Legal
Privacy notice
Last updated 29 October 2026
This notice explains how personal data is collected, used, disclosed, retained and protected in connection with the OurGround service. It is provided in accordance with Articles 13 and 14 of the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”). It should be read together with our Terms of use.
Contents
- Definitions and scope
- The controller and how to contact us
- Personal data we process
- Sources of personal data
- Purposes and lawful bases
- Management Companies
- Recipients and disclosure
- International transfers
- Retention
- Security
- Personal data breaches
- Your rights
- Automated decision-making
- Cookies and similar technologies
- Children
- Information you provide about others
- Changes to this notice
- Complaints
1. Definitions and scope
1.1 In this notice: “Service” means the OurGround web application, any associated mobile application and the systems through which they are provided; “Website” means the public information pages at ourground.co.uk, excluding the Service; “Estate” means a managed residential development registered on the Service; “Management Company” means an organisation that manages one or more Estates and holds an account on the Service; “User”, “you” and “your” mean any individual who accesses the Website or holds an account on the Service; and “we”, “us” and “our” mean the controller identified in section 2.
1.2 “Personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meanings given to them in the UK GDPR.
1.3 This notice applies to personal data processed through the Website and the Service. It does not apply to any third-party website, application or service, including those linked from the Website or the Service, each of which is governed by its own privacy notice.
2. The controller and how to contact us
2.1 The controller responsible for personal data processed through the Service and the Website is OurGround (ourground.co.uk).
2.2 All enquiries concerning this notice or our processing of personal data, including requests to exercise the rights described in section 12, should be sent by email to contact@ourground.co.uk, marked for the attention of the Data Protection Lead.
2.3 We are not required to appoint a Data Protection Officer under Article 37 UK GDPR and have not done so. Data protection matters are handled by the contact at 2.2.
3. Personal data we process
3.1 Depending on how you use the Service, we process the following categories of personal data:
| Category | Description | Visibility to others |
|---|---|---|
| Account data | Email address and password. Passwords are held in a protected form that cannot be read by us or by any other person. | None |
| Profile data | Username and display name. | Members of the same Estate |
| Age | The age you give when you create an account, so we can refuse registration under 14. | None |
| Identity data | Real name, where supplied. | OurGround only, for account support. Never shown to other residents or to Management Companies |
| Contact data | We do not collect a telephone number when you create an account. A Management Company may record a work telephone number on a staff record (see Staff records). | Work telephone numbers: admins of that Management Company. Never shown to residents |
| Location data | Precise geographic coordinates, collected only when you submit a report or elect to display your location on an Estate map. Location is not collected in the background. | Members of the same Estate, where attached to a report |
| User content | Descriptions, comments, messages and photographs you submit. Photographs may incidentally capture identifiable individuals, vehicles or property. | Members of the same Estate, subject to role; messages are visible only to their participants |
| Operational records | Issue reports, status changes, maintenance logs, site inspections and the identity of the User and time associated with each (the “Audit Trail”). | Members of the same Estate, subject to role |
| Subscription data | Details of any subscription held in respect of an Estate, including its start and expiry dates. | You and OurGround only. Never shown to Management Companies |
| Staff records | If you work for a Management Company: your company role, and any staff record it keeps about you, being your name, job title, work phone and email, home postcode (converted to an approximate position and used only to estimate travel time), skills, licences, whether you can drive, working pattern, leave allowance, days off and your rota. See section 6. | Admins of your Management Company; you see your own record and rota. Residents see only your username and a company badge |
| Consent records | The version of this notice you acknowledged and the date on which you did so. | None |
| Technical and security data | Internet Protocol (IP) address, device and browser information, and records of access to the Service, used to operate the Service and to protect accounts from misuse. | None |
| Correspondence | The content of any communication you send us, including support requests and bug reports. | None |
3.2 Where a subscription is paid for by card or other electronic means, the payment is processed by a third-party payment service provider acting as an independent controller. We do not receive or store full payment card details.
3.3 We do not seek to collect special category data within Article 9 UK GDPR or personal data relating to criminal convictions and offences within Article 10 UK GDPR. You must not include such data in reports, comments, messages or photographs unless strictly necessary. Where such data is nonetheless submitted, we will process it only to the extent necessary to operate the Service and may remove it. Days off in staff records are recorded only as holiday, training, unplanned absence or other: the Service does not record sickness or any other health information, and has no free-text field for days off.
3.4 The Website does not require registration. It does not collect the categories listed in 3.1, save for technical data processed in the ordinary course of delivering web pages, and save for the company enquiry form. If you submit that form, we process your name, work email address, company name, any telephone number you give, how many estates you tell us about, and what you write. We email that enquiry to ourselves. We use it only to reply about your enquiry. It is correspondence for the purpose of section 9, and we do not add you to a marketing list.
4. Sources of personal data
4.1 We obtain personal data: (a) directly from you, when you register, complete your profile, submit content, correspond with us or otherwise use the Service; (b) from your device, with your permission, in the case of location data; (c) from other Users, where content they submit refers to or depicts you; and (d) from a Management Company, where it records details of its residents or staff on the Service.
5. Purposes and lawful bases
5.1 We process personal data for the following purposes, in reliance on the lawful bases under Article 6(1) UK GDPR stated against each:
| Purpose | Lawful basis |
|---|---|
| Creating and administering your account and verifying your identity when you sign in | Performance of a contract (Art. 6(1)(b)) |
| Providing the Service, including the reporting, tracking and resolution of Estate issues, maintenance and inspections, and messaging between residents and management | Performance of a contract (Art. 6(1)(b)) |
| Administering subscriptions | Performance of a contract (Art. 6(1)(b)) |
| Maintaining the Audit Trail as an accurate and complete record of work carried out on an Estate | Legitimate interests (Art. 6(1)(f)): the interest of Management Companies and residents in a reliable record for accountability, dispute resolution and insurance purposes |
| Securing the Service, preventing fraud and misuse, and investigating suspected breaches of our Terms of use | Legitimate interests (Art. 6(1)(f)): the protection of the Service, its Users and their data |
| Processing precise location data | Consent (Art. 6(1)(a)), given through your device’s location permission, which you may withdraw at any time |
| Sending service communications, such as account-recovery and verification emails and notices of material changes | Performance of a contract (Art. 6(1)(b)) |
| Responding to enquiries, support requests and bug reports | Legitimate interests (Art. 6(1)(f)): the effective operation and improvement of the Service |
| Complying with legal and regulatory obligations and responding to lawful requests from public authorities | Legal obligation (Art. 6(1)(c)) |
| Establishing, exercising or defending legal claims | Legitimate interests (Art. 6(1)(f)) |
5.2 Where we rely on legitimate interests, we have concluded, following an assessment, that those interests are not overridden by your interests or fundamental rights and freedoms. Details of that assessment are available on request using the contact at 2.2.
5.3 Where the provision of personal data is necessary for the performance of a contract and you do not provide it, we may be unable to provide the Service, or part of it, to you.
5.4 We do not use personal data for advertising or for marketing profiling, and we do not disclose it to third parties for their own marketing purposes. We will not send you direct marketing without your prior consent, which you may withdraw at any time.
5.5 We will not process personal data for a purpose incompatible with those set out above without first informing you and, where required, obtaining your consent.
6. Management Companies
6.1 Where a Management Company uses the Service to administer its Estates, it may determine the purposes for which certain personal data of its residents and staff is processed. To that extent, the Management Company acts as a controller in its own right, or as joint controller with us, and is responsible for its own compliance with data protection law, including providing any notice required to its residents and staff.
6.2 Where we process personal data on behalf of a Management Company as its processor, we do so only on its documented instructions and under terms satisfying Article 28 UK GDPR. Requests to exercise data protection rights in respect of such data may be referred to the relevant Management Company.
6.3 A Management Company may keep staff records on the Service, including for people who do not yet have an account, and is the controller of those records. Its admins can see every staff record and rota in that company; a member of staff sees only their own record and rota; residents and other Management Companies see none of them. Staff records are deactivated rather than deleted, so that past rotas remain accurate; a request to erase one may be made to the Management Company or to us.
7. Recipients and disclosure
7.1 We disclose personal data only as set out in this section.
7.2 Service providers. We engage carefully selected processors, who act only on our documented instructions and under written contracts satisfying Article 28 UK GDPR. They fall into the following categories: (a) providers of hosting, storage and account services; (b) providers of website hosting and email delivery, including the server at ourground.co.uk that sends account emails and plans staff rotas; (c) providers of map imagery, to whom the area of the map being viewed is disclosed, but not the content of reports; and (d) providers of postcode lookup, to whom only the postcode entered is disclosed.
7.3 Our processors are: Google LLC / Google Cloud (Firebase Authentication, Cloud Firestore, Cloud Storage and related services); MapTiler AG (map imagery); postcodes.io (postcode lookup); and the hosting provider for ourground.co.uk (website, account emails and the staff planner).
7.4 Other Users. Personal data is visible to other Users only as described in section 3. Data relating to one Estate is not accessible to Users of any other Estate.
7.5 Services you choose to use. Where you elect to open a location in an external mapping application, the relevant coordinates are passed to that application and its provider’s privacy notice applies.
7.6 Legal and corporate disclosures. We may disclose personal data: (a) where required by law, court order or a competent public authority; (b) to the police or other law enforcement bodies where we are satisfied that disclosure is necessary and proportionate for the prevention or detection of crime; (c) where necessary to establish, exercise or defend legal claims; and (d) to a prospective or actual successor in the event of a merger, acquisition, reorganisation or transfer of all or part of the Service, subject to equivalent protections.
8. International transfers
8.1 Certain of our processors may store or access personal data outside the United Kingdom, including within the European Economic Area and the United States of America.
8.2 Any such transfer is made subject to an appropriate safeguard under Chapter V UK GDPR, being: (a) adequacy regulations made under section 17A of the Data Protection Act 2018, including the UK Extension to the EU–US Data Privacy Framework where applicable; or (b) the International Data Transfer Agreement, or the International Data Transfer Addendum to the European Commission’s standard contractual clauses, issued by the Information Commissioner under section 119A of that Act, together with such supplementary measures as are required.
8.3 Further information on these safeguards is available on request using the contact at 2.2.
9. Retention
9.1 We retain personal data for no longer than is necessary for the purposes for which it is processed, including the satisfaction of legal, accounting and reporting requirements. Unless a longer period is required by law or for the establishment, exercise or defence of a legal claim, the following periods apply:
| Data | Retention period |
|---|---|
| Account, profile, identity and contact data | For the life of your account, and deleted or irreversibly anonymised within 30 days of its closure, save as stated below. |
| User content and operational records, including the Audit Trail | For as long as the relevant Estate remains registered on the Service, and for six years thereafter, reflecting the limitation period for contractual claims under the Limitation Act 1980. |
| Staff records and rotas | For as long as the Management Company uses the Service, and erased on request as described in 6.3. |
| Subscription data | For the duration of the subscription and six years thereafter, to meet accounting and tax obligations. |
| Correspondence | Up to two years from the conclusion of the matter concerned. |
| Technical and security data | Only for the short period necessary to operate and protect the Service, save where retained for longer to investigate a specific security incident or suspected misuse. |
9.2 Because the Audit Trail must be complete to be reliable, submitted maintenance logs and site inspections cannot be deleted by Users. Where you close your account, your attribution within the Audit Trail may be retained for the period stated above, or replaced with a non-identifying label where doing so does not undermine the integrity of the record.
10. Security
10.1 We implement appropriate technical and organisational measures, in accordance with Article 32 UK GDPR, to ensure a level of security appropriate to the risk. These include the encryption of personal data in transit and at rest, access controls restricting each User to the information appropriate to their role, the separation of data between Estates, measures to protect accounts against unauthorised access, and the regular review of those measures.
10.2 In the interests of the security of the Service and its Users, we do not publish detailed descriptions of our security arrangements.
10.3 No transmission over the internet and no method of electronic storage is wholly secure. You are responsible for keeping your account credentials confidential, for using a password that you do not use elsewhere, and for notifying us without delay of any suspected unauthorised use of your account.
10.4 If you believe you have identified a security vulnerability in the Service, please report it to the contact at 2.2 and refrain from exploiting or disclosing it.
11. Personal data breaches
11.1 In the event of a personal data breach, we will take prompt steps to contain it and to assess and mitigate its effects. Where required by Article 33 UK GDPR, we will notify the Information Commissioner’s Office without undue delay and, where feasible, within 72 hours of becoming aware of it. Where a breach is likely to result in a high risk to your rights and freedoms, we will inform you without undue delay in accordance with Article 34 UK GDPR.
12. Your rights
12.1 Subject to the conditions and exemptions set out in the UK GDPR and the Data Protection Act 2018, you have the right to:
- be informed about the collection and use of your personal data, which this notice is intended to satisfy (Arts. 13–14);
- access the personal data we hold about you and receive a copy of it (Art. 15);
- have inaccurate personal data rectified, and incomplete personal data completed (Art. 16);
- have personal data erased (Art. 17);
- restrict the processing of personal data (Art. 18);
- receive personal data you have provided to us in a structured, commonly used and machine-readable format, and have it transmitted to another controller (data portability, Art. 20);
- object to processing based on legitimate interests, on grounds relating to your particular situation, and to object at any time to processing for direct marketing (Art. 21); and
- withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before its withdrawal (Art. 7(3)).
12.2 To exercise any of these rights, contact us using the details at 2.2. We may request information reasonably necessary to verify your identity before acting on a request. We will respond without undue delay and in any event within one month of receipt of the request (or, where applicable, of the information needed to verify your identity). That period may be extended by up to two further months where a request is complex or where you have made a number of requests, in which case we will inform you of the extension, and the reasons for it, within the first month.
12.3 No fee is ordinarily charged. Where a request is manifestly unfounded or excessive, in particular because of its repetitive character, we may charge a reasonable fee reflecting our administrative costs or refuse to act on it, in accordance with Article 12(5) UK GDPR, and will explain our reasons.
12.4 The right to erasure is not absolute. We may decline or limit erasure where retention is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims, including where the data forms part of the Audit Trail (see 9.2).
12.5 Requests to close your account and erase the associated personal data may be made using the contact at 2.2.
13. Automated decision-making
13.1 We do not make decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you, within the meaning of Article 22 UK GDPR.
13.2 When an admin of a Management Company asks for one, the Service produces a draft rota that assigns work to that company’s staff, using their staff records. The rota is a working plan that the Management Company reviews, changes and remains responsible for. It does not decide pay, discipline or employment.
14. Cookies and similar technologies
14.1 The Service stores information on your device that is strictly necessary to keep you signed in and to provide the functionality you request. Where you select “Remember me”, your email address is additionally stored on your device to pre-fill the sign-in form. Storage that is strictly necessary for a service you have requested is exempt from the consent requirement by virtue of regulation 6(4) PECR.
14.2 Neither the Website nor the Service uses analytics, advertising or tracking cookies. Should that change, we will update this notice and obtain your consent before placing any non-essential cookie on your device.
14.3 In common with most websites, the Website and the Service retrieve certain resources, such as fonts and map imagery, from third-party providers. Those providers necessarily receive your IP address and basic browser information in order to deliver the resource, and process it in accordance with their own privacy notices.
15. Children
15.1 The Service is intended for residents and staff of managed residential Estates and is not directed at children. You must be at least 14 years of age to create an account. We ask for your age at registration and do not create an account where the age given is under 14. We do not knowingly process the personal data of children under 14 and, should we become aware that we have done so, we will delete it.
16. Information you provide about others
16.1 Where you submit content that refers to or depicts another person, you must have a lawful basis for doing so, must limit that content to what is necessary to report an Estate matter, and must not submit it for the purpose of harassing or monitoring any person. We may remove content that does not meet this standard, in accordance with our Terms of use.
17. Changes to this notice
17.1 We may amend this notice from time to time, including to reflect changes to the Service, to our processors or to applicable law. The date of the latest revision appears at the top of this page. Where a change materially affects the processing of your personal data, we will give you reasonable notice through the Service or by email before it takes effect.
18. Complaints
18.1 If you have any concern about our handling of your personal data, please contact us in the first instance using the details at 2.2 so that we may seek to resolve it.
18.2 You also have the right to lodge a complaint with the supervisory authority in the United Kingdom, the Information Commissioner’s Office: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; telephone 0303 123 1113; ico.org.uk/make-a-complaint.