Shaping South Staffordshire Privacy Notice

Last updated: 03/06/2026

This notice sets out important information for those participating in different stages of Shaping South Staffordshire project about how we safeguard your personal information. 

1. What is this project?

Shaping South Staffordshire is a project (“the Project”) designed to give you even more of a voice in developing South Staffordshire’s new Local Plan. The Project is part of Waves (“The Waves Programme)”, a national programme developed by Demos, a British think tank, that helps local councils involve residents meaningfully in difficult policy decisions by using technology to allow more people to participate in the conversation.   

It gives residents the opportunity to share their views on the Council’s new Local Plan through a structured four-phase process: 

Phase 1 is open to all South Staffordshire residents aged 16 and over. It uses the Comhairle online platform. You share your views and respond to ideas from other residents. It takes around 15 minutes and can be done at any time during the participation window. 

Phase 2 involves in-depth deliberation sessions with a selected representative group of around 40 residents aged 18 and over. Participants are paid for their time. It uses Zoom and the ECHO platform. 

Phase 3 is a second at-scale engagement open to all South Staffordshire residents aged 16 and over, informed by the findings from Phase 2. 

Phase 4 is a second round of in-depth deliberation with the same representative group from Phase 2. 

This notice covers all four phases. Additional technology platforms may be introduced for later phases. Where this happens, this notice will be updated before those phases begin and you will be informed of any changes before you participate. An up-to-date version of this notice will always be available on the Project page. 

2. Who is responsible for your personal data?

Depending on which stage of the process you are participating in, we will ask different questions and different organisations will have access to your answers and any personal information you share. 

South Staffordshire District Council is the data controller for this project. This means the Council is responsible for deciding how and why your personal data is collected and used. 

Demos, an independent think tank and registered charity (Charity Registration No. 1042046), is the data processor. Demos delivers the Shaping South Staffordshire project on behalf of the Council and processes your personal data only on the Council’s instructions. 

CrownShy Ltd, the provider of the Comhairle platform, acts as a sub-processor. CrownShy processes your data on Demos’ behalf and under the same data protection obligations. 

Zoom Communications Inc, the provider of the video platform, acts as a sub-processor. Zoom processes your data on Demos’ behalf under the same data protection obligations.  

Dembrane, the provider of the ECHO platform, acts as a sub-processor. Dembrane processes your data on Demos’ behalf under the same data protection obligations.  

Demos also uses Stripe Payments Europe as a processor to make payments to you for any cash prizes you may win as part of the project. 

If you have questions about how your data is handled, contact South Staffordshire Council’s Data Protection Officer: Lorraine Fowkes, Corporate Director of Governance, [email protected].

3. What personal data is collected and why?

What data we collect depends on which phase you participate in and what you choose to share. 

Phase 1 and Phase 3 

If you participate without providing your name, email address, or other contact details, your contributions are not directly linked to your identity. However, if you choose to share information about yourself in your responses — for example personal details about your circumstances or situation — that information may constitute personal data even if you have not identified yourself. Please be aware of this when deciding what to share. If you are unsure whether information you have shared could identify you, you can contact us and we will advise. 

If you choose to provide personal information — for example, to be considered for Phase 2 or to enter a prize draw — we may collect the following: 

• Session data: an anonymous cookie-based session identifier, your voting patterns, and your responses to deliberation prompts. This is generated automatically when you participate. 

• Contribution data: the ideas, views, and responses you choose to share during the deliberation. This may include special category personal data if you choose to share it: for example information about your health or ethnicity. Further detail on special category data is set out below. 

• Contact data (optional): your name and email address, if you opt in to be considered for Phase 2 or to enter a prize draw. If you opt in for Phase 2, your contact details and demographic data may be shared with an independent third party organisation responsible for selecting the Phase 2 panel. This is to ensure the selection process is fair, random, and independent from the Council. 

• Demographic data (optional): your age group, gender, and location (parish area). Collected to understand the diversity of participation and ensure the Phase 2 panel is representative of South Staffordshire residents. 

• Ethnicity (optional, explicit consent required): collected to ensure diverse and representative participation. You can decline without affecting your ability to participate. 

Special category personal data 

Special category personal data includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data. The law requires us to ensure that such data is protected and processed only under certain conditions. 

We will collect and process special category personal data if you choose to provide it, for example if your contribution data refers to your health, disability, or ethnicity. We will also collect it if you respond to our optional ethnicity question (see above). We will always ask for your explicit consent before collecting special category data through a specific question. If you share special category data as part of your free text contributions, we will treat it accordingly. 

Third party personal data 

Please do not share personal information about other individuals in your responses. We cannot be sure whether they would want their information included. If you want to refer to someone else’s experience, please anonymise it — for example say ‘a family member’ rather than using their name. 

Phase 2 and Phase 4 (The Resident Panel) 

If you are selected to participate in Phases 2 or 4, additional data will be collected: 

• Recordings and transcripts: sessions are recorded and transcribed. Recordings are used to produce accurate analysis of the deliberation and to check the accuracy of the transcription. You will be asked for separate, explicit consent before the sessions are recorded, as part of your onboarding to the Resident Panel.
• Survey responses: you may be asked to complete a survey about your experience of the deliberation process, used for programme evaluation and learning.

4. How we use the information you share with us

We will only use your personal data where it is necessary for the following purposes: 

• To analyse consensus and patterns in resident views on the Local Plan to inform South Staffordshire Council’s decision-making.
• To select representative participants for the in-depth deliberation phases. 
• To administer cash incentives and prize draws to participants. 
• To assess the diversity of participation across the South Staffordshire population in each phase.
•  To evaluate the effectiveness of the Waves programme and digital democracy tools and processes for future implementation. 

These purposes will assist in achieving the following outputs of the Waves programme: 

• Policy findings informed by resident views for South Staffordshire Council’s use in developing the new Local Plan. 
• Best practice guidance and toolkits for implementing future digital deliberation processes in other local authorities. 
• Programme evaluation outputs that contribute to the evidence base for scaling digital deliberative democracy across UK local government. 

We will not use your personal data for any other purpose. This includes personal data that has been anonymised as part of the programme.

5. What is the lawful basis for processing your data?

South Staffordshire Council is responsible for identifying and maintaining the lawful basis for all processing under this programme.

All consent must be freely given, specific, informed, and indicated by a positive opt-in action. Pre-ticked boxes are not used. You can withdraw consent at any time without detriment. Withdrawal does not affect the lawfulness of any processing that took place before you withdrew. To withdraw, contact Demos at [email protected] or South Staffordshire Council at [email protected].  

6. How long is your data kept?

• Session and anonymous data: 1 year from date of submission 
• Contact data (Phase 2 opt-in): deleted at programme end (31 January 2027) or on withdrawal of consent, whichever is sooner 
• Demographic data: 1 year from date of submission 
• Ethnicity and special category data: 1 year from date of submission 
• Phase 2 consent record: deleted on re-contact or withdrawal of consent, whichever is sooner 
• Video recordings: 6 months from date of recording 
• Transcripts (Phases 2 and 4): Up to 2 years from date of recording 
• Survey responses: 1 year from date of submission 
• Anonymised and aggregated data: retained indefinitely, as it is no longer personal data 

7. Who else has access to your data?

Your data will only be shared with organisations directly involved in delivering the programme. It will not be sold or shared with any third party for any other purpose. 

• South Staffordshire Council: as data controller, the Council has access to deliberation data and findings for the purpose of informing the Local Plan. 
• Demos: as data processor, Demos accesses data to facilitate and analyse the deliberation and produce findings. 
• CrownShy (Comhairle platform): as sub-processor, CrownShy hosts the platform and stores participant data on AWS infrastructure within the UK. No data is transferred outside the UK.
• Zoom: as a sub-processor, Zoom hosts the video platform that allows participants to join the online deliberation sessions in Phases 2 and 4. All live session data processed by Zoom (video, polling data and chat) is processed in the EEA. Recordings are made locally rather than in the cloud and will be stored locally by the project team. Recordings will be deleted after 6 months. 
• Dembrane (ECHO platform): as sub-processor, Dembrane hosts the transcription and analysis platform and has access to what you say during the sessions. However, they only see this data in a totally anonymised form. They cannot link what you have said back to you.  
• Stripe, Prize draw payment provider: Any financial data that is collected for the purposes of making payments to you for cash prizes or incentives will be passed to our payment provider: Stripe Payments Europe. We do not store card details or banking information. Demos uses Stripe card services instead which comply with the payment card industry data security standard (PCI-DSS) published by the PCI Security Standards Council. Stripe will never share your banking information details. 

Additional technology platforms may be introduced for later phases of the programme. Where this happens, this notice will be updated before those phases begin.  

8. How is AI used in this programme?

AI is used to identify patterns, summarise ideas, and support analysis of discussions across all phases.  

In Phase 1, AI is used to identify patterns, summarise ideas, and support analysis of discussions. It is only used on anonymised or pseudonymised data and will not have access to any information that could personally identify you. 

In Phases 2 and 4, AI is used to transcribe your conversations and analyse those transcripts in real time. Although transcripts are anonymised before analysis, the transcription process itself occurs during live sessions where participants are known to facilitators. AI-generated summaries are shared with participants and facilitators during the session for review and discussion. This is done using the ECHO platform. 

For a full explanation of the tools used, how AI works in each phase, and the ethical commitments we have made, please see the Waves technology page: here.​     ​ 

In summary: AI is used to group and summarise ideas and identify consensus patterns across participants. AI is not used to make policy decisions. All AI outputs are reviewed by the Waves Programme team before informing any analysis or findings. Your contributions will not be used to train AI models. 

9. International transfers

Personal data collected through this programme is transferred outside the United Kingdom in two instances: 

1. Zoom is registered in the United States but all real-time processing will take place in EEA data centres.  
2. Dembrane is registered in the Netherlands. Data collected using the ECHO platform is transferred to the EEA, which is covered by the UK’s adequacy decision for the EEA. All data is processed within the EEA. 

CrownShy and Stripe process all data within the UK. 

10. Your rights

As a data subject under UK GDPR, you have the following rights: 

• Right of access: you can request a copy of the personal data we hold about you. 
• Right to erasure: you can ask us to delete your personal data. Note: truly anonymous data cannot be erased as it cannot be linked to you. 
• Right to rectification: you can ask us to correct any inaccurate data we hold about you. 
• Right to restriction: you can ask us to pause processing of your data in certain circumstances. 
• Right to withdraw consent: you can withdraw your consent at any time without detriment. This does not affect processing that has already taken place. 
• Right to object: you can object to processing in certain circumstances. 
• Right to data portability: you can request your data in a structured, machine-readable format. 
• Right not to be subject to automated decision-making: no automated decisions with legal or significant effects are made about you under this programme. 
• Right to complain: you have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or 0303 123 1113. 

To exercise any of these rights, contact South Staffordshire Council’s Data Protection Officer in the first instance: [email protected].  

We will respond to all legitimate requests within one calendar month. There is no fee for making a request, though we may charge a reasonable fee if a request is clearly unfounded or excessive. 

11. Contact information

South Staffordshire Council (Data Controller)
Council Offices, Wolverhampton Road, Codsall, WV8 1PX
DPO: Lorraine Fowkes — [email protected]  

Demos (Data Processor)
15 Whitehall, Westminster, London SW1A 2DD
Programme Manager: [email protected] | 020 3878 3955 

If you have a complaint that cannot be resolved, you have the right to contact the ICO directly at ico.org.uk or by calling 0303 123 1113.