Democracy Technology Privacy Policy

1 Who we are and what we do

1.1 Who we are

We are Democracy Technology Ltd (trading as Mi-Voice), (“Mi-Voice”, “us”, “we”, “our”). We are a limited company registered in England and Wales under registration number 06397657 and we have our registered office at Unit 8, Mill Court, The Sawmills, Durley SO32 2EJ.

We are registered with the UK supervisory authority, Information Commission (“IC”), in relation to our processing of Personal Data under registration reference ZA017280.

1.2 What we do

We provide a range of secure, multi-channel voting election services for various organisations including, but not limited to professional bodies, trade unions, charities and corporations.

1.3 Controller

Unless we notify you otherwise, we are the controller of the Personal Data we process about you. This means that we decide what Personal Data to collect and how to process it.

1.4 Processor

Where we process Personal Data on behalf of our clients for example, through Mi-Vote or Mi-Nomination, we act as a processor for our clients. In this scenario, our client is the organisation that instructs us to collect and process your Personal Data which means they are the controller of your Personal Data. Please see their Privacy Notice for information on how your Personal Data is processed.

2 Purpose of this Privacy Notice

The purpose of this privacy notice is to explain what Personal Data we collect about you and how we process it. This privacy notice also explains your rights, so please read it carefully. If you have any questions or you wish to make a complaint, you can contact us using the information provided below under the ‘How to contact us’ section.

3 Who this Privacy Notice applies to

This privacy notice applies to you if:

You visit our website
You purchase our products and/or services
You enquire about our products and/or services
You provide us with your business contact information
You submit formal tender documentation
You sign up to receive newsletters and/or other promotional communications from us
You visit us at our offices

4 What Personal Data is

‘Personal Data’ means any information from which someone can be identified either directly or indirectly. For example, you can be identified by your name or an online identifier.

5 Personal Data we collect

The type of Personal Data that we collect from you will depend on our relationship with you. For the type of Personal Data we collect about you, please see the table below in the section entitled ‘Purposes, lawful bases and retention periods’.

6 How we collect your Personal Data

We collect most of the Personal Data directly from you in person, by telephone, text or email and/or via our website. For example, we will collect your Personal Data when you:

submit an online form to request more information from us
complete a referral enquiry form
give it to us at a conference or event
give it so us when you enter a competition
complete an enquiry form or give us your business card
contact us by email or telephone to request more information
submit formal tender documentation
message us directly via our social media channels
provide us with your client feedback
allow third-party tools, such as Google Analytics, Microsoft Clarity and Microsoft Advertising, to collect data about your browsing behaviour on our website via cookies and other tracking technologies. For further information, please see our Cookie Policy.

However, we may also collect your Personal Data from third parties such as:

reputable companies who provide lead generation contact lists
others to whom you have provided consent
publicly available sources such as social media platforms

7 CCTV and Video Surveillance

We record images using CCTV cameras and operate a live feed using Ring video doorbell. For further details, please see the table below.

8 Purposes, lawful bases and retention periods

We only use your Personal Data when the law allows. Most commonly, we use your Personal Data in the circumstances set out in the table below.

With regard to how long we keep your Personal Data, we will only keep it for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of providing you with access to our site, responding to enquiries, or managing your account.

We may retain your Personal Data for a longer period where it is necessary to comply with legal, regulatory, or accounting requirements, or to resolve disputes and enforce our agreements. Once the applicable retention period expires, your data will be securely deleted or anonymised.

Categories of individuals	Categories of Personal Data	Purpose of Processing	Lawful Basis	Retention Period
Representatives of existing customers and suppliers	Name, job title, Company name, business address, business email address and phone number	To administer the contract we have with the company you work for	Legitimate interests	6 years following the date of the transaction
Representatives of prospective customers	Name, job title, Company name, business address, business email address and phone number	To contact you to promote our services / negotiate a contract	Legitimate interests	2 years following last meaningful contact
Representatives of former customers	Name, job title, Company name, business address, business email address and phone number	To process any post-contract queries, claims etc	Legitimate interests	6 years following the end of the contract
Representatives of existing, former and prospective customers	Name, job title, Company name, business address, business email address, business phone number and details of your enquiry	To respond to your enquiry	Legitimate interests	12 months from the date the enquiry is closed
Representatives of existing, former and prospective customers	Name and business email address	To process your competition entry	Consent	6 months from the date of the competition
Representatives of existing, former and prospective customers	Name, job title, Company name, business address, business email address and phone number	To send you newsletters and other promotional material having collected your contact details at an event or exhibition	Legitimate interests	2 years following last meaningful contact
Representatives of existing, former and prospective customers	Name and business email address	To send you newsletters and other promotional material	Legitimate interests	2 years following last meaningful contact
Individuals who we have a telephone call with	Name, Company name and telephone number and any other details you share during the telephone call	To record the telephone call for training and monitoring purposes	Legitimate interests	2 years following last meaningful contact
Representatives of existing and former customers	Name, job title, Company name, business address, business email address and business phone number	Client feedback and research (to understand client needs and inform product improvement)	Legitimate interests	2 years following last meaningful contact
Website visitors	Using Google Analytics, we collect the following information: · Device and browser data, such as IP address, information about your device and browser settings	Various purposes – see our cookie notice on our website	Consent	See our cookie notice
Website visitors	Behavioural metrics, heatmap data, session replay data, device and browser information, IP address, cookie data	Website improvement, marketing, site optimisation, fraud/security purposes, and advertising via Microsoft Clarity and Microsoft Advertising	Consent	See our cookie notice
Anyone attending our premises	CCTV images; live video feed via Ring doorbell (no live recording)	For the purposes of the security, the prevention, detection, investigation of crime and the apprehension and prosecution of offenders and the safety of our staff and visitors.	Legitimate interests	Ring Doorbell is a live feed only. No footage is recorded. CCTV footage is retained for 30 days unless there is an incident, in which case we retain it for as long as is necessary for any related investigation and action.

9 Sharing your Personal Data

We do not sell your Personal Data. However, we may share your Personal Data with trusted third parties where necessary for the operation of our services. For example, we will share your Personal Data with suppliers and providers who will carry out services on our behalf, such as email providers and IT service providers. We also share data with third-party analytics and advertising partners in accordance with our cookie notice.

We will ensure that we enter into robust contracts with all third parties with whom we share your Personal Data so that they are contractually and legally required to process your Personal Data securely and in accordance with the relevant data protection law. They will be required to only process your Personal Data in accordance with our instructions and the applicable data protection legislation, and they will not be able to use it for their own purposes.

We do not allow any third parties to use your Personal Data for their own purposes, and we will not share your Personal Data with third parties for marketing purposes.

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our site, we encourage you to read the privacy notice of every website you visit.

Where we are under a legal or regulatory duty to do so, we may disclose your details to the police, regulatory bodies or legal advisors, and/or, where we consider necessary to protect the rights, property or safety of our personnel, users or others. We may also share your data with our outsourced Data Protection Officer (“DPO”), Evalian, as necessary, in relation to data protection matters. Our DPO can be contacted using the details set out below.

10 International Transfers

Your Personal Data may be processed outside of the UK. This is because some of the organisations we use to provide our service to may be based outside the UK.

We have taken appropriate steps to ensure that when your Personal Data is processed in a country outside the UK, it does not have a materially lower level of protection than that guaranteed in the UK.

We do this by ensuring that:

Your Personal Data is only processed in a country which the Secretary of State has confirmed has an adequate level of protection (an adequacy regulation), or
We enter into an International Data Transfer Agreement (“IDTA”) with the receiving organisation and adopt supplementary measures, where necessary. (A copy of the IDTA can be found here international-data-transfer-agreement.pdf (ico.org.uk)) or
When transferring your Personal Data to America, we may rely on the UK-US Data Bridge, where appropriate.

11 Marketing Communications

Mi-Voice may contact prospective clients and existing clients from time to time via email, telephone and/or direct mail to promote our services and referral scheme. We will not share your information with any other third party for marketing purposes. You can unsubscribe at any time by clicking on the ‘unsubscribe’ link in the communications we send you or by contacting us directly on enquiries@mi-voice.com

12 Unsubscribe

We may distribute e-mails on behalf of our clients informing individuals about an event or inviting them to vote. If you receive an e-mail that you believe has been sent in error, or if you wish to unsubscribe from any further communications with regard to the event in question, please e-mail or write to us and we will ensure that you are removed from the mailing list being used. Alternatively, you can use the unsubscribe link that can be found at the bottom of the e-mail communication received.

To unsubscribe from emails directly from Mi-Voice (not our clients), please use the unsubscribe button link within the email you have received or email us directly at enquiries@mi-voice.com using the subject line ‘Unsubscribe’ and notify us of the email you wish to unsubscribe.

13 Your rights

You have certain rights in relation to the processing of your Personal Data, including to:

13.1 Right to be informed

You have the right to know what personal data we collect about you, how we use it, for what purpose and in accordance with which lawful basis, who we share it with and how long we keep it. We use our privacy notice to explain this.

13.2 Right of access (commonly known as a “Subject Access Request”)

You have the right to receive a copy of the Personal Data we hold about you.

13.3 Right to rectification

You have the right to have any incomplete or inaccurate information we hold about you corrected.

13.4 Right to erasure (commonly known as the right to be forgotten)

You have the right to ask us to delete your Personal Data.

13.5 Right to object to processing

You have the right to object to us processing your Personal Data. If you object to us using your Personal Data for marketing purposes, we will stop sending you marketing material.

13.6 Right to restrict processing

You have the right to restrict our use of your Personal Data.

13.7 Right to portability

You have the right to ask us to transfer your Personal Data to another party.

13.8 Automated decision-making.

You have the right not to be subject to a decision based solely on automated processing which will significantly affect you. We do not use automated decision-making.

13.9 Right to withdraw consent

If you have provided your consent for us to process your Personal Data for a specific purpose, you have the right to withdraw your consent at any time. If you do withdraw your consent, we will no longer process your information for the purpose(s) you originally agreed to, unless we are permitted by law to do so.

13.10 How to exercise your rights

You will not usually need to pay a fee to exercise any of the above rights. However, we may charge a reasonable fee if your request is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

If you wish to exercise your rights, you may contact us using the details set out below within the section called ‘How to contact us and our Data Protection Officer’. We may need to request specific information from you to confirm your identity before we can process your request. Once in receipt of this, we will process your request without undue delay and within one month. In some cases, such as with complex requests, it may take us longer than this and, if so, we will keep you updated.

14 Complaints

You have the right to complain if you consider that we have not complied with the data protection law when handling your Personal Data. We will acknowledge receipt of your complaint within 30 days, investigate the matter without undue delay, and keep you informed of the progress and outcome. If you wish to complain please use the contact details given below under “How to contact us and our Data Protection Officer”. We will do our best to resolve the matter to your satisfaction.

If you are not satisfied with the outcome of your complaint, you can complain with the relevant supervisory authority. The supervisory authority in the UK is the Information Commission who can be contacted online at:

For supervisory authorities in other countries within the EU see the link below:
https://edpb.europa.eu/about-edpb/about-edpb/members_en

15 Children’s Privacy

Some of our products and services are used by organisations in the education and children’s services sector. Where our clients instruct us to process the Personal Data of children in connection with our services, we do so as a data processor acting on their behalf. The client organisation is the data controller and is responsible for ensuring appropriate transparency and consents are in place. For details of how your Personal Data is used in this context, please refer to the privacy notice of the organisation that invited you to participate.

We retain children’s Personal Data only for as long as is necessary to deliver the service, and it is securely deleted within 6 months of the conclusion of the relevant event.

If you believe a child’s Personal Data has been shared with us inappropriately, please contact us using the details below and we will investigate promptly.

16 How to contact us and our Data Protection Officer

If you wish to contact us in relation to this privacy notice or if you wish to exercise any of your rights outlined above, please contact us as follows:

By post at: Unit 8, Mill Court, The Sawmills, Durley SO32 2EJ.

By email at: enquiries@mi-voice.com

By phone on: +44 (0) 2380 763 980

17 Changes to this Privacy Notice

We may update this notice (and any supplemental privacy notice), from time to time as shown below. We will notify of the changes where required by applicable law to do so.

Last modified 21st August 2026