Privacy Policy

1. Introduction

Welcome to Harrogate Community Pulse ("we," "our," or "us"). We are committed to protecting your personal data and respecting your privacy rights. This Privacy Policy explains how we collect, use, store, and protect your personal information in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data Controller

Harrogate Community Pulse
Email: privacy@harrogatepulse.co.uk

2. Information We Collect

2.1 Information You Provide

When you register and use our platform, we collect:

• Personal Identification: Full name, email address
• Location Data: Postcode (to verify Harrogate residency)
• User Type: Resident, Official, or Councillor status
• Account Credentials: Password (stored securely, hashed)
• User-Generated Content: Polls created, votes cast, comments posted, official responses

2.2 Information Collected Automatically

When you use our platform, we automatically collect:

• Technical Data: IP address, browser type and version, device type, operating system
• Usage Data: Pages visited, time spent on pages, clicks, scrolling behavior
• Cookies: As described in our Cookie Policy (see Section 10)
• Geolocation Data: Approximate location based on IP address (for verification purposes)

2.3 Information from Third Parties

• Postcode Verification: We use the UK Postcodes.io API to verify Harrogate residency

3. How We Use Your Information

3.1 Legal Basis for Processing

We process your personal data under the following legal bases:

Purpose	Legal Basis
Account creation and management	Contract performance
Verifying residency eligibility	Legitimate interest
Platform security and fraud prevention	Legitimate interest
Analytics and platform improvement	Legitimate interest
Email communications (service updates)	Contract performance
Email communications (marketing)	Consent (opt-in required)
Compliance with legal obligations	Legal obligation

3.2 Specific Uses

We use your personal information to:

• Provide Services: Enable account creation, voting, poll creation, and commenting
• Verify Eligibility: Confirm you are a Harrogate resident through postcode verification
• Prevent Fraud: Detect and prevent duplicate voting, spam, and abuse
• Communicate: Send essential service updates, poll notifications, and official responses
• Improve Platform: Analyze usage patterns to enhance user experience
• Generate Analytics: Create aggregated, anonymized statistics about community engagement
• Commercial Use: Create and sell aggregated, anonymized data about voting patterns by parish/ward (see Section 5)

4. How We Share Your Information

4.1 Public Information

The following information is publicly visible on our platform:

• Your name (on polls you create and comments you post)
• Polls you have created
• Comments you have posted
• Your user type (Resident, Official, Councillor)

Note: Your email address, postcode, and voting choices are NEVER made public.

4.2 Aggregated Data Sharing

4.3 Third-Party Service Providers

We share data with trusted third parties who help us operate our platform:

• Hosting Provider: To store and serve our website
• Email Service: To send transactional emails and notifications
• Analytics: To understand platform usage (anonymized where possible)

All third-party providers are GDPR-compliant and bound by data processing agreements.

4.4 Legal Requirements

We may disclose your personal data if required by law or in response to:

• Valid legal process (court orders, subpoenas)
• Law enforcement requests
• Protection of our rights, property, or safety
• Prevention of fraud or illegal activity

4.5 We DO NOT

• ✗ Sell your personal information to third parties
• ✗ Share your voting choices with anyone
• ✗ Provide your email address to advertisers
• ✗ Share your postcode with commercial entities
• ✗ Disclose individual-level data for commercial purposes

5. Data Retention

We retain your personal data for different periods depending on the type:

Data Type	Retention Period
Account information	Until account deletion + 30 days
Voting records (anonymized)	Indefinitely (for historical statistics)
Polls and comments (public content)	Indefinitely (community record)
Email communications	Until account deletion + 30 days
IP addresses and logs	12 months (security purposes)
Cookies	As specified in Cookie Policy
Backup data	90 days (rolling backups)

Note: When you delete your account, we anonymize your voting records (removing all personal identifiers) but keep the vote counts for statistical integrity.

6. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

6.1 Right of Access

You can request a copy of all personal data we hold about you. Email privacy@harrogatepulse.co.uk with subject "Data Access Request".

6.2 Right to Rectification

You can correct inaccurate or incomplete personal data through your account settings or by contacting us.

6.3 Right to Erasure ("Right to be Forgotten")

You can request deletion of your personal data. Note:

• We will delete your account, email, and postcode
• Public polls and comments will be anonymized (shown as "Deleted User")
• Voting records will be anonymized but counts preserved for statistical integrity
• Legal obligations may require us to retain certain data

6.4 Right to Restrict Processing

You can request we limit how we use your data while we investigate a concern.

6.5 Right to Data Portability

You can request your data in a machine-readable format (JSON or CSV).

6.6 Right to Object

You can object to:

• Processing based on legitimate interests
• Direct marketing (opt-out links in all emails)
• Automated decision-making (we don't use this)

6.7 Right to Withdraw Consent

Where processing is based on consent, you can withdraw it at any time (e.g., marketing emails).

6.8 Right to Lodge a Complaint

You can complain to the UK Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113
• Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Exercise Your Rights

To exercise any of these rights, contact us at:
Email: privacy@harrogatepulse.co.uk
We will respond within 30 days.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

Technical Measures

• Encryption: HTTPS/TLS for all data transmission
• Password Security: Bcrypt hashing with salt (passwords never stored in plain text)
• Server Security: Firewalls, intrusion detection, regular security updates
• Database Security: Encrypted storage, restricted access, regular backups
• Access Controls: Role-based access, principle of least privilege

Organizational Measures

• Staff training on data protection
• Regular security audits
• Incident response procedures
• Data processing agreements with third parties

Data Breach Notification

In the event of a data breach affecting your personal data, we will:

• Notify the ICO within 72 hours (if required by law)
• Notify affected users without undue delay
• Provide details of the breach and mitigation steps

8. Children's Privacy

Our platform is not intended for users under 18 years old. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will delete it immediately.

If you believe we have inadvertently collected information from a child, please contact us at privacy@harrogatepulse.co.uk.

9. International Data Transfers

Your personal data is processed and stored in the United Kingdom. If we transfer data outside the UK/EEA, we ensure:

• The country has an adequacy decision from the UK government, OR
• Appropriate safeguards are in place (Standard Contractual Clauses), AND
• You have enforceable rights and effective legal remedies

Currently, our hosting and services are UK-based, and no international transfers occur.

10. Cookies and Tracking

We use cookies and similar technologies. Please see our detailed Cookie Policy for information about:

• Types of cookies we use
• Purpose of each cookie
• How to control cookie preferences
• Third-party cookies

11. Automated Decision-Making

We do not use automated decision-making or profiling that significantly affects you. All decisions regarding account approval, content moderation, and other actions involve human review.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do:

• We will update the "Last Updated" date at the top
• For significant changes, we will notify you via email
• Continued use of the platform after changes constitutes acceptance
• You can always access the current version at harrogatepulse.co.uk/privacy

13. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or your personal data:

Data Protection Officer
Email: privacy@harrogatepulse.co.uk
Response Time: Within 30 days

General Inquiries:
Email: hello@harrogatepulse.co.uk

14. Definitions

• Personal Data: Any information relating to an identified or identifiable person
• Processing: Any operation performed on personal data
• Data Controller: The entity that determines how and why personal data is processed
• Data Processor: A third party that processes data on behalf of the controller
• Anonymized Data: Data that cannot be used to identify an individual
• Aggregated Data: Data combined from multiple sources, without personal identifiers