Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

Disclosure Group Ltd
Email: privacy@disclosurehub.co.uk

If you have questions about this policy or wish to exercise your data rights, contact us at the address above.

2. What Personal Data We Collect

We collect the following categories of personal data:

Account and identity data

• Full name, email address, phone number
• Date of birth, occupation, address
• Login credentials (passwords are stored in hashed form only)

Case and financial data

• Information you enter into the Form E builder (financial details, property, pensions, income, etc.)
• Documents you upload (bank statements, valuations, certificates)
• Case notes, correspondence, and filing history

Technical and usage data

• IP address, browser type, device information
• Pages visited, features used, session duration
• Referral source and interactions with our website

3. Lawful Basis for Processing

Under UK GDPR Article 6, we process your data on the following legal bases:

4. Cookies and Tracking Technologies

We use cookies and similar technologies on our website. In accordance with the Privacy and Electronic Communications Regulations 2003 (PECR) and UK GDPR, we obtain your consent before placing non-essential cookies.

Strictly necessary cookies

These are essential for the website to function and cannot be switched off. They include session cookies for authentication and security tokens.

Analytics cookies (require consent)

We use Google Analytics (Google Ireland Limited) to understand how visitors interact with our website. These cookies collect information including:

• Pages viewed and time spent on each page
• How you arrived at our site (referral source)
• Your approximate geographic location (country/city level)
• Device type, browser, and screen resolution

Google Analytics uses cookies including _ga, _ga_*, and _gid. This data is processed by Google under their Privacy Policy. We have configured Google Analytics with IP anonymisation enabled.

These cookies are only placed after you provide consent via our cookie banner. If you decline, no analytics cookies will be set and no tracking data will be collected.

Managing your cookie preferences

You can change your cookie preferences at any time by clicking the "Cookie Settings" link in our website footer. You can also clear cookies through your browser settings.

5. How We Use Your Data

• To provide and maintain the Disclosure Hub application
• To process and store your Form E financial disclosure data
• To generate documents and evidence bundles for your case
• To communicate with you about your account and service updates
• To improve our service through anonymised usage analytics (with consent)
• To detect and prevent fraud or security incidents

6. Data Sharing and Transfers

We do not sell your personal data. We share data only with:

• Infrastructure providers — hosting, database, and storage services (data processed within the UK/EEA where possible)
• Google Analytics — anonymised website usage data (with your consent), which may be transferred to the US under appropriate safeguards
• Payment processors — if you subscribe to a paid plan, payment data is handled by Stripe Inc. under their own privacy policy
• Legal or regulatory authorities — where required by law or court order

Where data is transferred outside the UK, we ensure appropriate safeguards are in place (e.g., UK International Data Transfer Agreement or adequacy decisions).

7. Data Retention

We retain your personal data for as long as necessary to provide our services:

• Account data: retained while your account is active and for 2 years after deletion
• Case data and documents: retained while your account is active; deleted within 90 days of account closure
• Analytics data: retained for 14 months (Google Analytics default with our configuration)
• Audit logs: retained for 6 years to comply with legal and regulatory requirements

8. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate data
• Right to erasure — request deletion of your data (subject to legal retention requirements)
• Right to restrict processing — request we limit how we use your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — withdraw consent for analytics or marketing at any time

To exercise any of these rights, email privacy@disclosurehub.co.uk. We will respond within one month.

If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO):

Website: ico.org.uk
Helpline: 0303 123 1113

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption of data in transit (TLS) and at rest
• Access controls and authentication requirements
• Regular security monitoring and audit logging
• Secure infrastructure hosted within managed environments

10. Children's Data

Our service is not directed at individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

11. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be communicated via email or a prominent notice on our website. The "Last updated" date at the top of this page indicates when the policy was last revised.

12. Contact Us

For privacy-related enquiries or to exercise your data rights:

Email: privacy@disclosurehub.co.uk
General support: support@disclosurehub.co.uk