Privacy notice
This notice covers Tideswell community information: the public pages at tideswell.org.uk, the "Something changed? Tell us" box (on our pages, and on the tideswell.org.uk/tell-us page that other local websites link to from information they show from us) and the address tellus at tideswell dot org dot uk, and the editors' site at editors.tideswell.org.uk. It says who is responsible for the personal data involved, what we collect, why, how long we keep it, and what you can ask us to do.
Who is responsible
For now the service is run by Helpful Consultants Limited, a company registered in England and Wales (company number 02628048), whose registered office is Magna House, 18–32 London Road, Staines-upon-Thames TW18 4BP. The company is the data controller: it decides how the personal data described here is used, and it is responsible for it. It is registered with the Information Commissioner's Office, registration number ZB047546.
The company holds this role only until a community group in Tideswell is ready to take it over as data controller. When that happens we will update this notice, and say so on the site first.
To ask anything about your data, email privacy at tideswell dot org dot uk.
If you only look at the pages
- You do not need an account. The pages set no cookies, store nothing in your browser, and use no tracking, analytics or advertising.
- "Near me" works only if you press the button and your browser asks you first. Your position is sent once, to find what is nearby, and is not stored. The map then moves to your area, so your browser fetches the map pictures for it from OpenStreetMap, which sees your internet address and that area.
- Like any website, the services that deliver the pages and the information keep short-lived technical logs, such as your IP address and the time of a request (see "Who handles data for us").
- Some parts of the page come from other organisations' servers, which therefore see your IP address: the map (OpenStreetMap's tile servers, which are also told the request comes from tideswell.org.uk, as their rules require, but not which page), the map software (Cloudflare's cdnjs) and some photographs (Wikimedia Commons and Geograph). They handle that under their own privacy notices.
If you send us a note
What we receive. What you write and which item it is about. Your email address or phone number only if you choose to give it. If you write by email: your address, the name your email program shows, the subject and the text, and the names and sizes of any attachments, but not the attachments themselves.
Why. To check and correct the information, and, if you left an address, so that an editor can write back to ask a question or tell you what changed. Our lawful basis is legitimate interests: keeping community information accurate, and answering people who write to us. Leaving an address is up to you.
Who sees it. The volunteer editors for the community your note is about, and the service's administrators. Nothing you write is published as you wrote it; editors may use the information in it to update an entry.
Replies. If an editor writes back, the email comes from tellus at tideswell dot org dot uk. We never send anything automatically to an address someone types in; an editor writes only in answer to a note. If you get an email from us about a note you did not send, someone else typed your address, and you can ignore it: an address that has not answered us can be sent at most two emails. If an email we send you cannot be delivered, or you mark it as spam, our email service tells us: we note that, with the mail server's short reason (kept for 90 days), and send no more emails to your address. The note stays with the scrambled fingerprint of your address; ask us and we will lift it, with our email service too, and keep a short record that we did.
How long. Your email address or phone number, and your name as your email program shows it, are deleted automatically 90 days after you last wrote to us, including wherever your address appears in what you wrote. What you wrote, and any replies, stay with the record of that item so that editors can see where a change came from, and are removed two years after we have finished with the item. After that we keep only a scrambled fingerprint of your address (a one-way code), which lets us recognise a sender we have blocked, or match an answer to an earlier note, but does not hold your address. Ask us and we will delete anything sooner.
If you are an editor
What we hold. The address you sign in with, the name you choose to show other editors, the roles you have, and a history of the changes and decisions you make: who did what, and when. If you add a passkey, only its public part is stored; the private part never leaves your device or password manager. Our sign-in service keeps records of sign-ins.
Why. To run the editing screens securely and to be able to show who changed what. Our lawful basis is legitimate interests.
Previewers. People who help us design the hub can be given a previewer account, which signs in the same way and shows the whole hub, including entries that are not public yet, but changes nothing. We hold the same details about them as about editors.
In your browser. The editors' site keeps your sign-in in your browser's storage, and remembers if you dismiss the suggestion to add a passkey. Nothing else, and no tracking.
How long. Your account and roles last as long as you edit with us. Our copy of your sign-in address is cleared after a year with no role and no sign-in. The history of changes is kept, because it records who decided what. You can ask us to close your account at any time.
Organisations' details we publish
We publish organisations' contact details, such as role email addresses, business phone numbers and websites, with where each came from and when it was last checked. We check them against each organisation's own website, any calendar feed it gives us, and public registers (the Food Standards Agency's food hygiene ratings, the Charity Commission's Register of Charities and Companies House): by hand, and with a weekly automatic check whose findings an editor reviews before anything changes. The check looks only for facts about the organisation; it leaves out personal email addresses and mobile numbers, and keeps nothing about the people named on those pages or in those registers (trustees, directors, their addresses). If an entry shows your own personal details and you would like them changed or removed, use "Something changed? Tell us" on that entry, or email privacy at tideswell dot org dot uk.
Asking before we publish. We publish a club's, group's, charity's or business's entry, and its events, only once it has agreed after seeing exactly what we would share; public bodies and public places, such as the parish council, bus stops and car parks, need no asking. When someone answers for an organisation, through the private preview link we send or by email, phone, letter or in person, we keep their name, their role (such as secretary or owner), when and how they answered, any reason they gave, and what they were shown, as a record of who agreed or said no. Only our editors see it. Our lawful basis is legitimate interests: being able to show that an organisation agreed before we published it. We keep it for as long as we hold the entry. The preview link works for 30 days, and we keep only a scrambled form of it, so we cannot read it back.
Who handles data for us
- Supabase keeps our database in London: the notes people send, their addresses for 90 days, editors' accounts and replies. It also runs the small programs that receive emails and send replies. This is where the personal data described here is stored.
- Resend sends the emails we send, from Ireland: editors' sign-in emails and replies to people who wrote to us. It sees each email's address and text, keeps a log of sent emails for 30 days, and tells us whether each email was delivered.
- Cloudflare runs the tideswell.org.uk domain. Emails sent to tellus@ or privacy@ pass through it on their way to us; it forwards them without keeping them. Visits to our websites do not pass through it, though its separate cdnjs service supplies the map software (see "If you only look at the pages").
- Anthropic provides an AI model that helps our editors read organisations' public web pages. When an editor fills in a new entry from an organisation's website, or our weekly check reads it, the text of that public page may be sent to it, to pick out facts such as an address or opening hours; every fact it suggests is checked against the page and by an editor. It is never sent the notes people send us, their addresses, or editors' details. Anthropic does not use this text to train its models, and deletes it within 30 days (or keeps it up to two years only if its safety systems flag it as misuse). It works in the United States.
- Vercel delivers the pages of both websites. It sees only that a page was visited, from which IP address, in short-lived logs. Notes and addresses never pass through it: your browser sends them straight to our database.
Each of these companies handles personal data only on our instructions, under a data processing agreement. Our database is kept in London, emails are sent from Ireland, and the AI model runs in the United States. Like most web services, their networks and support teams also work outside the UK, so some data may be handled in other countries, including the United States; where it is, their agreements use the safeguards that UK law approves for international transfers. Ask us if you would like the details.
We do not sell personal data or use it for advertising. No decision about you is made by a computer alone: automatic checks only flag notes for an editor to look at.
Your rights
You can ask to see the personal data we hold about you, to have it corrected or deleted, to object to how we use it or have us stop using it for a while, and, where it applies, to have a copy to take elsewhere. Email privacy at tideswell dot org dot uk; we will answer within one month.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or 0303 123 1113. We would appreciate the chance to put things right first.
Changes to this notice
When anything here changes, for example when a community group takes over as data controller, we will update this page and the date at the top.