Privacy Policy

1. Introduction

Welcome to BallotBadger. BallotBadger is polling and election software for clubs, organisations, and communities, operated by Thornes Consulting Ltd (trading as BallotBadger), a company registered in England and Wales with company number 16297800 and registered office at 167-169 Great Portland Street, Fifth Floor, London, England, W1W 5PF. It is not a gambling, lottery, or games-of-chance platform. We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and share your information when you use our website and application (the “Service”).

For the purposes of UK data protection laws, Thornes Consulting Ltd is the Data Controller for information collected directly from Organisers and all Users of the website. Where an Organiser uploads Participant personal data, the Organiser is the Data Controller and BallotBadger (Thornes Consulting Ltd) acts as the Data Processor, processing that data solely on the Organiser’s behalf and in accordance with the Data Processing terms set out in our Terms and Conditions.

2. The Data We Collect

The data we collect depends on how you interact with our Service:

For Organisers (Account Holders):

• Identity Data: Name and email address used to create your account.
• Email Delivery Status: If emails to your address bounce, or you report our emails as spam, we record this against your account so we can let you know. It is also shown to the people who manage the organisations you belong to, so they know you aren’t receiving invitations and notifications. It is cleared when your address works again.
• Organisation Data: Organisation name and other details provided during setup.
• Transaction Data: Details about software Platform Fee payments made by Organisers. Note: We do not collect or store your credit card details. These are securely handled by our payment processor, Stripe. Participants (voters) make no payments and no financial data is collected from them.
• Content Data: The text, questions, and options you create for your ballots.

For Participants (Voters):

• Contact Data: Your email address (provided to us by the Organiser solely for the purpose of sending you a voting invitation).
• Voting Data: The selections you make on a ballot. We employ cryptographic and security measures to separate your identifying information (like your email) from your actual vote to maintain ballot anonymity.

For All Users:

• Technical Data: IP address, approximate location derived from it (country and, where available, region and city), browser type, operating system, and basic usage data (such as time spent on the platform) to help us ensure the site is running smoothly and securely.
• Communication Data: Correspondence and information you provide when contacting our support team.

3. How We Use Your Data

We only use your personal data when the law allows us to. We use it for the following purposes:

• To provide the Service: To create accounts, host ballots, send invitations to Participants, and record votes (Contractual Necessity).
• To process payments: To facilitate software Platform Fee payments from Organisers via Stripe (Contractual Necessity). Participants are never charged and no payment data is collected from them.
• To communicate with you: To respond to support queries and send service-related announcements (Contractual Necessity / Legitimate Interest).
• To maintain security: To prevent fraud, malicious activity, or duplicate voting, and to keep an audit record of significant account and organisation activity (Legitimate Interest).
• To check email addresses before sending: To confirm Participant email addresses can receive email before invitations are sent, so invitations reach voters and mistyped or non-existent addresses are not emailed (Legitimate Interest).
• To improve our platform: To analyse how users interact with our site so we can improve the user experience (Legitimate Interest).
• To comply with legal obligations: To maintain records required by tax and financial reporting laws (Legal Obligation).

4. How We Share Your Data

We do not sell your personal data to third parties. We only share data with trusted service providers necessary to run BallotBadger:

• Payment Processor: We share necessary transaction identifiers with Stripe (based in Ireland, EEA) to process Organiser payments.
• Email Delivery: We use Amazon Web Services Simple Email Service (AWS SES), operating in the EU/UK region, to send ballot invitations and service communications.
• File Storage: We use Amazon Web Services S3 (AWS S3), operating in the EU/UK region, for file storage.
• Website Security and Delivery: All traffic to BallotBadger passes through Cloudflare, which protects the Service against attacks and delivers it quickly. To do this, Cloudflare processes your IP address and the technical details of each request, and tells us the approximate location (country, region and city) your IP address belongs to. We use that location only for security: to show you where your devices and sign-ins were, and to warn you about a sign-in from a new country.
• Email Address Verification: We use DeBounce to check that Participant email addresses can receive email before invitations are sent, and to check the email address given when an account is created or its email address is changed. Only the email address is shared, never names, ballot details or votes. Addresses we have checked recently, and those belonging to verified BallotBadger accounts, are not sent to DeBounce again.
• Self-Hosted Infrastructure: All other infrastructure, including application servers and databases, is self-hosted on a private server in the Netherlands (EEA).
• Legal Obligations: We may disclose your data if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency).

We will notify Organisers of any changes to our sub-processor list at least 30 days before the new sub-processor begins processing data.

5. International Data Transfers

We self-host our primary infrastructure on a private server in the Netherlands, within the European Economic Area (EEA), which benefits from a UK adequacy decision. Our AWS services (SES and S3) are configured to operate within EU/UK regions. Stripe processes payments within the EEA.

If any future sub-processor requires a transfer outside the UK and EEA, we will ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, and will update this section accordingly.

You may request further details about our data transfer arrangements by contacting us at [email protected].

6. Data Retention

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for.

• Organiser Accounts: We keep your account data until you request account deletion.
• Ballot and Participant Data: Voting data and Participant email lists are retained while the ballot is active. Organisers can delete their ballots at any time, which will purge the associated Participant data from our active databases.
• Email Verification Records: We keep the result of each email address check against a one-way hash of the address, not the address itself, so that we don’t need to check it again. Deliverable results are kept for up to 90 days, and results for undeliverable addresses for up to 24 months. The record for a registered account’s email address is kept until the account is deleted.
• Unverified Accounts: If an account’s email address is never verified, the account and its data are deleted 30 days after it was created.
• Transaction Records: We retain payment transaction records for up to 6 years after the transaction date as required by HMRC for tax and financial reporting purposes.
• Technical and Log Data: Server logs and technical data are retained for up to 90 days for security and debugging purposes, after which they are automatically deleted.
• Abuse Prevention: To protect the Service from abuse, we briefly count requests by IP address, or by account when you are signed in. These counters expire automatically, most within a minute and none later than a day.
• Trusted Devices: When you trust a device, we keep its name (such as the browser and operating system), the IP address and approximate location it was trusted from and last used from, and when it was last seen, so you can review and remove your devices. The record is deleted when you remove the device or when the trust expires after 90 days. We also keep a list of the countries your account has been used from on a verified device, so that we can ask you to verify a device used from somewhere new. A country is removed from the list after 180 days without use, or when you remove all your devices.
• Audit and Security Records: We keep a record of significant account and organisation activity (such as sign-ins, changes to accounts, memberships and ballots, and the email address, IP address and approximate location involved) for up to 2 years, to protect accounts, investigate misuse and resolve disputes. These records are kept after an account is deleted. You can ask us to remove your details from them at any time by contacting [email protected]; we will then erase your email address, IP address, location and other identifying details, keeping only an anonymous record that the activity took place.
• After Account Deletion: Following an account deletion request, we will delete or anonymise your personal data from active systems within 30 days, except for the audit and security records described above. Data may persist in encrypted backups for up to a further 90 days before being purged.

7. Voting Anonymity and Security

BallotBadger is built on the principle of secure, anonymous ballots. Once a Participant casts a vote, our system registers that the specific Participant has voted (to prevent double-voting) but severs the link between the Participant’s identity and the specific option they chose. We use industry-standard encryption to protect data in transit and at rest.

8. Your Legal Rights (UK GDPR)

Under UK data protection laws, you have rights regarding your personal data, including the right to:

• Request access to your personal data.
• Request correction of incomplete or inaccurate data.
• Request erasure of your data (“Right to be Forgotten”).
• Object to processing of your data.
• Request restriction of processing your data.
• Request transfer of your data to you or a third party.
• Withdraw consent at any time, where we rely on consent as the lawful basis for processing.

We will respond to any data subject access request within one calendar month of receipt, as required by UK GDPR.

If you wish to exercise any of these rights, please contact us at [email protected]. Note to Participants: If you wish to be removed from an Organiser’s mailing list before a vote, you may also need to contact the Organiser directly.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) if you believe your data protection rights have been violated. You can contact the ICO at ico.org.uk or by calling 0303 123 1113.

9. Cookies and Local Storage

We use only strictly necessary cookies and browser storage required for the secure operation of the Service. These do not require your consent under the Privacy and Electronic Communications Regulations (PECR). We do not use advertising, tracking, or third-party analytics cookies.

Specifically, we use:

• Authentication cookies: Set by our identity provider to keep you signed in, secure your session, and support two-factor authentication and trusted-device checks.
• Re-authentication state (session storage): A short-lived flag used during sensitive operations to confirm you have recently verified your identity. Cleared when you close the browser tab.
• User preferences (local storage): When you change settings such as your theme (light/dark), dismiss in-app notifications, or switch between organisations, we record those choices in your browser’s local storage so the interface remembers them on your next visit. These values are written only when you take a deliberate action and are never sent to advertisers or analytics providers.

Stripe Checkout: When an Organiser proceeds to pay a Platform Fee, they are redirected to a payment page hosted by Stripe at checkout.stripe.com. Stripe sets its own cookies on that page for fraud prevention and to operate the checkout, under Stripe’s own privacy policy. BallotBadger does not load Stripe scripts on its own pages and does not set any Stripe cookies on the BallotBadger domain. You can review Stripe’s cookie practices at stripe.com/cookies-policy/legal.

If we introduce non-essential cookies or similar technologies in the future (for example, analytics or marketing), we will obtain your consent before setting them.

10. Changes to This Privacy Policy

We keep our Privacy Policy under regular review. We will notify Organisers of material changes at least 30 days before they take effect, via the email address associated with their account. We will also post any updates on this page.

11. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us at:

Email: [email protected]

If you have concerns about how your data is handled, you may also contact the Information Commissioner’s Office (ICO) at ico.org.uk.

12. Automated Decision-Making

We do not carry out any automated decision-making or profiling that produces legal effects or similarly significantly affects you.