Policy
Privacy Notice
Version 0.4 · Last updated 7 November 2026 · Follows Bilcor Group policies v0.6 · Draft for legal review
This notice explains what personal data Common Ground UK collects, why, what the law lets us do with it, how long we keep it, who helps us process it, and what your rights are. It covers commongrounduk.uk only. Other Bilcor Group platforms have their own notices.
Who is responsible for your data
Common Ground UK is part of Bilcor Group. Bilcor Group is the data controller for this platform. Once Bilcor Group is registered as a company, the controller will be Bilcor Group Ltd and its company number will be shown here.
For any privacy question or request, email privacy@commongrounduk.uk.
The short version
- You must be 16 or over to answer questions or create an account.
- We ask for your explicit consent before recording your first answer. Nothing is recorded until you agree.
- You can vote without giving us your name or email address.
- Your individual vote is never shown against your name. Results are only ever published as totals.
- We never sell personal data and never share it with political parties or advertisers.
- We do not share personal data with Common Ground Local, Middle Ground Sport or the Bilcor Group website. Each platform keeps its own data.
What we collect, why, and our legal basis
| What | Why | Legal basis |
|---|---|---|
| Your votes and PMQs grades, with a random session identifier made in your browser, the date, a broad label for how you arrived (for example "social" or "search"), and which version of the consent wording you agreed to | To count results, stop the same browser voting twice on one question, understand which channels bring people to the platform, and produce anonymous totals, including in reports that organisations pay for | Your explicit consent, asked for before your first answer, together with confirmation that you are 16 or over. A vote can reveal a political opinion, which the law treats as special category data |
| Optional profile: age band, sex, first part of your postcode, nation, party voted for last time and next time, work sector, housing tenure and education level | To show how results differ between groups. Groups smaller than 10 people are never shown | Your explicit consent. Every question is optional and you can skip the whole profile |
| Email address, if you create an account or save your votes as a guest | To sign you in, send a one-time code, and let you keep your record across devices | Contract (providing the account you asked for). Votes linked to an account: your explicit consent, given when you link them |
| Email address, if you subscribe to The Dispatch newsletter | To send the newsletter | Your consent. Unsubscribe at any time from any email |
| Name, email, organisation and message, if you send an enquiry, buy a data subscription, register a school or trust, or dispute an MP score | To reply, provide the service and keep business records | Contract, or legitimate interests where you contact us before buying anything. Business records: legal obligation |
| Payment details for organisations buying data products | To take payment | Contract. Card details are handled by Stripe and never reach us |
| Text you submit to the Open Floor, with the name and organisation you choose to give | To review and, if accepted, publish the question | Legitimate interests. If an organisation asked for the question, we say so on it |
| A one-way scrambled (hashed) version of your internet address | To block automated vote flooding from a single connection | Legitimate interests (protecting the count). We never store the address itself |
| Anonymous visitor counts: the page visited, the site you came from, campaign tags in the link, country and region, device type, operating system and browser. Collected by Vercel Web Analytics, which uses no cookies and identifies a visit only by a scrambled code that is thrown away after 24 hours | To see which pages are used and which links bring people to the platform, so we can improve it. We only ever see totals, never an individual visitor | Legitimate interests, under the UK ‘statistical purposes’ rule for measuring how a website is used. You can switch it off at any time on our Cookies page, and we do not count you if your browser sends a Global Privacy Control or Do Not Track signal. Sign-in, account, admin and embed pages are never counted, and personal details in web addresses are removed before anything is sent |
Schools programme: pupils never create accounts and we collect no personal data about them. Pupils join a teacher-led session with a code and their answer is the only thing recorded, as part of the class total. We do not ask for or store names, emails, year group, sex or device identifiers. School and trust staff contact details are held as described above.
What we do not collect
- Your full internet (IP) address. We keep only a scrambled version that cannot be turned back into the address
- Your full postcode, unless you type it into the MP finder, in which case it is used for that lookup and not stored against you
- Cross-site browsing history or advertising profiles
- Card or bank details (Stripe holds these)
- Anything about pupils taking part through the Schools programme, apart from their anonymous answers
How long we keep it
| Data | How long |
|---|---|
| Votes and optional profile answers | Permanently, as part of the public record. They are held against a random identifier, not your name |
| The record of which consent wording you agreed to | As long as the vote it belongs to |
| Account email | Until you ask us to delete your account |
| Guest email and saved-votes link | Until you ask us to remove it |
| Newsletter email | Until you unsubscribe |
| Hashed internet address used for flood protection | Deleted automatically after 48 hours |
| Visitor counts | The scrambled visit code is discarded after 24 hours; only anonymous totals are kept |
| Enquiries, customer and payment records | Six years after our last dealing with you, as required for tax and accounting |
| Server logs kept by our hosting provider | A short period set by Vercel, for security and fault finding |
If you delete your account, your past votes stay in the totals (removing them would change published results), but they are no longer linked to any email address.
Who processes data for us
We use these service providers. Each acts only on our instructions under a data processing agreement.
| Provider | What they do | Where |
|---|---|---|
| Supabase | Database and sign-in | EU (Frankfurt) |
| Vercel | Website hosting and anonymous visitor counts | Global network, United States company |
| Resend | Sends sign-in codes and service emails | United States |
| Beehiiv | Sends The Dispatch newsletter | United States |
| Stripe | Takes payment from organisations | United States and EU |
| postcodes.io | Turns a postcode you enter into a constituency | United Kingdom |
Where data leaves the UK, it is protected by UK adequacy regulations or the UK International Data Transfer Agreement or Addendum. AI tools we use to draft questions and summaries do not receive personal data.
Your rights
Under UK data protection law you can ask us to: give you a copy of your data; correct it; delete it; restrict or object to how we use it; and move it to another service. Where we rely on consent, you can withdraw it at any time.
Because anonymous votes are held against a random browser identifier, we can only find them if you give us that identifier or they are linked to your account.
Withdrawing consent stops us recording any further answers from you. Answers already counted stay in the published totals, because published results are permanent and cannot identify you; if your votes are linked to an account or email, we will remove that link.
Email privacy@commongrounduk.uk. We will reply within one month.
Complaints
If you are unhappy with how we handle your data, please tell us first so we can put it right. Our Complaints Procedure explains the steps.
You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.
ICO registration
Bilcor Group will hold one ICO registration covering all of its platforms. Registration is in progress; the number will be published here once it is issued.
Changes
When this notice changes we will update the version number and date at the top of the page.