Cratus is processing your data, in the UK, on behalf of our client, for the purposes of community / political engagement, community / political consultation and / or research.
There are six lawful grounds on which we can process data. The relevant one in this instance is:
We will usually collect your name, email address and phone number and, if relevant, information about your organisation, including the name of your organisation and region as well as any history that is relevant in that it might have a bearing on the project.
Certain categories of personal information are categorised as sensitive, including health information, ethnicity and political opinions. We may collect sensitive personal data about you. We would only collect sensitive personal data if there is a clear reason for doing so; and on the basis that our processing relates to personal data which has been manifestly made public by you as the data subject.
We will only ever share your information with the project team and the relevant Local Planning Authority, should our processing be part of a planning application.
As a resident your data is only shared showing your street name and feedback.
As a councillor if you are responding to a consultation on a planning project we will share your name in connection to your views.
If you are providing feedback on behalf of a community group or parish council for example we will share the name of that body with the consultant team.
We may also share your data with our third-party service providers, agents, subcontractors and other associated organisations for the purposes of completing tasks and providing services to you (for example, our sister company Rubber Duckiee or our preferred printers – V3Print).
These third parties have access to your Personal Information only to perform these specific tasks on our behalf and are obligated not to disclose or use it for any other purpose.
We will disclose your Personal Information where required to do so by law or in accordance with an order of a court of competent jurisdiction, or if we believe that such action is necessary to comply with the law and the reasonable requests of law enforcement or to protect the security or integrity of our Service.
Your information, including Personal Information, may be transferred to — and maintained on — computers located outside of your state, province, country or other governmental jurisdiction where the data protection laws may differ than those from your jurisdiction. This is because we work with trusted suppliers, for example Mailchimp and Dropbox which are US companies.
Security of your data is important to us and is maintained on password protected systems, our computers are protected by Symantec.
We will minimise your data as far as possible. If you are responding to a consultation on a project / application that is the first phase or one of many phases of a wider regeneration scheme, then we will keep your information on file until all phases are complete, so we can update you as to the progress of future phases as and when they come forward.
If not, your data will be kept on our system for the duration of the scheme progressing through planning and for up to one year after the signing of the S106 agreement so that if necessary we can update you with key information following any grant of planning consent.
Should we be processing your data on behalf of a client for the purposes of research we will keep it on our system for a maximum of ten years, as far as possible information will be minimised.
(1) Right to be informed – you have the right to be told how your personal information will be used. This Policy is intended to provide you with a clear and transparent description of how your personal information may be used.
(2) Right of access – you can write to us to ask for confirmation of what information we hold on you and to request a copy of that information. Provided we are satisfied that you are entitled to see the information requested and we have successfully confirmed your identity, we have 30 days to comply.
(3) Right of erasure – you can ask us for your personal information to be deleted from our records.
(4) Right of rectification – if you believe our records of your personal information are inaccurate, you have the right to ask for those records to be updated.
(5) Right to restrict processing – you have the right to ask for processing of your personal data to be restricted if there is disagreement about its accuracy or legitimate usage.
(6) Right to data portability – to the extent required by the General Data Protection Regulations (“GDPR”) where we are processing your personal information (i) under your consent, (ii) because such processing is necessary for the performance of a contract to which you are party or to take steps at your request prior to entering into a contact or (iii) by automated means, you may ask us to provide it to you – or another service provider – in a machine-readable format.
For more information please either write to us at:
Data Protection, Cratus, West Wing, 25 Lavington Street, SE1 0NZ
Or email us at firstname.lastname@example.org
Or call us on 0208 629 7190.