Privacy Policy

This service is operated by the organisation that provides access to the mediation financial disclosure platform. For this default policy, the controller details, registered address, company number, and contact email should be replaced with the relevant organisation details.

We may collect and use:

• identity and contact details, such as name and email address;
• case details, including case identifiers and party details;
• financial disclosure information entered into forms;
• authentication and security information, including login events and one-time passcode records;
• technical information, such as IP address, browser type, device information, and security logs.

We use personal information to:

• provide secure access to mediation disclosure forms;
• save, manage, finalise, and display disclosure submissions;
• allow authorised mediation staff to administer cases and submissions;
• maintain security, audit logs, fraud prevention, and service integrity;
• comply with legal, regulatory, accounting, and dispute-resolution obligations.

Depending on the context, we may rely on contract, legal obligation, legitimate interests, consent, or another lawful basis under UK data protection law. Where special category information is processed, an additional condition must also apply. The relevant lawful basis should be documented by the organisation using this service.

We may share information with:

• authorised mediation staff and tenant administrators;
• authorised parties in a case, only where sharing has been enabled and permitted;
• technology suppliers who host, support, secure, or deliver the service;
• professional advisers, courts, regulators, or authorities where required or permitted by law.

Records are kept only for as long as needed for the purposes described in this policy, including mediation administration, legal obligations, dispute handling, security, and audit requirements. The retention period may vary by tenant and case type.

Under UK data protection law, you may have rights to access, correct, erase, restrict, transfer, or object to the use of your personal information. These rights are not always absolute and may depend on the lawful basis and context of processing.

We use technical and organisational measures designed to protect personal information, including access controls, tenant isolation, encrypted sessions, audit logging, and secure authentication controls.

If personal information is transferred outside the UK, appropriate safeguards should be used where required by UK data protection law.

You can contact the organisation operating this service about privacy concerns. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk.