Portico
Now Recruiting Beta Testers

PRIVACY POLICY

Last Updated: 6 October 2026


1. Introduction

Welcome to Portico. We respect your privacy and are committed to protecting your personal data. This Privacy Policy informs you as to how we look after your personal data when you visit our website (porticogov.io) or use our casework management platform, and tells you about your privacy rights and how the law protects you.


CRITICAL DISTINCTION: This Privacy Policy applies only to the personal data of our customers (Councillors, their staff, and website visitors). It does not apply to the constituent data or casework emails you manage within the Portico platform. All constituent data is governed strictly by our Data Processing Agreement (DPA), under which you act as the Data Controller and Portico acts as the Data Processor.


2. Who We Are

Portico ("we", "us", or "our") is the Data Controller responsible for your personal data as a customer.

Our Contact Details:

  • Email address: dpo@porticogov.io

  • Postal address: Container 46, St Saviour’s Yard, St Saviour’s Lane, Norwich, NR3 1GQ

  • ICO Registration Number: TBC


3. The Data We Collect About You

We may collect, use, store, and transfer different kinds of personal data about you, which we have grouped together as follows:

  • Identity Data: First name, last name, job title, and local authority or parliamentary affiliation.

  • Contact Data: Official council email address (e.g., .gov.uk or .parliament.uk) and alternative contact email addresses.

  • Financial Data: Payment card details and billing addresses. Note: Portico does not store your full card number; this is processed securely by our payment partner, Stripe.

  • Transaction Data: Details about payments to and from you, including your £15/mo subscription invoices and VAT records.

  • Technical Data: Internet protocol (IP) address, your login data, browser type and version, time zone setting, and operating system used to access our platform.

  • Usage Data: Telemetry data on how you use our website and platform (e.g., which features you use most) to help us improve the software.


4. How We Use Your Personal Data and Our Legal Basis

Under the UK GDPR, we will only use your personal data when the law allows us to. We rely on the following legal bases to process your data:

  1. Performance of a Contract: To register you as a new user, process your £15/mo (+VAT) subscription, and deliver the Portico software to you.

  2. Legitimate Interests: To analyse usage telemetry to improve our application, ensure network security, and administer the Vested Referral Scheme.

  3. Legal Obligation: To retain transaction records for HMRC accounting and VAT compliance purposes.

  4. Consent: To send you direct marketing or beta waitlist updates (which you can opt out of at any time).


5. Disclosures of Your Personal Data

We do not sell your personal data. We may share your data with the following trusted third parties strictly to facilitate our services:

  • Stripe Payments UK Ltd: To process your monthly subscription payments and handle financial compliance.

  • Amazon Web Services (AWS UK): To host our infrastructure securely in the UK (eu-west-2).

  • HubSpot: To manage our customer relationships, waitlist communications, and user support ticketing.

  • Accounting Software (e.g., Xero): To manage our business finances and VAT returns.

  • HM Revenue & Customs (HMRC), regulators, and other authorities: If required by law.


6. Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. This includes TLS encryption in transit, AES-256 encryption at rest, and strict access controls.


7. Data Retention

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for.

  • Active Subscriptions: We hold your account data for the duration of your active subscription.

  • Financial Records: By law, we are required to keep basic information about our customers (including Contact, Identity, Financial, and Transaction Data) for six years for tax and VAT purposes.

  • Account Deletion: If you cancel your account, your profile and login data will be safely deleted within 30 days, leaving only the anonymised or legally mandated financial records.


8. Your Legal Rights

Under the UK GDPR, you have the right to:

  • Request access to your personal data (a "Subject Access Request").

  • Request correction of incomplete or inaccurate data we hold about you.

  • Request erasure of your personal data when there is no good reason for us continuing to process it.

  • Object to processing where we are relying on a legitimate interest.

  • Request restriction of processing of your personal data.

  • Request the transfer of your personal data to another party.

  • Withdraw consent at any time where we are relying on consent to process your personal data.

If you wish to exercise any of the rights set out above, please contact us at dpo@porticogov.io.


9. Complaints

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.