Privacy notice

Privacy notice — planning applicants (DRAFT, awaiting Dan's approval)

Status: DRAFT v1 (2026-08-05). Written by Claude for ticket D6.

Not published, not legal advice. Dan reviews, amends and approves

before any real letter is sent; consider a solicitor's read-through

before launch. On approval this text is published on the public

website and its URL printed on every letter.

Who we are

Kestrel (operated by [LEGAL ENTITY NAME — Dan to confirm], "we") is a

service that helps building-trade businesses contact people who have

submitted planning applications. Contact: [privacy@DOMAIN — Dan to

confirm] or [POSTAL ADDRESS].

What data we hold about you and where it came from

If you (or an agent acting for you) submitted a planning application to

a local planning authority, that authority publishes the application on

its public planning register, as required by law. From that public

register we collect: the site address, the application reference,

a description of the proposal, decision dates and outcomes, and — where

the authority publishes it — the applicant's name.

We do not collect data about you from any other source, and we do not

hold financial data, contact numbers or email addresses about

applicants.

What we do with it

We make this public planning information searchable for our subscribers

(builders, architects, surveyors and similar trades), and we post

letters on their behalf to the applicant's site address offering

services relevant to the application — for example, a builder writing

about an approved extension.

Our legal basis

Our legal basis under UK GDPR Article 6(1)(f) is **legitimate

interests**: ours and our subscribers' interest in offering relevant

trade services to people with live building projects, using only

information already published in a public register, by post only (no

email, no phone), with a clear route to stop further contact. We have

carried out and documented a legitimate interests assessment

[LIA — to be completed at launch; Dan holds it].

How to stop letters (right to object)

Under UK GDPR **Article 21 you have an absolute right to object to

direct marketing**. Tell us once and letters stop for good — from every

business that uses Kestrel, not just the one that wrote to you:

• write to [privacy@DOMAIN], or
• post to [POSTAL ADDRESS], or
• use the reference printed on the letter you received.

We add you to our suppression list within 10 working days (usually

much faster) and no further letters will be sent to you through

Kestrel. The suppression list stores the minimum needed to honour your

objection (address/postcode and, if you give it, your name) and nothing

else.

How long we keep data

See our retention policy: applicant personal data is deleted on the

timetable published there; the suppression list is kept for as long as

we operate, because deleting it would restart the letters you asked us

to stop.

Your other rights

You can ask for a copy of the data we hold about you (access), ask us

to correct it, ask us to erase it, and complain to the Information

Commissioner's Office (ico.org.uk). Requests to [privacy@DOMAIN]; we

respond within one month.

Sharing and processors

Letters are printed and posted by our print partner ([Stannp Ltd — Dan

to confirm at D3]) acting as our processor. Subscribers can download

applicant details for their own records; when they do, they become a

controller of that copy and must honour objections independently — our

terms oblige them to. We do not sell data or send it outside the UK.