Privacy Policy

The Mobile Elections App (MEA) platform is maintained by Civica Xpress. Civica Xpress acts as the Data Processor for information uploaded to and made available from this web platform. In one situation Civica Xpress acts as the Data Controller for users in some limited circumstances which are detailed below.

Civica Xpress is part of Civica UK Limited.

Our Contact Details:
Civica’s Headquarters is located at
Southbank Central (8th Floor)
30 Stamford Street
London
SE1 9LQ
Tel: 020 7760 2800

Civica is registered with the Information Commissioner’s Office, with registration number Z5268164.

If you have questions or comments about this Privacy Notice or how we handle personal data, please direct your correspondence either to the above postal address (marking the envelope FAO – Data Protection Officer), or to [email protected].

Where Civica Xpress Acts as the Data Processor

For all information stored using the MEA platform; other than for the exception stated below, your employer or the relevant Local Authority, Returning Officer, or Electoral Registration Officer will act as the Data Controller.

Personal data including bank details, right to work documentation, address and contact details will be stored in accordance with the data retention policy of the Data Controller and you should consult this document. The privacy statement of, and other relevant information pertaining to the Data Controller where not Civica Xpress can be found on their company website and must be made available upon request.

The MEA platform is hosted by Microsoft Azure. All data hosted within Microsoft Azure is encrypted and secure to a high standard. All data hosted by Microsoft Azure for the MEA platform is stored within the United Kingdom. Microsoft enterprise cloud services are independently validated through certifications and attestations, as well as third-party audits. In-scope services within the Microsoft Cloud meet international and industry-specific compliance standards, such as ISO/IEC 27001 and ISO/IEC 27018, FedRAMP, and SOC 1 and SOC 2. They also meet regional and country-specific standards and contractual commitments, including the EU Model Clauses, UK G-Cloud, Singapore MTCS, and Australia CCSL (IRAP).

Personal information may be obtained directly from an MEA user in a number of ways including:

  • When you create an MEA account for the purpose of employment with a Returning Office, Electoral Registration Officer, Local Authority, or other employer.
  • When you create an MEA account for the purpose of acting as a booking agent in relation polling station or other electoral venue transactions.
  • When you create an MEA account for any other purpose.
  • When you submit or make changes to personal, contact, or employment information for your MEA account.
  • When you upload employment documentation to the MEA platform
  • When you submit direct messages or documents to the MEA platform which include such information

Personal information may also be obtained when uploaded directly to the MEA platform by the Data Controller.

Documents submitted to the Mobile Elections App (MEA) platform will be stored in accordance with the privacy policy and document retention policy of your employer, or the Local Authority, Returning Officer or Electoral Registration Officer who has requested that this be submitted via the MEA platform.

Users have access to a enable or disable an offline mode for the Presiding Officer and Polling Station Inspector modules for the MEA platform. Offline modes will be disabled by default. Data Controllers may choose to enable offline mode for the MEA platform. Where the offline mode for these modules is enabled, data can be stored temporarily in the cache of browsers on devices used for these modules.

Data which is stored temporarily in the cache of a user's browser can no longer be regulated by Civica Xpress as a Data processor. It is the responsibility of users to ensure that data stored in their browser cache is uploaded to the MEA server and consequently removed from their device at the earliest opportunity. Data Controllers should inform end users of this responsibility. Where Data Controllers do not wish to enable data to be stored in the browser cache of end users, offline modes for the MEA platform will not be enabled by default and should be disabled where appropriate.

Any special category information submitted as part of employment documentation to the MEA platform will be stored in accordance with the privacy policy and document retention policy of your employer, the Local Authority, Returning Officer or Electoral Registration Officer who has requested that this be submitted via the MEA platform.

Where Civica Xpress acts as the Data Controller

In one instance of use Civica Xpress will act as the Data Controller for information supplied by users. Anonymised email address information will where necessary be supplied to a third party supplier (SendGrid) for the purpose of sending solicited communication. This instance of use will involve a transfer of personal data to a third country.

The Mobile Elections App (MEA) platform includes a function for users to receive an email including information which enables a user to reset their username. Where this function is used users will receive an anonymised emailed via a third party provider SendGrid. In this instance email address data will be provided to a third party. Only email address information will be supplied. No other information will be supplied to, or retained by a third party in this context. A data sharing agreement is in place with SendGrid.

International Transfers

Civica operates and provides services from its locations across the globe. As such we may transfer personal information to Civica group locations outside of the EEA when we have a business reason to do so. We have Intra-Group Transfer Protocols in place based on Standard Contract Clauses which provide legal safeguards for such transfers.

Sharing information

We will never sell your data to third parties. Data may at times be required to be provided to third parties where there is a legal or business need to do so. The details of all transfers of information to third parties required by the use of the MEA platform have been detailed in this privacy notice. Should your data be required to be supplied to any further third party organisations you will be informed of any changes to this privacy notice in order to attain your consent.

Your Rights

Your right of access –You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information we process.

Your right to rectification – You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies.

Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing – You have the right to ask us to restrict the processing of your information in certain circumstances.

Your right to object to processing – You have the right to object to processing if we are using legitimate interests as our lawful basis for processing.

Your right to data portability – This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another, or give it to you. The right only applies if we are processing information based on your consent or as part of a contract, or in talks about entering into a contract and the processing is automated.

Your right to withdraw consent – You can withdraw your consent that you have previously given to one or more specified purposes to process your personal data. This will not affect the lawfulness of any processing carried out before you withdraw your consent. It may mean we are not able to provide certain products or services to you and we will advise you if this is the case.

Rights related requests

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information or to exercise any of your other rights. This helps us to ensure that personal data is not disclosed to any person who has no right to receive it.

No fee is required to make a request unless your request is clearly unfounded or excessive. Depending on the circumstances, we may be unable to comply with your request based on other lawful grounds.

How to complain

If you disagree with how we are processing your data, please contact our DPO at [email protected] or address your letter to the DPO at the Civica Headquarters address listed in the ‘Contact Details’ section. You can also complain to the ICO if you are unhappy with how we have used your data.

The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113

Changes to this Privacy Notice.

Civica will occasionally update this privacy notice to reflect changes in legislation, our practices and services. When we post changes to this privacy notice, we will revise the “last updated” date at the top of this privacy notice. If we make any material changes in the way we collect, use, and share personal data, we will notify you by prominently posting notice of the changes on the website. We recommend that you check this page from time to time to inform yourself of any changes in this privacy notice.