Privacy policy
Last updated 3 November 2026
This explains what personal data Untitled Unionisation Platform collects, why, who can see it and how long it's kept, and your rights under UK data protection law (the UK GDPR and the Data Protection Act 2018).
Who we are
Untitled Unionisation Platform is developed and run by Islay Anderson, who is the data controller: the person responsible for your personal data on it.
For anything about your data, email [email protected].
Each tenants' union on the platform is run by its own members. They decide what the union posts and sends, but not how the platform stores or protects your data.
What we collect
When you sign up
- your name and email address
- your password, which is stored scrambled (hashed) so nobody can read it, including us
- your phone number, if you choose to give it
- your building's address and the name of your flat or room
When you join and take part
- who vouched for you and who you vouched for, and when you became a member
- whether you voted in each referendum and poll, so you can't vote twice, but never how you voted. Votes are added to the totals without any link to you.
- roles you're elected to, and whether you left or were removed from the union
- what you write: bulletins, replies, discussions, polls, emails to landlords and your approvals of them, with the images and files you add. Images are compressed and their hidden details, such as the location a photo was taken, are removed.
- details of landlords, letting agents and other contacts that members add, and the replies they send to the union's emails
When you use the site
- while you're logged in, your IP address and the type of browser you use, kept with your session to keep your account secure
- when you last used the site, to the nearest hour, so we don't delete accounts that are still in use
- error logs, which can include the address of the page you were on
- feedback you send us, with your name and email address if you give them
- how many times each of our QR codes is scanned. We record which code and when, never who scanned it.
Why we use it
We only use your data to run the platform and your union. We never sell it or use it for advertising.
| What for | Lawful basis |
|---|---|
| Your account, your union and everything it does: vouching, posts, votes and emails | Providing the service you signed up for (contract) |
| Emails about your account and your union, such as votes and approvals | Providing the service you signed up for (contract) |
| Keeping accounts secure, preventing abuse and fixing problems | Our legitimate interest in a safe, working platform |
| Checking uploaded images against known child abuse images | Our legitimate interest in keeping illegal material off the platform |
| Details of landlords and agents that members add | The union's legitimate interest in contacting them about the building |
| Reading and replying to feedback you send | Our legitimate interest in improving the platform |
| Answering requests and complaints about your data | Legal obligation |
Being in a tenants' union, and how you take part, could say something about your views. We treat it as sensitive: it's only shown to members of your own union, and never to your landlord.
Who can see it
- Members of your union see your name, your flat and what you write. They don't see your email address or phone number.
- Tenants waiting to be vouched for can only see the vouching bulletin, including what you write there.
- Landlords and agents receive the union's emails, which are signed by the union and never name the member who wrote them. Images in those emails can be seen by anyone who has the email.
- The platform's administrators see only counts in the admin area, not names or what anyone wrote. To keep the platform running, they can access the database, and only do so when they need to.
-
Service providers who host and run parts of the platform for us, and only use your data to
do that:
- IONOS, which hosts our server and its database
- Cloudflare, which protects the site, stores and delivers uploaded images and files, and scans images for known child abuse material
- Geoapify, which looks up addresses when a building is registered. It's sent what you type in the address search, never your name or email.
Some providers may handle data outside the UK. When they do, they must protect it as UK law requires, for example with the UK's International Data Transfer Agreement or Addendum.
We'll only share your data with anyone else if the law requires it, such as a court order, or to report child abuse material.
Cookies
We only use cookies the site needs to work, which the law allows without asking for your consent. There are no analytics, advertising or tracking cookies, and nothing from other websites.
| Name | What it's for | Expires |
|---|---|---|
| untitled-unionisation-platform-session | Keeps you logged in as you move between pages | After 2 hours without activity |
| XSRF-TOKEN | Stops other websites sending forms as you | After 2 hours without activity |
| remember_web_… | Keeps you logged in on this device, only if you tick "Remember me" when logging in | When you log out, or after 400 days |
| cookie_banner_seen | Remembers that you've hidden the cookie message | 1 year |
How long we keep it
- Your account is kept until you delete it, or until we delete it because it's not in use.
- We delete accounts that don't confirm their email within 7 days.
- We may delete accounts that haven't chosen a building and flat after 30 days, or haven't been vouched for after 90 days.
- We may delete unions with no members where nobody has signed up for 90 days.
- We always email you a week before deleting your account or union, and logging in stops it.
- When you delete your account, we delete your details, sessions, vouches, voting records and roles. What you wrote stays in the union's records, shown as written by a former member, because other members rely on it.
- Copies of a union's records that we email to members who leave, are removed, or whose union is deleted are kept for 30 days for them to download, then deleted.
- Sessions end after 2 hours without activity.
Your rights
You have the right to:
- get a copy of the personal data we hold about you
- have it corrected if it's wrong
- have it deleted. You can delete your account yourself from your membership page.
- have us limit how we use it, or object to us using it
- get your data in a format you can take elsewhere
To use any of these rights, email [email protected]. We'll reply within one month. It's free.
Complaints
If you think we've mishandled your data, please tell us first so we can put it right.
Email [email protected]. We'll reply within one month.
You can also complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk/make-a-complaint (opens in new tab) or by phone on 0303 123 1113.
Changes to this policy
If we change how we use your data, we'll update this page and the date at the top. If a change affects you significantly, we'll email you first.