1. Purpose
This policy sets out the rules that Bilcor Group and every one of its platforms follow when handling personal information. Each platform also has its own privacy notice, which explains exactly what that platform collects.
2. Who is responsible
Bilcor Group is responsible for personal information on every platform it runs (the "data controller"). Bilcor Group is being set up as a private limited company in England and Wales. Until the company is registered, the data controller is Steve Hatton, trading as Bilcor Group. Responsibility will pass to the company when it is registered. Its company details and its registration number with the Information Commissioner's Office (ICO) will be added here at that point.
3. Our principles
- We collect only what is needed to run each platform fairly.
- We use it only for the reasons we have told people about.
- We never sell personal information.
- We never show anyone's view against their name.
- We keep information secure and only for as long as it is needed.
- We are open about what we do, in plain English.
4. Our legal reasons for using information
UK data protection law says we must have a legal reason for each way we use personal information. These are ours:
- Answers that may reveal political opinions: your explicit consent.
- Other answers, such as views on a sports club's decisions: your consent.
- Running your account and sending emails you need, such as sign-in links: to provide the service you asked for.
- Keeping platforms secure and stopping misuse, such as scrambled internet addresses: our legitimate interest in running fair, safe platforms.
- Newsletters and updates: your consent, which you can withdraw at any time.
- Keeping records the law requires, such as financial records: legal obligation.
- Each platform's privacy notice says exactly which of these it uses.
5. Each platform keeps its own information
- Every platform has its own separate database.
- Personal information is never shared between platforms, or with this group website.
- Each platform publishes its own privacy notice listing what it collects, why, and who helps it do so.
6. Views that may reveal political opinions
Answers about public decisions, such as national policy or local council decisions, can count as political opinions. UK data protection law treats these as special category information, which needs extra care.
- Platforms that ask about public decisions ask for clear, explicit consent before recording an answer, and explain why.
- People can withdraw their consent at any time. This stops any further answers and removes any link between them and their past answers. Answers already counted stay in the anonymous published totals, because published results are permanent.
- Results are only ever published as anonymous totals.
7. Young people
Our rules for young people, including the minimum age, are set out in our Young People and Minimum Age Policy.
8. How long we keep information
- Each platform publishes how long it keeps each type of information.
- As a default, accounts that have not been used for two years are deleted.
- Technical logs, such as internet addresses used to stop misuse, are kept for a short time only. Where our platforms store them, they are scrambled. Our hosting and sign-in suppliers also keep short-term technical logs of their own, under their own terms, which each platform lists in its privacy notice.
- When someone asks for their information to be deleted, we delete it along with the link to their answers. Anonymous result totals stay unchanged.
9. Keeping information secure
- Only people who need access to personal information have it.
- All admin accounts use strong passwords and two-step sign-in.
- Information is encrypted when it travels between people's devices and our platforms.
- We choose suppliers with good security and check them regularly.
10. Suppliers
We use trusted suppliers for hosting, databases and email. They process information only on our instructions, under contracts that protect it. Where information is stored outside the UK, recognised legal safeguards are in place. Each platform lists its suppliers in its privacy notice.
11. People's rights
Anyone can ask to see the information we hold about them, have it corrected or deleted, object to how we use it, or withdraw consent. Email hello@bilcor-group.com. We will reply within one month. Anyone unhappy with how we have handled their information can complain to us using our Complaints Procedure. We confirm receipt within 5 working days and tell them the outcome. They can also complain to the Information Commissioner's Office at ico.org.uk.
12. If something goes wrong
- If personal information is lost, stolen or seen by the wrong people, we act straight away to contain it.
- Where the law requires it, we report it to the ICO within 72 hours.
- If there is a high risk to the people affected, we tell them directly.
- We keep a record of every incident, however small, and what we learned from it.
13. Before launching anything new
We check the privacy risks before any change that uses personal information. We always carry out a formal data protection impact assessment, and keep it on file, before:
- launching any new platform;
- any new use of answers that may reveal political opinions;
- any new feature that 16 and 17 year olds may use;
- any new tracking, profiling, or use of location; and
- any new supplier that will hold personal information.
14. Review
We review this policy at least once a year, and sooner if anything changes.