1. Who we are

ConsultOnline is operated by PNPR Ltd, registered in England and Wales (Company No. 08357874). Our registered address is 14 Lannesbury Crescent, St. Neots, Cambridgeshire, PE19 6AF. We provide a software platform that helps local authorities, planning consultancies, developers and other organisations run public consultations digitally.

If you have questions about this policy, want to know what personal data we hold about you, or want to exercise your rights, contact us at info@consultonline.uk or write to us at the registered address above.

2. Data controller and processor roles

The role PNPR Ltd plays depends on the type of data being processed:

Consultation response data: the organisation running the consultation, such as a local authority, planning consultancy or developer, is usually the data controller. PNPR Ltd acts as a data processor on their behalf under a Data Processing Agreement.
Platform account data, marketing-site visitors and business enquiries: PNPR Ltd is the data controller and determines the purposes and means of processing.

3. What data we collect

We collect personal data when you use our website, use the ConsultOnline platform, contact us, respond to a consultation, subscribe to updates, or otherwise correspond with us, including by email or telephone. The data we collect may include:

Account information: name, email address, password and authentication/session data when you register for a dashboard account.
Consultation responses: survey answers, map pin comments, idea submissions, uploads, feedback, and other responses you provide through a consultation website or microsite.
Demographic data: where a consultation asks for monitoring information such as age, ethnicity, disability status or other protected characteristics. See section 6 for further detail.
Contact and correspondence information: name, email address, telephone number, organisation, role, message content, attachments, and our responses when you contact us or a consultation organiser.
Marketing and subscription preferences: your communication preferences, consent records, unsubscribe requests and engagement with emails we send.
Usage and technical data: pages visited, referring pages, date and time of visits, device type, browser, operating system, IP address, approximate location derived from IP address, and web server log information.
Cookies and similar technologies: see section 11 and our Cookies page for more detail.

4. How we use your data

We use personal data to:

Provide, operate, secure and improve the ConsultOnline platform and marketing website.
Authenticate your account, maintain your session and provide account support.
Allow consultation organisers to collect, analyse, moderate, manage and report on consultation feedback.
Respond to enquiries, emails, support requests and other correspondence.
Send service-related emails such as verification, password reset, invitation, notification and security messages.
Send consultation notifications, product updates, newsletters, event invitations or other marketing communications where permitted by law and your preferences.
Understand engagement with communications and website content so we can make messages and services more relevant.
Generate aggregated or anonymised analytics for consultation organisers and for our own service improvement.
Keep appropriate records, comply with legal obligations, respond to regulators or law enforcement agencies, and protect our rights, users and services.

5. Legal basis for processing

We process personal data on the following legal bases under UK GDPR:

Contract: where processing is necessary to provide services you or your organisation have signed up for.
Legitimate interests: to respond to enquiries, operate and improve the platform, secure our systems, provide analytics to consultation organisers, understand engagement, conduct appropriate business development, and ensure our operations are run efficiently. We use this basis only where our interests are not overridden by your rights and freedoms.
Consent: for optional notification subscriptions, certain marketing communications, analytics cookies, and some special category data processing. You can withdraw consent at any time.
Substantial public interest: where applicable for processing special category data in the context of public consultations, representation monitoring and planning or public engagement activities.
Legal obligation: where we are required by law to process or disclose information, including to regulators, courts or law enforcement agencies.

6. Special category data

Some consultations may collect demographic or equality monitoring data, such as age, ethnicity, disability status, health-related information or other protected characteristics, to understand whether responses are representative of the affected community. This data falls within the special categories defined by UK GDPR.

Where such data is collected, it is processed on the basis of explicit consent or, where applicable, for reasons of substantial public interest in accordance with Schedule 1 of the Data Protection Act 2018. Additional safeguards are used, including access controls, role-based permissions, minimisation, pseudonymisation where practical, and strict limitations on onward sharing.

7. Automated processing and sentiment analysis

The platform may use automated analysis, including sentiment and theme analysis, on free-text consultation responses. This helps consultation organisers identify common themes and patterns across large volumes of feedback more efficiently.

Automated analysis is not used by PNPR Ltd to make decisions about individuals. The consultation organiser, not PNPR Ltd, is responsible for decisions made on the basis of consultation results and any associated analysis.

You have the right to request human review of automated analysis that has been applied to your consultation response. To make such a request, contact the consultation organiser directly or email us at info@consultonline.uk.

8. Marketing, profiling and consent

We may send marketing communications about ConsultOnline, public consultation practice, industry updates, events, product updates or related services where you have opted in or where the law otherwise permits us to contact you. Each marketing email will include a way to unsubscribe.

We may analyse engagement with direct marketing communications, such as whether emails are opened or links are clicked, so we can understand what is useful and send more relevant content. We do not sell personal data to third parties and we do not use this activity to make decisions that produce legal or similarly significant effects about you.

Where we rely on consent, you can withdraw that consent at any time by using an unsubscribe link, changing your preferences where available, or contacting us at info@consultonline.uk.

9. Data sharing and sub-processors

Consultation responses are shared with the organisation running the relevant consultation and, where instructed by that organisation, with their authorised project partners such as planning consultants, communications agencies, technical advisers or reporting teams.

We may share personal data with trusted service providers who help us operate the website and platform, such as hosting providers, database providers, email delivery services, analytics providers, error monitoring tools, customer support systems, professional advisers and other technical suppliers. These providers may only process personal data for agreed purposes and must protect it appropriately.

We may disclose personal data to regulatory bodies, courts, law enforcement agencies or other third parties where required or permitted by law. A current list of sub-processors is available on request by emailing info@consultonline.uk.

10. Data location and international transfers

We aim to store personal data in data centres located in the United Kingdom or European Economic Area. If we need to transfer personal data outside the UK adequacy area, we will use appropriate safeguards such as adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, or another lawful transfer mechanism.

11. Cookies and web server logs

Our website and platform use cookies and similar technologies. A cookie is a small text file placed on your device that helps a website remember information about your visit. Web server logs may record technical information such as date and time of visits, pages viewed, time spent on pages, referring pages, browser type, operating system and IP address.

We use strictly necessary cookies for core functions such as authentication, security, content gates, language settings and cookie preferences. We use analytics cookies only where consent is required and you have given that consent. Cookies and logs help us understand aggregate usage, improve the website and platform, diagnose issues and protect our services.

We do not use third-party advertising cookies. You can update cookie preferences through the Manage cookies link in the footer or read more on our Cookies page.

12. Data retention

We retain personal data only for as long as necessary for the purpose for which it was collected, including to provide services, meet legal and contractual obligations, resolve disputes, maintain security, and keep appropriate records. Our retention periods vary depending on the nature of the data and the reason it is held.

Account data: retained for the lifetime of your account, plus 12 months after account closure unless we need to keep limited records for legal, security or fraud-prevention reasons.
Consultation response data: retained for the period agreed with the consultation organiser, typically up to 6 years where planning authority or project record-keeping requirements apply.
Contact form enquiries and correspondence: retained for up to 24 months from the date of your enquiry unless an ongoing relationship, contract, dispute or legal requirement means we need to keep it longer.
Marketing data: we will not continue direct marketing to you for longer than 3 years without renewed consent or another lawful basis. We may keep suppression records, such as your email address and unsubscribe status, to make sure we respect your choices.
Analytics data: retained in aggregated or anonymised form where practical. Anonymised data is not personal data.

In some cases we may delete, aggregate or anonymise data so it can no longer identify you. You may request deletion of your data, subject to legal, contractual and public-record retention obligations.

13. Children and young people

The ConsultOnline dashboard is not intended for use by individuals under the age of 13. Where a consultation may involve respondents under the age of 18, the consultation organiser is responsible for deciding whether parental or guardian consent is required and for providing appropriate privacy information for that consultation.

14. Data breach notification

If a personal data breach occurs, we will assess the risk and take appropriate action. Where UK GDPR requires it, PNPR Ltd will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach. Where a breach is likely to result in a high risk to individuals, affected individuals will also be notified without undue delay.

15. Your rights

Under UK GDPR, you have rights in relation to your personal data. These rights are subject to limits and exceptions, and we may need to verify your identity before acting on a request. Where we cannot comply with a request, we will explain why. You can exercise these rights free of charge unless a request is manifestly unfounded, excessive or repetitive.

Your rights include the right to:

Access the personal data we hold about you and receive information about how it is used.
Rectify inaccurate or incomplete personal data.
Request erasure of personal data in certain circumstances.
Restrict or object to processing in certain circumstances, including objecting to direct marketing at any time.
Receive certain data in a structured, commonly used and machine-readable format and ask us to transmit it to another organisation where technically feasible.
Withdraw consent at any time where processing is based on consent.
Request human review of automated processing where applicable.
Lodge a complaint with the Information Commissioner's Office.

To exercise your rights, email info@consultonline.uk or write to us at the registered address above. If your request relates to a specific consultation where another organisation is the data controller, we may direct your request to that organisation or help them respond.

16. Complaints

If you are unhappy about how we use your personal data, please contact us first so we can try to resolve the issue. You also have the right to complain to the Information Commissioner's Office: Website: ico.org.uk. Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

17. Security

We use technical and organisational measures designed to protect personal data, including encrypted connections, secure authentication, hashed passwords, access controls, role-based permissions, monitoring, backups and staff access restrictions. No system is completely risk-free, but we regularly review our safeguards and improve them where needed.

19. WhatsApp chatbot and AI assistant services

Some consultations may offer a website chatbot or WhatsApp chatbot to help users find public consultation information, project documents, frequently asked questions, and ways to take part. If you use these services, we may process your message content, phone number or account identifier, message metadata, conversation history, project context, moderation status, escalation notes, and any information you choose to provide.

Chatbot services may use automated systems, including artificial intelligence tools, to generate replies from publicly available project information and from documents or content that the relevant user is authorised to access. Restricted or private documents are not included in chatbot responses unless the project owner has configured them to be available for that purpose and the user has the required access.

For WhatsApp messages, information may be processed by Meta Platforms Ireland Limited and its affiliates as part of the WhatsApp Business Platform. We may also use AI service providers, hosting providers, monitoring tools and moderation systems to process chatbot requests and generate responses. These providers act under contractual controls and may only process data for agreed purposes.

Chatbot conversations may be logged so that we can provide the service, answer follow-up questions, prevent abuse, apply rate limits, investigate spam or inappropriate use, improve accuracy, and escalate issues to a human project team where needed. Automated replies are intended to provide helpful information and do not replace formal consultation notices, planning documents, professional advice, or human review.

Please do not include unnecessary sensitive personal data in chatbot messages. If a message appears abusive, spam, unlawful, unsafe, or outside the scope of the consultation, it may be blocked, rate-limited, marked for moderation, or escalated for review.

20. Chatbot and messaging retention

Website chatbot and WhatsApp chatbot conversation data is retained only for as long as needed to provide the service, maintain security, investigate abuse, handle escalations, meet legal or contractual obligations, and support the relevant consultation record. Retention periods may vary by project and by the role of the consultation organiser. You may request deletion of chatbot data, subject to legal, contractual and public-record retention obligations.

18. Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email where appropriate, through the platform, or through a notice on the website. The last updated date at the top of this page reflects the most recent revision.

Privacy Policy