Privacy Policy

CouncilUnit Casework ("we", "us", "our") is a trading name of Civicunit Ltd, a company registered in England and Wales, company number 17333404, registered office Office 20058, 182-184 High Street North, London, England, E6 2JA. We provide casework management software to councillors and council groups.

This matters, so we want to be upfront about it. Depending on what data we're handling, we act in one of two different roles:

• When we hold account information about a councillor using this platform (name, ward, email, login details), we are the data controller - we decide why and how that data is used, and this policy explains our own practices for it.
• When a councillor uses this platform to store or process information about their constituents (residents raising casework), we act as a data processor on behalf of the relevant council, which remains the data controller for its residents' personal data. We process that data only on the council's instructions, under a separate data processing agreement with each council client. If you are a resident and have a question about how your personal data has been handled in connection with casework, you should contact the relevant council directly in the first instance, as they are responsible for that data.

For councillor accounts: name, title, ward, council, email address, phone number (if provided), login credentials, and records of your activity within the platform (cases created, correspondence sent, login history).

For constituent/casework data (processed on behalf of councils, as described in section 2): name, title, contact details, address, and the content of casework raised, including any correspondence sent or received in connection with it. This may occasionally include special category data (for example, where a resident's casework relates to their health, immigration status, or similar) if a councillor records that as part of handling a case - we do not actively seek this out, but it may be present within casework content submitted by councillors or forwarded from constituent emails.

• To provide the casework management service to councillors and councils who have contracted with us
• To operate councillor accounts, including login and authentication
• To send transactional emails (case correspondence, account notifications, invitations)
• To maintain security and an audit trail of casework activity
• To respond to support requests

Our legal basis for processing councillor account data is performance of our contract with the relevant council or councillor. Our processing of constituent casework data is carried out strictly on the instructions of, and under contract with, the relevant council, who determines their own legal basis for collecting and holding that data (typically their public task or legal obligations as a local authority).

We use a small number of service providers (sub-processors) to operate the platform:

• Supabase (database hosting and authentication) - EU Hosting Region
• Postmark (email sending and inbound email processing) - EU Hosting Region

We do not sell personal data, and we do not share it with any third party for marketing purposes. A full, current list of sub-processors is available on request to legal@councilunit.co.uk.

Councillor account data is retained for the duration of the relevant service agreement, and for a reasonable period afterwards for legitimate business and legal purposes (typically no longer than 24 months after an account is deactivated, unless a longer period is required by law). Constituent casework data is retained according to the instructions and retention schedule agreed with the relevant council, since the council determines appropriate retention for its own residents' data as the data controller.

If you are a councillor with an account on this platform, you can request access to, correction of, or deletion of your own account data at any time by contacting legal@councilunit.co.uk. If you are a resident whose data has been processed in connection with council casework, please contact the relevant council directly, as they are the data controller responsible for responding to your request; we will assist the council in fulfilling such requests where required under our agreement with them.

This platform only uses cookies that are strictly necessary for it to function - specifically, to keep you securely logged in. We do not use any analytics, tracking, or advertising cookies. Because we only use strictly necessary cookies, we are not required to show a cookie consent banner under UK PECR rules, and we don't.

We take appropriate technical and organisational measures to protect personal data, including encryption, access controls, and restricting data access on this platform so that one council's data is never visible to another.

We may update this policy from time to time. We'll update the "last updated" date at the top when we do, and for material changes, we'll take reasonable steps to notify councillor account holders.

Questions about this policy, or to exercise your rights as described above: legal@councilunit.co.uk