Privacy notice

Last updated: [date]

Zakrila (company number 16952018), 1 Saxon Reach, Cliffsend, Ramsgate CT12 5HQ, is the controller of personal data processed through www.zakrilaindex.com and app.zakrilaindex.com. Contact: dataprotection@zakrila.com. ICO registration: [number].

  1. Website visitors: server logs (IP address, browser, pages requested) for security and to run the service. Lawful basis: legitimate interests (security, service integrity).
  2. Nominations: organisation name and email; nominator email if given. Purpose: to send one participation email to the organisation and one receipt to the nominator. Lawful basis: legitimate interests. Retained 90 days, then deleted.
  3. Account holders: name, email, password (hashed), organisation, sign-in records. Purpose: to provide the service. Lawful basis: contract (Participation terms).
  4. Role holders: name, role title, work email, role acceptance, confirmation records and timestamps. Purpose: to operate distributed confirmation and compute Ⰻ Safeguarding Status. Lawful basis: legitimate interests of the participating organisation and of Zakrila in operating a governance register; the organisation must tell you before adding you. [Public display of role-holder names — FIELDFISHER DECISION REQUIRED.]
  5. Audit events: an append-only record of declarations, confirmations, reassignments and status changes, linked to the account that made them. Purpose: integrity of the register. Lawful basis: legitimate interests. Retained for the life of the organisation's entry plus [6] years.
  6. Public status records: organisation-level data only (name, sector, jurisdiction, statuses, dates).
  7. Enquiries and complaints: your name, contact details and correspondence. Lawful basis: legitimate interests; legal obligation where a data protection or defamation complaint is made. Retained [6] years.
  8. Payments: handled by [payment processor]; we receive confirmation of payment, not card details.

We do not request, accept or store safeguarding policies, case files, incident records, evidence documents, special category data or accounts of harm. Participating organisations remain responsible for their own safeguarding records. Ⰻ Safeguarding Status is not derived from any safeguarding case data.

Ⰻ Safeguarding Status is computed automatically from an organisation's recorded governance events. It is a status about an organisation, not a decision about an individual, and it has no legal or similarly significant effect on any individual. We do not make automated decisions about individuals within the meaning of Article 22 UK GDPR.

Hosting: Vercel Inc. (United States). Form handling: Netlify Inc. (United States). Email delivery: [provider]. Payments: [provider]. Accountants and legal advisers where necessary. Regulators, courts or law enforcement where required by law.

Our hosting and form providers process data in the United States under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses [or the UK Extension to the EU-US Data Privacy Framework where the provider is certified].

Data is encrypted in transit and at rest. Access is restricted to authorised staff. Audit records are hash-chained so that changes are detectable. No system is completely secure; we cannot guarantee absolute security.

You can ask for access to, correction or erasure of your personal data, ask us to restrict or object to processing, and ask for a copy in a portable format. Erasure of a role holder's name from audit records may be replaced by pseudonymisation where the record must be retained for integrity. Contact dataprotection@zakrila.com. We respond within one month.

See the Cookies page.

We do not send marketing. If this changes we will ask for your consent first.

You can complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.

We will post changes on this page and update the date at the top. Material changes will be notified to account holders by email.