Privacy Policy

1. Data We Collect and Why

We limit our data collection to only what is strictly necessary to run the platform securely and fulfil our project contracts:

• Account Information: If required by a project, we collect your Username and Email Address to manage your account, authenticate your login, and verify project eligibility.
• Technical Logs (IP Addresses): We automatically collect your IP Address when you visit the site or make a submission. We process this for legitimate security interests: specifically, to track malicious activity, prevent spam, and enforce platform bans against disruptive users.
• Geospatial and Opinion Data: We collect the text comments and geometric data you submit. This feedback is linked to an internal system ID rather than your personal details when shared or commercialised.

2. Children's Data and Educational Settings

• Direct Users: We do not knowingly collect or store personal data (such as emails or IP addresses) from independent users under the age of 13. If we discover an account has been created by a child under 13 without verification, it will be terminated immediately.
• Schools as Intermediaries: When our platform is deployed as part of a school project or curriculum task, Map The Gap Ltd acts as a Data Processor on behalf of the school. The school remains the primary Data Controller. Any student data, IP logs, or map geometries collected during school-led sessions are processed strictly under the educational mandate and data safety compliance frameworks managed by that specific academic institution.

3. Legal Basis for Processing

Under UK GDPR, we process your data under the following legal grounds:

• Consent: When you opt to sign up and submit opinions.
• Legitimate Interests: For collecting IP addresses to ensure cyber security, moderate content, and enforce user bans.

4. Data Transfers and Infrastructure

Your personal data flows through our secure, modern infrastructure stack:

• Cloudflare: Used for edge proxy routing, optimisation, and security filtering.
• Neon Database: Stored natively in the AWS London region (eu-west-2), ensuring your personal data remains within the United Kingdom.

5. Data Sharing and Commercialisation

We do not sell raw personal details (like emails or IP addresses) to third parties. However, we do partner with local councils, corporate organisations, and clients to deliver public opinion data. For these purposes, all map opinions and geometries are strictly anonymised using random IDs before transfer.

6. Your Rights

Under UK data protection law, you have the right to access your personal data, request corrections, ask for deletion, or object to processing. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO). To exercise any of these rights, please contact us at info@mapthegap.co.uk.