Privacy policy
This policy explains how GovConnex collects, uses and protects personal data in the United Kingdom, and the rights you have under UK data protection law.
Who we are
In the United Kingdom, GovConnex is GCX Technologies Ltd, a company registered in England and Wales (company number 15168952), part of GovConnex Pty Ltd (ABN 33 629 740 932) in Australia. In this policy, “GovConnex”, “we”, “us” and “our” mean both.
GCX Technologies Ltd and GovConnex Pty Ltd are the controllers of the personal data described here: we decide why and how it’s used. This policy follows the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
You can reach us about your personal data at privacy (at) govconnex.com, or by post at GCX Technologies Ltd, 33 Queen Street, London EC4R 1AP.
If you’re in Australia or New Zealand, the privacy policy on our Australian site applies instead.
Whose data this covers
This policy covers people who visit our website, get in touch, ask for a demo, download a report, come to our events or sign up for updates; people who use GovConnex through their organisation; people in public life whose public record appears in GovConnex; people who apply to work with us; and our suppliers’ contacts.
When your organisation uses GovConnex, the contacts, notes, meetings and files your team adds to its workspace belong to your organisation. We handle them on its behalf, as its processor, under its agreement with us, and your organisation decides how they’re used. Questions about that data are best taken to your organisation first.
What we collect
When you get in touch. Your name, work email, phone number, organisation, role and country, and what you tell us: the topics you’d like a demo to cover and the time you book, a note you send, the report you ask for or the event you register for.
When you use GovConnex. Your name, work email, organisation and role, your settings, and how you use the platform, such as when you sign in and which features you use. If your organisation uses single sign-on, we receive your name and email address from its identity provider.
When you visit our website. Your IP address and the general location it suggests, your browser and device, the pages you visit and the site you came from. Analytics and marketing cookies only run if you agree, as our Cookie policy explains.
From our emails. Whether you opened an email from us and which links you followed.
When you apply for a role. Your CV, work history and anything else you choose to send us.
For billing. The names and contact details of the people who look after a customer’s account and invoices, and payment records.
Most of this comes from you. Some comes from your organisation (when it sets up your account), from people at your organisation who introduce us, from event partners when you register through them, and from public sources such as your organisation’s website or LinkedIn.
You don’t have to give us personal data, but we need your name and work email to answer an enquiry, arrange a demo or send a report.
People in public life
GovConnex helps organisations follow parliament and government. To do that, it brings together the public record of people in public roles: members of the UK Parliament and of the devolved parliaments and assemblies, ministers, candidates, and others named in official records and public statements.
This can include their name, role, party, constituency and public contact details, and what they have said and done publicly: in parliament and its committees, in published statements and media releases, and in posts on their public social media accounts.
It comes from public sources: Hansard and the other official records of parliament, parliamentary and government websites, published statements and media releases, and public social media accounts.
We use it because we and our customers have a legitimate interest in following the work of parliament and government, and in understanding and engaging with the people who do it. What someone says in public life can reveal their political opinions, which UK law treats as special category data. We use only what they have made public themselves, in their public role (UK GDPR Article 9(2)(e)).
If you’re in public life and your information appears in GovConnex, you have the rights set out below, including to ask us to correct it and to object to our use of it. Email privacy (at) govconnex.com.
How we use it, and our lawful basis
UK law asks us to have a lawful basis for each way we use personal data. The table sets out what we do, and the basis we rely on.
Where we rely on legitimate interests, you can object at any time (see Your rights). Where we rely on your consent, you can withdraw it at any time: for cookies in Cookie settings at the foot of every page, and for emails with the unsubscribe link in each one.
| What we do | Our lawful basis |
|---|---|
| Answer your enquiry, arrange and run your demo, and send you a report you asked for | Legitimate interests: answering people who contact us, and showing them GovConnex |
| Provide GovConnex to your organisation: your account, sign-in, support and service emails | Contract, where we have an agreement with you; otherwise legitimate interests: providing the service your organisation has agreed with us |
| Email you updates, event invitations and news about GovConnex | Legitimate interests: telling people at organisations we work with, or who have asked us for something, about what we do. Every email lets you unsubscribe |
| Run events and webinars, and send recordings and slides afterwards | Legitimate interests: running the events you register for |
| Analytics: count visits and see which pages are read | Consent, through Cookie settings |
| Connect your visits to our site with an enquiry you send, so our team knows what you were reading | Consent, through Cookie settings |
| Measure our advertising, and show our ads to people who have visited our site | Consent, through Cookie settings |
| Count visits to our site without cookies, so we know how it’s used | Legitimate interests: running and improving our website |
| Show the public record of people in public life in GovConnex | Legitimate interests: following the work of parliament and government. For political opinions, that the person made them public (Article 9(2)(e)) |
| Keep GovConnex and our website secure, and prevent misuse and fraud | Legitimate interests: protecting our customers, our service and our business |
| Improve and develop GovConnex | Legitimate interests: making GovConnex better for the people who use it |
| Consider your application for a role | Steps you’ve asked us to take before entering a contract with you, and legitimate interests: hiring |
| Invoice customers, keep accounts and meet our tax and other legal obligations | Contract, and legal obligation |
| Deal with legal claims and requests from regulators, courts and law enforcement | Legal obligation, and legitimate interests: protecting our rights |
| Reorganise, sell or merge our business | Legitimate interests: running and developing our business |
Artificial intelligence
GovConnex’s AI features, such as Analyst, summaries and briefings, send requests to AI providers in the United States. They’re processed there transiently, with storage turned off at the provider. We never use customer data to train AI models, and an organisation can switch each AI feature off.
We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects on you.
Where it’s held
Workspaces. We host GovConnex on Amazon Web Services. UK customers’ workspaces are held in London (eu-west-2) and aren’t copied to any other region.
Our website and CRM. What you send through our website, and our records of customers and enquiries, are held in HubSpot’s data centre in Australia. Our team works from the United Kingdom and Australia, and can see them from both.
AI. Requests to GovConnex’s AI features are processed transiently in the United States.
Analytics and advertising. Google and LinkedIn may process data in the United States and elsewhere.
When personal data goes to a country the UK hasn’t recognised as giving it adequate protection, we use the safeguards UK law provides: the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or, for a US company certified to it, the UK Extension to the EU–US Data Privacy Framework. You can ask us about these safeguards at privacy (at) govconnex.com.
How we protect it
GovConnex is ISO 27001 certified. Data is encrypted at rest with AES-256, with keys managed in AWS Key Management Service, and in transit with TLS 1.2 or later. We back it up at least daily and keep backups for 30 days. Access is limited to the people who need it, and our team is trained in security and privacy. There’s more on our Security page.
If a personal data breach is likely to put people’s rights and freedoms at risk, we tell the Information Commissioner’s Office within 72 hours of becoming aware of it, and if the risk is high, we tell the people affected without undue delay.
How long we keep it
We keep personal data only as long as we need it for the reasons we collected it, then delete or anonymise it.
- Workspaces. When a customer’s agreement ends, we keep its workspace for 30 days so it can be exported, then delete it. Deleted data leaves our backups as they expire, within 30 days.
- Enquiries and marketing. While we’re in touch with you. If you unsubscribe, we keep your email address on a suppression list so we don’t email you again.
- Accounts and billing. As long as tax and company law require.
- Job applications. While we consider your application, and for a short time afterwards in case of questions, unless you ask us to keep it for future roles.
- Cookies. As long as each cookie lasts, as listed in our Cookie policy.
We may keep something longer if we need it for a legal claim or a regulator.
Your rights
Under UK data protection law, you have the right to:
- ask for a copy of the personal data we hold about you
- have inaccurate or incomplete data corrected
- have your data deleted, in some circumstances
- restrict how we use it, in some circumstances
- object to our using it on the basis of legitimate interests, and to stop our using it for direct marketing at any time
- have data you gave us transferred to you or to another organisation, where we use it by consent or contract
- withdraw your consent at any time, where we rely on it
- not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you
To use any of these, email privacy (at) govconnex.com. We may ask you to confirm who you are. We’ll answer within one month, or tell you within that month if we need up to two months more because a request is complex. There’s usually no charge.
Complaints
If you’re unhappy with how we’ve handled your personal data, please tell us first at privacy (at) govconnex.com, and we’ll do our best to put it right.
You also have the right to complain to the Information Commissioner’s Office, the UK’s regulator for data protection: at ico.org.uk/make-a-complaint, on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
Children
GovConnex and our website are for organisations and the people who work in them. We don’t knowingly collect personal data from children.
Changes to this policy
We update this policy when what we do with personal data changes, and the date at the top shows when it last changed. If a change matters to our customers, we tell them.
For anything else, email contact (at) govconnex.com.