Privacy Notice
Last updated: 8th September 20261. Who we are
CllrWay Ltd operates the CllrWay platform. Our registered office is 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. For data protection enquiries, contact info@cllrway.com.
When we are a data controller: We determine how and why personal information is used for our own business operations, including customer accounts, enquiries, support, subscription administration and security of the service.
When we are a data processor: Where councillors, candidates, political organisations or other authorised customers use CllrWay to manage resident casework, electoral information, canvassing, surveys or other records, the relevant customer or organisation generally determines the purpose of that processing. In these circumstances, we process the information on the relevant controller's documented instructions, under the applicable customer and data processing arrangements. The identity of the controller depends on who is responsible for the particular activity; it is not necessarily the council or the person who has logged in.
2. Personal data we process
Information we process for our own business purposes
Account and profile information — name, email address, council or ward affiliation, account role, profile details and account preferences.
Service and security information — sign-in activity, IP addresses, browser/device information, access records and relevant technical logs.
Business communications — enquiries, support requests, correspondence and feedback sent to CllrWay Ltd.
Subscription and billing information — information needed to administer paid services and account records, where applicable.
We generally receive this information from you, your sign-in provider, your organisation or your use of the CllrWay service. Basic account and sign-in information is needed to provide a user account; importing a resident or electoral dataset is not required to create an account.
Information processed on behalf of customers
Resident and electoral register information — names, addresses, postcodes, electoral identifiers and other information provided by an authorised customer. This may include information from the full electoral register, which is not the same as the publicly available open register.
Casework information — residents' enquiries, correspondence, contact details, issue descriptions, documents, notes and follow-up actions. Some records may include sensitive personal information.
Canvassing information — visit outcomes, contact history, canvassing notes and responses, which may include information revealing political opinions.
Survey information — responses to surveys created by customers and any contact or other details respondents choose to provide, together with associated technical identifiers used by the survey service.
Customer correspondence — emails, attachments and communications handled through the platform's integrated email features.
This information may be supplied by councillors, candidates, political organisations or other authorised users, or collected when residents communicate with them or answer their surveys. The relevant data controller is responsible for its own privacy information and for ensuring that the source and intended use of data are lawful.
3. Lawful basis for processing
CllrWay Ltd acting as data controller
Where we decide the purpose of processing, we rely on the following UK GDPR lawful bases, as applicable to the particular circumstances:
| Purpose | Lawful basis |
|---|---|
| Providing accounts and services to an individual customer | Contract — Article 6(1)(b) |
| Administering accounts for organisations, handling enquiries and providing support | Legitimate interests — Article 6(1)(f), in operating and supporting our service; contract where Article 6(1)(b) applies |
| Protecting accounts, preventing misuse, investigating security incidents and maintaining audit records | Legitimate interests — Article 6(1)(f), in keeping the service and customer information secure; legal obligation where applicable |
| Managing payments and retaining required accounting or tax records | Contract or legitimate interests, as applicable; legal obligation — Article 6(1)(c) — for mandatory records |
| Responding to legal requirements and handling rights requests for which we are responsible | Legal obligation — Article 6(1)(c), where applicable |
CllrWay Ltd acting as data processor
For customer-controlled resident records, casework, electoral registers, canvassing and surveys, the relevant controller is responsible for determining and documenting the applicable lawful basis under Article 6 of the UK GDPR. CllrWay Ltd does not adopt its own separate lawful basis for using that customer-controlled information for the customer's purposes.
Some customer records may contain special-category data, including political opinions or information about health. Where such data is processed, the controller must also identify an applicable Article 9 condition and meet any additional legal requirements. The presence of information in CllrWay does not itself establish permission to use it for another purpose.
4. How information is used
Our own business information is used to operate and secure CllrWay, manage customer relationships, handle support requests, administer subscriptions and meet our legal obligations. We may use customer feedback and appropriately aggregated or anonymised operational information to improve the service.
Customer-controlled information is processed to provide the functions requested by the relevant controller, including casework management, resident records, correspondence, electoral canvassing, surveys and reporting. We do not independently use identifiable casework, resident or canvassing data for our own advertising, marketing or unrelated product-development purposes, and we do not sell that information.
Electoral register restrictions: The full electoral register may only be obtained, used and disclosed by those authorised to do so and for their permitted purposes. Customers are responsible for confirming that they have authority to import and use it. Electoral information is not automatically authorised for general-purpose casework, and casework information must not automatically be repurposed for political campaigning.
CllrWay provides tools that customers may use to analyse and manage their own records. The relevant controller remains responsible for explaining any profiling or decisions it carries out using those records and for meeting the applicable data protection requirements.
5. Who information may be shared with
We use service providers to operate CllrWay. Depending on the services enabled, these may include:
Microsoft Azure — application hosting, database infrastructure and file storage.
Microsoft Entra ID — authentication and identity services.
Stripe — subscription payment services, where paid subscriptions are enabled.
Email delivery services — delivery of messages where that facility is used, including customer-configured email arrangements.
Some service providers may act as processors or sub-processors; others may act as separate controllers for particular activities. Where a provider processes customer-controlled data on our behalf, the applicable controller authorisation and contractual arrangements govern that processing.
Customer-controlled information may also be made available to people the relevant controller has authorised, using the platform's DataSet memberships and access permissions, or sent to recipients selected by the customer through its communication features.
We may also disclose information where required to comply with the law or a valid legal request. Some service providers or support arrangements may involve processing outside the UK. Where a restricted international transfer is made, we use an applicable UK adequacy arrangement, appropriate safeguards or another lawful transfer mechanism, as required. Details of relevant processing locations and customer-data sub-processors should be recorded in the applicable customer data processing documentation.
6. How long information is kept
Retention depends on whether we are the controller or are processing data on behalf of a customer. We keep information only as long as needed for its permitted purpose, subject to applicable legal requirements and documented retention arrangements.
Account and profile data — generally held while an account is active; following account deletion, associated personal account data is anonymised within 30 days, except information that must be retained for a lawful reason.
Customer DataSets, including resident and casework information — retained under the relevant controller's instructions and applicable agreement. Where an authorised controller deletes a DataSet, soft-deleted DataSets are scheduled for permanent purging after 30 days.
Security and audit logs — normally retained for 12 months, subject to any justified investigation or legal retention requirement.
Billing and accounting records — retained for up to 7 years where needed for accounting, tax or related legal obligations.
Deleting an individual user account does not necessarily delete a DataSet controlled by another person or organisation. Information contained in backups may remain temporarily until the relevant backup retention cycle expires, subject to the applicable arrangements. Different retention rules may apply to records that the controller is legally required to keep.
7. Your data protection rights
Depending on the circumstances and the lawful basis, you may have the following rights under the UK GDPR:
Access — ask for a copy of personal information held about you.
Rectification — ask for inaccurate information to be corrected.
Erasure — ask for information to be deleted where the legal conditions apply.
Restriction — ask for processing to be restricted in certain circumstances.
Portability — receive applicable information in a structured, machine-readable format where this right applies.
Objection — object to certain processing, including processing based on legitimate interests, where the right applies.
Withdraw consent — withdraw consent where it is the lawful basis for processing, without affecting earlier lawful processing.
Automated decisions — have rights relating to qualifying solely automated decisions, where applicable.
If you have a CllrWay account: You can manage profile information and use features in Profile → My Data to download the information made available there or request account deletion. These features do not necessarily provide a complete export of a customer-controlled DataSet or determine whether another controller may lawfully retain information.
If you are a resident whose information is held by a councillor, candidate or political organisation: The relevant controller is normally responsible for handling your request. You may contact that person or organisation directly. If you are unsure who the controller is, contact us and we will help direct the enquiry appropriately, while protecting other customers' information.
For requests concerning information we control, contact info@cllrway.com. We respond without undue delay, normally within one calendar month, subject to any lawful extension or clarification process. You also have the right to complain to the Information Commissioner's Office (ICO).
8. Cookies and tracking
We use cookies needed to operate the application securely, including authentication and session continuity. We do not use advertising, tracking or analytics cookies. Further information is available in the Cookie Notice linked from the website footer.
9. Security
We apply technical and organisational safeguards appropriate to the risks of processing, including HTTPS/TLS for data in transit, encryption at rest for database and file storage, role-based access control, DataSet permissions and audit logging of sensitive operations.
Authentication uses Microsoft identity services. We also use persisted, encrypted ASP.NET Core Data Protection key management. Access to customer DataSets is governed by server-side permissions rather than solely by what is displayed in the user interface. More information is available on the Security page linked from the website footer.
10. Changes to this notice
We may revise this notice as the service or applicable requirements change. Where material changes affect the way we process information, we will provide an appropriate notification. The date shown at the top indicates the version currently published.
Questions about this notice? Contact info@cllrway.com.