The Council Network (TCN) Privacy Policy

Status: DRAFT, leadership decisions incorporated, pending final legal sign-off

1. Who We Are

This policy explains how The Council Network (“TCN”, “we”, “us”) collects, uses, shares, and protects personal information belonging to the people who use it: officers, councillors, sponsors, and other users.

TCN is operated by The Sector Networks Group Ltd (company number 16571416), which is the data controller for the purposes of this policy.

TCN’s registered office address is 54 Meadowcroft Close, Horley, England, RH6 9EJ.

TCN’s ICO registration number is ZC019576.

TCN’s Data Protection Officer (DPO) is Richard Biggs.

2. Scope of This Policy

This policy covers all personal information processed through the TCN platform: account and profile data, content you create (discussions, replies, group posts, messages), connection and interaction data, and technical data collected when you use the site or app.

It applies to all user types: officers, councillors, sponsors, group admins, and site admins. A separate Cookies Policy covers cookies and similar tracking technologies in detail.

3. Information We Collect

3.1 Account and profile data

Collected from everyone (mandatory):

  • Name
  • Email address (a .gov.uk or equivalent official address for officers/councillors; a personal address for sponsors/guests)
  • Password (stored using an industry-standard hashing method, never in plain text; see Section 11 for further detail)
  • User type (officer, councillor, sponsor, admin, guest)
  • Council / organisation
  • Department (officers) or political party (councillors; see Section 4, which treats this data differently)

Collected optionally, at the user’s choice:

  • Role, skills, and interests
  • Bio and professional history
  • Profile photo and cover photo
  • Qualifications and certifications
  • Social media links (LinkedIn, X, Facebook, Bluesky)
  • A second, non-official email address for notifications

3.2 Content you create

  • Discussion posts, replies, and quoted replies
  • Group posts, within groups you’ve joined or created
  • Direct messages to other users
  • Flags you raise on other users’ content, and the reason given

3.3 Connections and interactions

  • Connection requests sent, received, accepted, or declined
  • Upvotes
  • Group memberships, and any group-level role (admin, participant)
  • Users you’ve blocked

3.4 Invitations

If you invite someone to TCN by email, we collect the invitee’s contact address, the group invited into (if any), a unique invitation token, and its status and expiry.

3.5 Communications data

We keep a record of the consent you’ve given for each of the three email types (transactional, notifications, and marketing), including when consent was given or withdrawn, so we can demonstrate compliance if asked.

3.6 Technical and usage data

  • IP address and device/browser information
  • Log-in times and general usage activity, used to power the personalised home feed
  • Cookies and similar technologies, see our Cookies Policy

The analytics and usage-logging tooling will be named here once the platform build is further along; this also affects the related decision in Cookies Policy §4.

4. Special Category Data: Political Party

A councillor’s political party affiliation is special category data under UK GDPR. It is classified as “political opinion” data under Article 9, alongside data such as health or religious belief, which affects how we may collect and use it.

Political party is a mandatory field for all councillor accounts. Because this is special category data, we require your explicit, informed consent to providing it as part of registration, given via a dedicated consent checkbox at sign-up, separate from your general acceptance of these policies. You can withdraw this consent at any time by closing your account, which removes your political party from our records. Because the field is mandatory for councillor accounts, we cannot keep a councillor account open without it.

5. How We Use Your Information

We use personal information to:

  • Create and administer your account, and verify you against the right user type and organisation
  • Run the core features you use: discussions, groups, messaging, connections, the jobs board
  • Personalise your home feed, based on your activity, interests, department, and group membership
  • Notify members with relevant expertise when a matching question is posted
  • Send transactional emails (authentication, password resets), notification emails (per your settings), and marketing emails (only with your consent)
  • Review flagged content and enforce our Moderation Policy and Terms of Use
  • Meet our legal obligations, including under the Online Safety Act 2023 (see our Online Safety Act statement)
  • Understand how TCN is used, to improve it

6. Our Legal Bases for Processing

UK GDPR requires us to have a valid legal basis for each way we use personal data:

  • Contract: providing the core platform functionality you sign up for (profile, discussions, groups, messaging).
  • Consent: marketing emails; your secondary notification email; and your political party field (see Section 4).
  • Legitimate interests: keeping TCN secure, preventing fraud and abuse, and improving the service. We balance this against your right to privacy in each case.
  • Legal obligation: responding to law enforcement or regulatory requests, and meeting our Online Safety Act duties.

Political party data is collected on the basis of explicit consent. No separate Legitimate Interests Assessment (LIA) is required for that field. LIAs remain relevant to the legitimate-interest bases above (security, fraud prevention, service improvement) and should be documented as those uses are finalised.

7. Automated Decision-Making

TCN does not use any automated decision-making process, including profiling, that produces legal or similarly significant effects on you. Any personalisation of your experience on the platform (see Section 5) does not involve solely automated decisions about you and does not affect your access to the platform or any of its features. If this changes in future, we will update this policy and, where required, provide further information about the logic involved and your rights under UK GDPR Article 22.

8. Who We Share Your Information With

8.1 Other users

Depending on your profile visibility settings, other users can see certain profile fields, your posts, and (if connected) your messages. Officers can control visibility to councillors and vice versa. Officers cannot hide from other officers.

8.2 Sponsors

Sponsors can see and respond to posts on their own sponsored discussion board, and can message users who have messaged them first. Sponsors do not otherwise have access to user data.

8.3 Service providers (processors)

  • DigitalOcean hosts the application.
  • Supabase provides our database, authentication and file storage.
  • Resend provides transactional email, including account and password-reset emails.
  • Sentry provides error monitoring.
  • We run Umami analytics on our own hosted infrastructure.

8.4 Jobs board partner

The Jobs Board is not currently available. We will update this notice before introducing a jobs-board integration that changes how personal information is handled.

8.5 Legal and safety

We may share information with law enforcement, regulators (including Ofcom, under the Online Safety Act), or professional advisers where we’re legally required to, or where we reasonably believe it’s necessary to prevent harm.

8.6 Business changes

If TCN is ever sold, merged, or restructured, personal data may be transferred to the new owner, who would be bound by this policy (or a successor policy you’d be notified of).

9. International Data Transfers

Our application, database and self-hosted analytics infrastructure are configured in London. Some of our service providers process or store information outside the United Kingdom.

Resend sends our emails through its Ireland region, but stores email content, delivery logs, webhook data and account records in the United States. The sending region does not determine where those records are stored.

Our Sentry error-monitoring endpoint is in its German region. Sentry stores event data in the selected region, while some account, integration and organisation metadata may be stored in the United States. We configure error reporting to limit personal data and remove sensitive information before sending events.

Resend describes contractual safeguards for international transfers, including Standard Contractual Clauses and the UK Addendum, in its data-protection information. Sentry describes its regional arrangements in its data-location documentation. Our review of the applicable provider agreements and transfer arrangements remains part of finalising this draft notice.

10. How Long We Keep Your Information

When you close your own account, TCN’s default approach is to anonymise your posts and replies, showing them as posted by ‘Deleted user’ so discussion threads remain intact for other users. If you’d prefer your posts to be removed entirely rather than anonymised, you can email us at admin@thecouncilnetwork.org to request this.

If your account is closed because you’re no longer a councillor (for example, following an offboarding trigger such as a bounced .gov.uk email), the default is different: your account is frozen, but your posts remain visible under your name. If you provided a personal, non-official email address at sign-up, you can email us to request that your posts be anonymised or taken down instead. If you didn’t provide one, you can still make this request by emailing us with proof of identity.

Retention periods:

  • Invitation tokens: deleted 90 days after the latest of their expiry, use or revocation date.
  • Marketing-consent records: retained for 7 years after consent is given or withdrawn. We retain the latest active consent while we still rely on it.
  • Moderation/flagging records: deleted 2 years after the report is resolved, unless the reported content is marked for preservation. Unresolved reports are retained.

11. Keeping Your Information Secure

We use technical and organisational measures to protect your information, including encryption and access controls.

Detail on password hashing method, encryption at rest and in transit, and admin access controls will be added here once the technical build progresses further. Our Data Protection Officer owns the decision on whether a breach requires notifying the ICO within the 72-hour UK GDPR window.

12. Children and Age

TCN is built for working professionals in local and central government and is not designed for use by children. TCN requires all users to be aged 18 or over. This is the same 18+ position taken in our Terms of Use and our Online Safety Act statement.

13. Your Rights

Under UK GDPR, you have the right to:

  • Access the personal information we hold about you
  • Correct inaccurate information
  • Request erasure of your information, in certain circumstances
  • Restrict or object to certain processing
  • Receive a copy of your information in a portable format
  • Withdraw consent at any time, where we rely on consent (including the political party field, by closing your account, and marketing emails)
  • Complain to the Information Commissioner’s Office (ICO) at ico.org.uk if you think we’ve handled your information incorrectly

We respond to rights requests within the statutory one-month period (extendable by two further months for genuinely complex requests, as UK GDPR allows). Requests are handled by our named Data Protection Officer.

14. Marketing Communications and Your Choices

We only send marketing emails if you’ve separately opted in at sign-up or in your settings. You can withdraw this consent at any time, either via the unsubscribe link in any marketing email or through your account settings. Withdrawing marketing consent does not affect transactional or notification emails, which you control separately.

15. Cookies

TCN uses cookies and similar technologies. Full details are set out in our separate Cookies Policy, which covers what we use, why, and how to manage your preferences.

16. Changes to This Policy

We’ll update this policy as TCN changes. If we make a material change, we’ll notify you by email or in-app notification before it takes effect.

17. How to Contact Us

If you have questions about this policy or how your information is handled, contact us at admin@thecouncilnetwork.org.

You can also complain directly to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.