Your data belongs to you, not us, and we treat it that way. We only go into your account to help you with a problem, fix a bug, or when the law requires it.
Plinth is run by Time to Spare Ltd (trading as Plinth), registered in England and Wales (company number 11530023). Our registered office is Space 4, 113-115 Fonthill Road, London, N4 3HH, and we're registered with the Information Commissioner's Office (ICO registration number ZA509591).
Who’s responsible for your data
We hold two kinds of data, and different rules apply to each.
The first is your account and our relationship with you: your name, email, billing details, support conversations and how you use our website. This applies whether you use Plinth for an organization or as an individual, for example if you've created an account to make bookings. For this data Plinth is the controller. We decide how it's used, and this policy explains how.
The second is the data you put into Plinth, such as your grants, cases, service users, bookings and donations. For this data your organization is the controller and Plinth is your processor. We only process it to provide the service, give you support, follow your reasonable instructions, or where the law compels us to. Your customer agreement, or the data processing terms in our Terms of Service, has the details.
This data can include special category data, such as health information, ethnicity and safeguarding notes, and data about children. We protect it with the same security controls as everything else, and the organization using Plinth is responsible for having the right lawful basis to collect it.
If you deal with an organization through Plinth, for example to book onto an activity, apply for a grant, register as a volunteer or fill in a form, that organization is responsible for the information you give it, so please contact them first. The same applies if you're one of its service users, grantees or beneficiaries. If you contact us instead, we'll pass your request on and help them respond.
What we collect and why
When you sign up, we ask for your name and email address and, if you're signing up for an organization, its name. We use these to set up your account and to send you invoices, updates and other essential information. We will never sell your personal information, and we won't use your name or your organization's name in marketing without your permission.
When you pay for Plinth, we may ask for card details, a billing address or bank details so we can charge you, work out any tax due and send invoices. Card details go straight to our payment processor and never pass through our servers. We keep your billing address to help spot fraudulent transactions and to print on your invoices. If you pay an organization through Plinth, for example for a booking, the payment goes to that organization, and your card details are handled by our payment processor in the same way.
If you write to us with a question or for help, we keep the correspondence and your email address for up to 3 years so we can refer back to it. When you browse our marketing pages, we track visits for statistics such as conversion rates and design tests (our Cookies Policy has more on this). We keep anything you volunteer, like survey answers, for as long as it's useful, and marketing contact records for up to 5 years after we last heard from you.
When you use the Plinth platform, we collect technical and usage data such as your IP address, device and browser type, the pages and features you use, and error logs. We use it to run, secure and improve the service. If you use our support chat, or we send you texts or emails through the platform, we keep a record of those messages.
Our legal basis for using it
The law only lets us use personal information when we have a lawful reason. We rely on four:
- We need it to deliver our contract with you, which covers setting up your account, providing the service, billing and support.
- We have a legitimate interest in keeping Plinth secure, preventing fraud, improving the product and telling you about things relevant to your organization. You can opt out of those messages at any time. If you're an individual rather than an organization, we only send you marketing emails if you've agreed to them, or if you're an existing contact and they're about similar services.
- The law requires it, for example keeping financial records for as long as tax law says.
- You've given consent, for example to non-essential cookies. You can withdraw consent whenever you like.
AI features
Some Plinth features use AI to help with due diligence, assessments, reporting and case notes. When you use them, the relevant data is sent securely to our AI providers, which process it only to return a result to you. None of them use your data to train their models. The AI helps your team make decisions; it never makes decisions about people on its own.
Your rights
The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 give you rights over your personal information. We respect those rights, and the EU GDPR where it applies, except where the law limits them. You have the right to:
- access the personal information we hold about you, and find out how it's shared, stored, secured and processed
- have inaccurate information corrected
- ask us to erase your information (sometimes called the "right to be forgotten"), subject to some legal limits. If we delete it, you may not be able to keep using Plinth and we may close your account
- ask us to restrict how and why we use your information
- object to how or why we process your information in certain situations, and object to direct marketing at any time
- receive a copy of your information and have it sent to another organization (data portability)
- not be subject to decisions made solely by automated processes that have a legal or similarly significant effect on you. This right is limited where the decision is necessary for a contract between us, is allowed by law, or is based on your explicit consent
- complain to the Information Commissioner's Office (ico.org.uk), though we'd appreciate the chance to put things right first
You can handle many of these yourself by signing in and updating your account. Plinth also gives your organization tools to handle these requests for its own contacts, and we'll help customers respond to requests about data they hold in Plinth. We respond to all requests within one month.
Our Data Protection Officer is our Chief of Staff. For help with any of these rights, email privacy@plinth.org.uk.
Processors we use
We use third-party processors, only as far as we need to, to handle some or all of your personal information. They cover things like hosting, search, AI features, payments and support chat. We review each processor's security before we use them, and each one signs a written agreement with data protection terms at least as strong as ours. We remain fully responsible for what they do with your data. The current list, including what each one does, is on our Trust Centre at trust.plinth.org.uk/subprocessors.
Law enforcement
We won't hand your data to the police, regulators or other authorities unless the law, a regulator or a court requires it. Unless we're legally prevented from doing so, we'll tell you about any such request and give you as much notice as we can.
Security and encryption
Data traveling between your browser and our servers is encrypted with TLS, and everything is encrypted at rest in our databases and backups. Only staff who need customer data can access it. They have to use multi-factor authentication, and we log that access.
We run an information security management system aligned to ISO/IEC 27001. In practice that means regular risk assessments, daily vulnerability scans, an annual penetration test and security training for everyone on the team. Our Trust Centre at trust.plinth.org.uk has our certifications, security policies and controls.
If we become aware of a breach affecting your personal data, we'll tell you without undue delay and, where required, notify the ICO within 72 hours.
Backups
We back up customer data every day. Backups are encrypted, stored in our cloud hosting environment and kept for 30 days, and we test restoring from them at least once a year. If data is lost or damaged, we restore it from the latest backup.
Deleted data
If you delete something while your account is active, we keep it for up to a year in case you deleted it by mistake. After that it's gone for good. If you need something permanently deleted straight away, for example to meet an erasure request, ask us and we'll remove it from our live systems. It then drops out of our backups when they expire.
When you cancel, you have 30 days to export your data as CSV from within Plinth. We then permanently delete all of it from our systems within 90 days of your contract ending, unless the law requires us to keep it. You can ask us to return or delete it sooner. If an account goes unused, we keep its data for up to 3 years so it can be recovered, then delete it.
The law makes us keep some records for longer. Invoices and financial records, for example, are kept for 7 years.
Where your data is stored
This site is run from the UK. Our main databases are hosted in London and Frankfurt.
Some of our processors, such as those we use for error monitoring, messaging and some AI features, may process data outside the UK and EEA. When that happens we only transfer data with proper safeguards in place, such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses, so your rights stay enforceable.
US visitors
Plinth also operates in the United States as Plinth US. Plinth Data (data.useplinth.com) has its own Privacy Notice and Terms of Use, published on that site, and this policy doesn't cover it. If you're in the US and use the Plinth platform, we handle your personal information in line with this policy and applicable US state privacy laws, including California's. We don't sell personal information. Our site doesn't currently respond to "Do Not Track" browser signals, but you can control cookies through our cookie banner.
For our customers
If your organization uses Plinth, your customer agreement, or the data processing terms in our Terms of Service, sets out everything we commit to as your processor. That includes processing only on your instructions, helping with data subject requests and impact assessments, notifying you of breaches, returning or deleting data when the contract ends, and your right to audit our data processing. This policy, together with our Trust Centre, is the Privacy and Security Policy and Back-Up Policy referred to in our customer agreement. If this policy and your agreement ever disagree, your agreement takes priority.
Changes and questions
We update this policy once in a blue moon. When we make significant changes, we'll email account owners and individuals with a Plinth account, or put a clear notice on our site. You can ask our support team to access, change or delete your personal information at any time.
If you have questions about this policy, email privacy@plinth.org.uk. To report a security concern, email security@plinth.org.uk.