Privacy notice

Who is responsible for your information

The National Emergencies Trust is responsible for personal information used by Ready Together.

For privacy questions, email data.protection@nationalemergenciestrust.org.uk.

Back to contents

Information we collect when you use the website

You can browse the main Ready Together toolkit without an account.

When you use the website, we may collect limited technical information.

This can include:

• your IP address
• browser and device information
• the date and time of a request
• pages or website services requested
• security and error information

We use this information to keep the service secure and working properly.

Our lawful basis is legitimate interests.

This means we have a genuine need to use the information to run and protect the service.

Back to contents

Website analytics

We use optional website analytics to understand how Ready Together is used.

Analytics stay off until you choose to allow them.

If you allow analytics, we may collect information about:

• pages and themes viewed
• resources downloaded
• activities used
• broad referral sources
• browser and device types
• website performance
• coarse account activity, such as saving progress or downloading a plan

We do not send names, email addresses or saved-plan text to analytics.

We do not send organisation logos, evaluation answers, contact messages or authentication details to analytics.

We do not use analytics for advertising, remarketing or commercial profiling.

We rely on your consent for optional analytics.

You can withdraw your consent at any time through Cookie Preferences in the website footer.

Withdrawing consent stops future analytics collection.

It does not undo processing that was lawful before you withdrew consent.

Our separate Cookie Policy explains the cookies and similar technologies we use.

Back to contents

Cookie and privacy choices

We store your cookie choice in your browser.

We keep that choice for up to 12 months.

We then ask you to choose again.

We do not keep an individual server-side copy of your analytics choice.

Some technology is strictly necessary to keep Ready Together secure.

This includes anti-abuse technology used on public forms and sign-in.

Strictly necessary technology does not depend on analytics consent.

Back to contents

Information we collect if you create an account

Creating an account is optional.

We ask only for your email address when you register.

We send a secure, time-limited magic link to your email address.

You do not need a password, username, phone number or social-media account.

After registration, you can choose to add:

• your name
• your organisation or community group name
• an organisation or community group logo

Your name is optional.

We may use it to address essential account messages.

Your organisation or community group name is optional.

We may use it when you create co-branded Ready Together materials.

We use account information to provide and manage your account.

Our lawful basis is legitimate interests.

Back to contents

Essential account emails

We may send emails needed to operate your account.

These can include:

• magic-link sign-in emails
• inactivity warnings
• account-closure confirmations
• important security notices
• important changes to the account service

These are service messages, not marketing.

We do not send newsletters or direct marketing at launch.

Our lawful basis for essential account emails is legitimate interests.

Back to contents

Your saved community plan

Account holders can save their progress and community plan.

Your saved plan is private by default.

NET staff do not routinely read saved plans.

Authorised staff may access a plan only when this is necessary.

Examples include technical support, security, a legal requirement or investigating serious misuse.

We restrict and log this access.

You can edit or delete your saved plan without deleting your account.

Do not add sensitive information about individual people

Keep your plan about the community as a whole.

Do not add:

• medical or health information
• detailed home addresses
• building access codes
• safeguarding information
• lists of vulnerable people
• personal emergency arrangements
• security-sensitive infrastructure information
• names, phone numbers or email addresses of other people unless a feature clearly requires them

Use roles or organisation details instead where possible.

For example, use “community centre lead” instead of a person’s name.

Ready Together does not intentionally ask for special category data in saved plans.

Special category data includes highly sensitive information, such as health, ethnicity or religion.

Back to contents

Downloading your plan

You can generate and download your completed plan.

The downloaded file is created on demand.

We do not keep a separate permanent copy of the generated file.

Temporary generated files are deleted automatically within 24 hours.

If you share a downloaded plan, you decide who receives that copy.

NET cannot control what happens to a copy after you share it outside Ready Together.

Back to contents

Organisation logos and co-branded materials

Account holders can upload an organisation or community group logo.

We store the logo while you choose to use it.

We delete the previous logo when you replace it.

We delete it if you remove it or close your account.

Co-branded materials are generated on demand.

Temporary generated files are deleted automatically within 24 hours.

Ready Together branding remains on co-branded materials.

You cannot upload general documents, photos or other attachments to your account at launch.

Back to contents

Optional evaluation information

Ready Together will include optional evaluation activity.

Taking part is not required to use the toolkit or your account.

You may be invited to provide information such as:

• your role
• your town, village, city or local authority area
• information about your organisation or community group

We do not need a full postcode for this purpose.

Evaluation information is kept separate from core account data.

We use a separate evaluation identifier where possible.

Nottingham Trent University will not have routine access to your core account data.

This includes your email address, saved plan and uploaded logo.

If you are invited to take part, we will give you separate privacy information first.

That information will explain who is responsible for the data and how it will be used.

It will also explain how long the information will be kept.

Back to contents

Contacting Ready Together

You can use the Contact form to ask a question, report a problem or contact Ready Together.

The form asks for:

• your full name
• your email address
• your organisation or community group, if you choose to provide it
• the type of enquiry
• a subject
• your message

Do not include sensitive personal information in your message.

Do not include medical details, home addresses or safeguarding information.

We use Contact form information to receive, manage and answer your enquiry.

Our lawful basis is legitimate interests.

The form asks you to confirm that you have read this Privacy notice.

That confirmation is not consent for marketing or research.

We use a third-party enquiry-management service to store and manage Contact form submissions.

The provider processes the information on our behalf.

We do not copy Contact form submissions into the Ready Together account database.

We do not send Contact form content to analytics.

Back to contents

Where your information comes from

Most personal information comes directly from you.

We also create limited technical information when you use the service.

We do not buy personal information about Ready Together users.

We do not use data brokers or enrichment services.

We do not receive user profiles from campaign partners.

Back to contents

Why we use personal information

We use personal information only for defined purposes.

These include:

• providing and managing optional accounts
• saving progress and community plans
• creating downloads and co-branded materials
• sending essential account emails
• answering enquiries
• keeping the website and accounts secure
• preventing abuse and fraud
• fixing technical problems
• understanding website use where you have allowed analytics

Most core service processing relies on legitimate interests.

Optional analytics relies on consent.

If another lawful basis is required for a specific activity, we will explain it.

Back to contents

Who we share information with

We use specialist service providers to operate Ready Together.

These include providers for:

• website hosting
• account authentication
• database and private file storage
• website and form security
• transactional email
• enquiry management
• analytics, where you allow it
• technical support

These providers may process personal information on our behalf.

We require them to protect it and follow our instructions.

Programme partners do not get access to your personal information just because they support Ready Together.

Nottingham Trent University does not have routine access to core account data.

Any evaluation data shared with NTU will follow the separate evaluation privacy information.

We may also share information with professional advisers, insurers or auditors where this is reasonably necessary.

They must protect the information they receive.

We may disclose information where the law requires us to do so.

This can include disclosure to a court, regulator or law-enforcement body.

We may also disclose information where necessary to protect someone’s safety or investigate serious misuse.

Back to contents

Processing outside the UK

We prefer UK processing where practical.

Some service providers may process limited personal information outside the UK.

Where this happens, we use safeguards required by UK data protection law.

You can contact us if you want more information about these safeguards.

Back to contents

How long we keep information

We keep personal information only as long as we need it.

Account information

We keep an active account while you continue to use it.

If there is no account activity for 24 months, we may prepare the account for deletion.

We will warn you at least 30 days before deleting an inactive account.

If you return during that period, the account stays active.

Closing your account

You can delete your account from your account area.

Access ends immediately, or as soon as technically practical.

We delete account information from live systems within 30 days.

This includes saved plans, progress and uploaded logos.

Saved plans

You can delete a saved plan without closing your account.

We remove it from live systems immediately, or as soon as technically practical.

Contact enquiries

We delete Contact form personal information 12 months after the enquiry is closed.

We may keep a specific enquiry longer if there is a documented legal, safeguarding or complaint reason.

Generated files

Temporary plan downloads and co-branded files are deleted automatically within 24 hours.

Analytics

Optional analytics data has a two-month user-level and event-level retention setting.

Anonymous or genuinely aggregated statistics may be kept for longer.

They must no longer identify or link back to an individual.

Technical and security records

Routine technical, access, error and email-delivery logs are kept for no more than 90 days.

Security and administrative audit logs are kept for 12 months.

Confirmed security or personal data incident records are kept for three years after the incident closes.

Privacy requests and complaints

We keep records of privacy rights requests and privacy complaints for three years after the case closes.

We delete identity-check evidence as soon as we no longer need it.

Backups

Rolling backups are kept for no more than 30 days.

Deleted information may remain in a backup until that backup expires.

Backups are not used for normal access.

If we restore a backup, we reapply earlier deletion requests where required.

We may keep information longer where the law requires it.

We may also keep it longer for an active legal, security or regulatory matter.

Back to contents

Children and young people

Ready Together is designed for people of all ages.

We do not set a minimum age for using the toolkit or creating an account.

We do not ask for a date of birth just to decide whether someone can use the service.

We apply strong privacy protections to all users.

We do not use targeted advertising or behavioural profiling.

We do not use location information to personalise the service at launch.

If research involves children or young people, it will have separate safeguards and privacy information.

Back to contents

Automated decisions and profiling

Ready Together does not make solely automated decisions using personal information that have legal or similarly significant effects.

We do not use account activity to build behavioural profiles at launch.

We do not personalise content based on your evaluation information at launch.

Back to contents

We do not sell your information

We do not sell personal information.

We do not use Ready Together personal information for advertising.

We do not use it for direct marketing at launch.

We do not share it with data brokers.

Back to contents

How we protect your information

We use technical and organisational measures to protect personal information.

These include secure authentication, restricted access, private storage, monitoring and secure development practices.

We limit access to people who need it for their work.

No online service can remove every security risk.

If we identify a personal data breach, we will manage it under our legal and security procedures.

Back to contents

Your data protection rights

Depending on the circumstances, you may have the right to:

• ask for a copy of your personal information
• ask us to correct inaccurate information
• ask us to complete incomplete information
• ask us to delete information
• ask us to restrict how we use information
• object to some uses of your information
• receive certain information in a portable format
• withdraw consent where we rely on consent

These rights do not apply in exactly the same way in every situation.

We may need to check your identity before responding.

We will only ask for information needed to make that check.

To make a request, email data.protection@nationalemergenciestrust.org.uk.

Back to contents

Your right to object

You can object when we use personal information because of our legitimate interests.

This includes some account, enquiry, security and service-management processing.

Tell us why you object.

We will consider your circumstances and the reason we need the information.

We will stop the processing where data protection law requires us to do so.

Email data.protection@nationalemergenciestrust.org.uk.

Back to contents

External websites

Ready Together may link to websites run by other organisations.

Those organisations are responsible for their own privacy practices.

Read their privacy information before giving them personal information.

Back to contents

If you have a privacy concern

Please contact us first if you are concerned about how we use your personal information.

We would like the opportunity to understand the problem and put things right.

Email data.protection@nationalemergenciestrust.org.uk.

You also have the right to complain to the Information Commissioner’s Office.

The Information Commissioner’s Office is the UK regulator for data protection.

Make a data protection complaint to the Information Commissioner’s Office

You can also call 0303 123 1113.

Or write to:

Find Information Commissioner’s Office contact details

You can contact the Information Commissioner’s Office without contacting us first.

Back to contents

Changes to this Privacy notice

We may update this notice when Ready Together changes.

We will update the “Last updated” date when we make changes.

If a change materially affects account holders, we will tell them through an essential service email.

Back to contents