Our Privacy Policy

Commonplace Digital Ltd - Privacy policy

COMMONPLACE DIGITAL LTD are committed to protecting and respecting your privacy.

Who are we

COMMONPLACE DIGITAL LTD with a registered office at:

1st Floor Cloister House,
Riverside,
New Bailey Street,
Manchester,
M3 5FS

For the purposes of the Data Protection Act 2018 we are the controller of the personal data we collect for certain purposes as described in this privacy policy.

We also act as a processor of personal data that Initiators collect using our engagement platform. In those cases it is the Initiator that is the controller. (See 'The team' page on the relevant Commonplace for more information on Initiators and the other organisations in the Team. You can reach this page via the main navigation or following this URL: https://<projectname>.commonplace.is/project-team).

We are registered with the Information Commissioner’s Office in the United Kingdom with registration number: ZA074797

What we do

We want to be really clear about what we do, because it sets the scene for how and why we collect and process personal data.

Personal data means any information about a living individual from which that person can be identified (but not data where the identity has been removed, like anonymous data).

Commonplace.is (referred to as our site or a Commonplace in this document) is an online engagement platform, which helps developers, councils and city managers Initiators) engage with individuals in local communities – people just like you.

Initiators use our platform to gather information that may reveal issues and suggest solutions, as well as for statutory consultation and formal planning applications. The specific data categories collected vary for each Commonplace and it’s up to the Initiator of each Commonplace (as controller) to decide what they would find helpful for their engagement purposes. The categories of data collected by the Initiator will be described in more detail in their privacy policy which is linked from the applicable Commonplace page.

We also help communities use the platform to plan their neighbourhoods, co-design solutions and analyse the social impact of new developments. We collect personal data in order to do this and where we do so we are the controller of that personal data.

We can’t make good community engagement happen without collecting, using and sharing personal data.

In this privacy policy, each individual engagement project is called a Commonplace. Each Commonplace is publicly available and you can see them on the Commonplace places page.

We explain all the details about how we collect, use and process personal data below. If you have any questions (including in relation to how we and the Initiator may use your data as independent controllers), please email privacy@commonplace.is.

Who we work with

We make it clear to you who initiated the Commonplace. It could be a developer, council or city manager, or it could be an architect or agency working for them, or it could even be someone who wants to make something happen in their community. In this policy we refer to a number of people and organisations:

How we collect information

We collect data from you in a number of different ways, depending on how you interact with us.

You can interact with us directly, for example through one of our Commonplaces. Or you can interact with us via someone else, for example by filling in a paper or digital questionnaire in your local area (this data is then provided to us for use in the Commonplace).

If you interact with us directly, we may collect data from you:

• Via a Commonplace
• By email
• Over the phone
• In person.

When you interact by responding to a question or survey, you can post material by typing a response on your device, or in some cases you can choose to record a voice comment. In either case you must limit your response to the question being asked and not reveal any private or personal data about yourself. If you do include personal data in a response then you will be consenting for it to be shared publicly.

If you choose to record a voice comment, this will be saved as a digitally recorded file that will be shared publicly. 

We may also be given data about you from third parties:

• From an Initiator and the Team (this will include people you interact with locally who may ask you for feedback and record it on a Commonplace).
• From service providers who we engage on our behalf.
• From publicly available sources.

We may also automatically collect some technical data about your equipment, browsing actions and patterns.

Information we collect and why

We set out in the table below the categories of data we may collect about you when you visit a Commonplace or if you contact us by other means. We also include the how and why and tell you what the lawful processing basis is for each. A summary of these lawful bases is provided below the table.

Our lawful bases of processing:

• Where we need to perform a contract – that’s the way the law puts it, but it’s essentially using your personal data to carry out something we’ve made a contract with you to do (for example, publishing your comments on a Commonplace).
• Where it’s necessary for our legitimate interests – this is where we or a third party have a legitimate interest in using your personal data and your interests or fundamental rights don’t override it (for example, including your identifiable comments in a Commonplace as part of a planning application). You have the right to object to this processing if you wish, and if you wish to do so please see the “Your Rights” section below. Please bear in mind that if you object this may affect our ability to carry out the tasks identified in the table above for your benefit and may defeat the object of your participation in the Commonplace.
• Where we have your consent to do so – this is where you clearly say to us it’s OK to do something (for example, you ask us to send you news and updates in your preferences).
• Where we need to comply with a legal or regulatory obligation – this one is probably self-explanatory, but if there’s a law that says we need to keep or hand over some personal data, or if someone in authority asks us to, we’ll follow the rules.

Special category data

Special category (i.e. sensitive) data may be collected via a Commonplace.

The types of special category data collected by Initiators on a Commonplace vary depending on the nature of the project but typically the following types of data are collected:

• Race or ethnicity: For each Commonplace, it helps identify how many residents have been reached in an ethnic group.
• Health: For some Commonplaces, it helps identify if the needs of people with disabilities or other health issues are being properly and fully considered.
• Gender identity: For some Commonplaces it is helpful identify gender identity to monitor diversity of responses.
• Sexual Orientation: For some Commonplaces it is helpful identify sexual orientation in order to monitor diversity of responses.
• Religion: For some Commonplaces it is helpful identify religion in order to monitor diversity of responses.

We do not use this special category data for our own purposes. We are only responsible for facilitating its collection for Initiators and for processing it in accordance with their instructions.

It is not mandatory for you to provide special category data. If you choose to provide special category data (and consent to its use) you can withdraw your consent at any time by logging into and amending your profile on the Commonplace. Their details can be found in their privacy policy.

Please note that special category data is generally anonymised on collection and once it has been anonymised it cannot be linked to you or identify you in any way.  In limited instances Initiators will have access to special category data in a pseudonymised way, such that they can link your special category data to your other answers, but never to your email address or other personal identifiers.

More information on the purposes for which any special category data is collected for each Commonplace, who the controllers will be and what they will do with this data is available on the demographics page on the Commonplace where this information is collected.

You should be aware that responses you might give to some questions on the Commonplace may reveal or concern special category data. You should bear this in mind when responding. Also see the section below on remaining publicly anonymous.

If you wish to remain publicly anonymous

If you contribute to a Commonplace, your feedback and any agreements added by you, are anonymised before being made available publicly to anyone who has an interest in the information. The words of your feedback and your agreements may be used for further analysis or to provide examples of feedback in marketing material, but your identity will not be revealed unless you shared something in your comment that reveals your identity.

If you do not want to be identified with material posted by you then you should not include your name or any identifying information in the material posted, whether you post the material as a typed comment or a recorded voice comment. We don’t review feedback before it’s published, so it’s important that you take responsibility for this yourself.

Managing your contact preferences

When you first contribute to a Commonplace, you are given the opportunity to subscribe to updates about that Commonplace and updates about other Commonplaces in your area. You don’t get any updates without asking for them, so be sure to say Yes please, if you do!

You can manage your preferences for a Commonplace at any time on your Commonplace profile. We only want you to be contacted when you want to be, so we will always get your consent to contact you. You can withdraw your consent to receive communications from us by updating your preferences at any time on your Commonplace profile, or by contacting us at privacy@commonplace.is. You can also use the unsubscribe links on any email.

You will need to look at the privacy policy of the party setting up the Commonplace (which can usually be accessed via a link on the Commonplace) for information on how to manage how they use your data and to tell them if you want to withdraw your consent to their use of your data, or to update it or to stop using it.

Generally, Commonplaces have the following options:

• Direct contact – you can consent to be contacted by an Initiator or the Team about specific issues raised by you in your feedback and responses.
• Project news and updates – you can consent to be contacted by an Initiator or the Team with news and updates about the project.
• Newsletter – you can consent to be sent newsletters which may be relevant to your area.
• New Commonplaces – you can consent to be told about new Commonplaces in your local area.

In order to evaluate the impact we make to communities we will send you an email to gather short feedback. You may unsubscribe using the links in these emails.

IP addresses

We may collect information about your computer, including where available: your IP address, operating system and browser type. This may be used for system administration and to report aggregate information to initiators. This is statistical data about our users' browsing actions and patterns, and does not identify any individual.

Cookies

Our Commonplaces use cookies to distinguish you from other users and help us to provide you with a good experience when you browse our sites and allows us to improve our sites. For detailed information on the cookies we use and the purposes for which we use them see our cookie policy.

Email tracking

After you share your email address on Commonplace, by either contributing or subscribing, you will receive emails from Commonplace, for example confirming that you are a real person. All emails received from Commonplace include tracking which helps us understand if the email that was sent was delivered, and if it was opened or clicked, registering also the count of opens and clicks on each link.

Keeping personal data secure

We have taken all appropriate technical, physical and organisational security measures to ensure that your data is protected against unauthorised access, use and disclosure, including encryption of special category data at rest. Unfortunately, the exchange of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our sites; any transmission is at your own risk.

Where you are invited to choose a password (for example if you are an individual setting up a Commonplace or surveyor) which enables you to access certain parts of a Commonplace, you are advised to choose a non-guessable password and you will need to follow the password rules which are outlined when you create your account or change your password.

You should look at the privacy policy of, or contact, the Initiator of a Commonplace to find out what security they apply to your data as they are the controller of that data.

Where we store your personal data

Our servers where we store personal data gathered from people who participate in Commonplaces are located in London, UK. If we ever need to transfer personal data outside of the European Economic Area, we will take all steps reasonably necessary to ensure that your data is subject to appropriate safeguards, such as relying on a recognised adequacy decision or standard contractual clauses, and that it is treated securely and in accordance with this privacy policy. If you would like more information about these safeguards, please contact us at privacy@commonplace.is.

Sharing your information

In addition to sharing information with Initiators and the Team, we also share it as follows:

Third party links

Our site may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility for these third parties.

Please check their privacy policies before you submit any personal data to these websites (and that includes checking the privacy policies of the initiator of the Commonplace and the parties identified on the Team page of the Commonplace).

Advertising on websites invariably involves some form of tracking. We don’t place any of these trackers ourselves, but many third parties do. Learn more about this on the Your Online Choices Website.

Disclosure of your information

We may disclose your personal information to any member of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries.

We may disclose your personal information to third parties, including:

• In the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets.
• If Commonplace Digital Ltd, or substantially all of its assets, are acquired by a third party, in which case personal data held by it about its customers will be one of the transferred assets.
• If we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms of use and other agreements; or to protect the rights, property, or safety of Commonplace Digital Ltd, our customers, or others.

If we are asked to as part of them seeking to exercise of defend their legal rights (for example, as part of a planning application or a judicial review).

How long we keep your information

We will only keep your information for as long as necessary to carry out the purposes for which we collected it. This will depend on the type of information and the types of legal and contractual obligations we must comply with.

We don’t want to keep personal data for longer than is necessary, so when we are deciding how long to keep each category of personal data, we think about the following things: how much data we have, whether it’s sensitive or not, what kind of harm there could be if there were an unauthorised disclosure.

We use also use the following criteria to determine how long we should keep your data for:

• Whether or not you are actively using your Commonplace profile;
• Whether or not you are opening emails that we send to you with communications we think you are interested in;
• If we are required by law to keep your information for a certain period of time;
• If we will need to keep copies of correspondence with you to resolve complaints.

If you have not logged-into a Commonplace website or you have not opened emails from us for a period of 2 or more years we may close your account and delete your information. We will contact you before we do this to ask you if you want us to do this or if you want us to keep your account open and if you want us to continue to communicate with you.

The periods for which initiators will keep your data will vary by Commonplace, so if you have a question about how long personal information is kept for each Commonplace, please check the privacy policy of the initiator of the Commonplace. The initiator of the Commonplace will have their own periods for which they keep personal data. As a rule of thumb, you should expect them to keep personal data for as long as any planning process or appeals may be ongoing. For more information you should check the privacy policies of the initiator of the Commonplace, which you can find on the Team page of that Commonplace.

Your rights

Under the General Data Protection Regulation you have the following rights:

• The right to be informed – that’s us telling you what we do with your personal data (which we do in our screens and forms and via this privacy policy).
• The right of access – it’s the same right as under the Act, the ability for you to ask us what information we hold about you and how it’s used.
• The right of rectification – that’s an obligation on us in certain circumstances to correct your personal data if it’s inaccurate or incomplete.
• The right to erasure – that’s an obligation on us in certain circumstances to delete or remove your personal data where there is no compelling reason for its continued processing (some people also call this right ‘the right to be forgotten’).
• The right to restrict processing – that’s an obligation on us in certain circumstances to stop actively processing your personal data.
• The right to data portability – that’s an obligation on us in certain circumstances to allow you to transfer your personal data from us to a third party.
• The right to object – that’s an obligation on us in certain circumstances to allow you to object to us processing your personal data where we do not have an overriding reason.

Not all of these rights will be relevant to your use of Commonplace, just because of the nature of our site, but they are important rights and we want to make sure you know about them. If you’d like to read more about them, you can get more information about the rights here.

Your Commonplace profile lets you exercise a lot of these rights. You can download, amend your personal data and close your Commonplace profile altogether.

If you have any questions, please contact privacy@commonplace.is.

When you contact us, we need to be sure it’s you. We may need to ask you to confirm your identity – this is an important security measure so that we don’t disclose personal data to any person who doesn’t have the right to receive it.

We try to respond within a month (30 days), but if your request is complex or you’ve made a number of different requests, it may take us longer. If that’s the case, we’ll keep you updated.

Like we say above, no fee is usually required, but we may charge if a request is clearly unfounded, repetitive or excessive.

If you wish to exercise Your Rights in respect of data controlled by the initiator or any of their partners you should check their respective privacy policies for details on how to do this directly with them.

Changes to our privacy policy

Any changes we may make to our privacy policy in the future will be posted on this page and, where appropriate, notified to you by email.

Contact

Got any questions? Please contact us by email: privacy@commonplace.is.

Complaints

If you have any complaints about the way in which we collect, store and use your information, and these have not been addressed by contacting us first, you can contact the supervisory authority in the United Kingdom, the Information Commissioner’s Office: https://ico.org.uk/concerns

Last updated: 21 Aug 2024