the same right as under the Act, the ability for you to ask us what information we hold about you and how it’s used.
  • The right of rectification – that’s an obligation on us in certain circumstances to correct your personal data if it’s inaccurate or incomplete.
  • The right to erasure – that’s an obligation on us in certain circumstances to delete or remove your personal data where there is no compelling reason for its continued processing (some people also call this right ‘the right to be forgotten’).
  • The right to restrict processing – that’s an obligation on us in certain circumstances to stop actively processing your personal data.
  • The right to data portability – that’s an obligation on us in certain circumstances to allow you to transfer your personal data from us to a third party.
  • The right to object – that’s an obligation on us in certain circumstances to allow you to object to us processing your personal data where we do not have an overriding reason.

Not all of these rights will be relevant to your use of Commonplace, just because of the nature of our site, but they are important rights and we want to make sure you know about them. If you’d like to read more about them, you can get more information about the rights here.

Your Commonplace profile lets you exercise a lot of these rights. You can download, amend your personal data and close your Commonplace profile altogether.

If you have any questions, please contact privacy@commonplace.is.

When you contact us, we need to be sure it’s you. We may need to ask you to confirm your identity – this is an important security measure so that we don’t disclose personal data to any person who doesn’t have the right to receive it.

We try to respond within a month (30 days), but if your request is complex or you’ve made a number of different requests, it may take us longer. If that’s the case, we’ll keep you updated.

Like we say above, no fee is usually required, but we may charge if a request is clearly unfounded, repetitive or excessive.

If you wish to exercise Your Rights in respect of data controlled by the initiator or any of their partners you should check their respective privacy policies for details on how to do this directly with them.

Changes to our privacy policy

Any changes we may make to our privacy policy in the future will be posted on this page and, where appropriate, notified to you by email.

Contact

Got any questions? Please contact us by email: privacy@commonplace.is.

Complaints

If you have any complaints about the way in which we collect, store and use your information, and these have not been addressed by contacting us first, you can contact the supervisory authority in the United Kingdom, the Information Commissioner’s Office: https://ico.org.uk/concerns

Last updated: 26 February 2020