Privacy Policy
Template, needs legal review before launch.
Last updated: [date]
Controller
[Company legal name], [Registered address], company number [Company number], is the data controller. ICO registration number: [ICO registration number]. Privacy questions: [contact email].
What we collect
- Account details: name, email address, password (stored hashed).
- Eligibility details: member type (health professional, carer or disabled person) and the information needed to verify it, such as a professional registration number.
- Usage data: offers you view or unlock, and technical data such as browser type.
- Messages you send us.
Special category data
Confirming that someone is a disabled person or carer may reveal health-related information. We collect only the minimum needed to verify eligibility, process it on the basis of your explicit consent, and do not use it for marketing. [Confirm verification method and retention with legal adviser.]
Proof documents you upload
Carers and disabled people may upload one document (for example a Carer's Allowance, PIP, DLA or Attendance Allowance letter, a Blue Badge or a carer's assessment) so a member of our team can confirm eligibility. Health professionals' registration numbers are checked against the public register of their regulator.
- We use documents only to check eligibility, never for marketing or profiling.
- Lawful basis: contract, and for health or disability information your explicit consent (UK GDPR Article 9(2)(a)), which you can withdraw at any time.
- Only authorised staff can see documents. They are encrypted in transit and at rest [confirm with hosting provider].
- We keep the document for [retention period, e.g. 30 days] after the decision and then delete it. We keep only a record that you were verified, the proof type and the date.
- Please cover up anything we don't need, such as bank details or National Insurance numbers.
- Decisions are made by a person, not solely by automated means.
Community posts
If you post in the members' community, other verified members can see your post, your first name or display name and the time you posted. We store posts, replies, votes and reports to run and moderate the community (legitimate interests). Please don't share health or personal details. You can delete your posts or ask us to remove them. We keep reported content for [retention period] for moderation.
Deal alerts
If you sign up, we use your email address and chosen categories to send offer emails, based on your consent. You can unsubscribe at any time. [Email provider name] sends them for us.
Referrals
Your referral link contains a code linked to your account so we can credit any reward. If someone joins with it, we record that they were referred by you; we don't share their details with you beyond whether a reward is due.
Competitions
To run a prize draw we use your name and email to manage your entry and contact winners. We keep entries for [retention period] after the draw. If you win, we may ask your permission before publishing your first name and area.
Why and lawful basis
- Running your membership: contract.
- Verifying eligibility: contract and, for special category data, explicit consent.
- Service emails and security: legitimate interests.
- Marketing emails: consent, which you can withdraw at any time.
- Affiliate tracking cookies: consent (see Cookie policy).
Who we share with
Verification provider [name], hosting and email providers [names], and affiliate networks Awin and Commission Factory (for tracking purchases you choose to make, only with your cookie consent). We do not sell personal data. See Awin's privacy policy.
International transfers
Where data leaves the UK, we use appropriate safeguards such as the UK International Data Transfer Agreement or adequacy regulations.
How long we keep it
Account data while your membership is active and [retention period] afterwards; verification evidence for [retention period].
Your rights
You can ask to access, correct, delete, restrict or port your data, object to processing, and withdraw consent. Contact [contact email]. You can also complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).