Privacy notice
Last updated: 16 July 2026.
This notice explains what personal information we use, why we use it, who we share it with, how long we keep it and what rights you have.
1. Who we are
Talvo is operated by Talvo Elections Ltd, a company registered in England and Wales (company number 17339608). Our registered office is First Floor, Swan Buildings, 20 Swan Street, Manchester M4 5JW. In this notice, 'Talvo', 'we' and 'us' mean Talvo Elections Ltd.
If you have a question, a request or a complaint, email support@talvo.vote.
2. Who is responsible for your information?
It depends on the information. If an organisation has added you to an election, as a voter, member or candidate, that organisation is the 'controller'. It decides what happens to voter rolls, candidate and nomination details, ballots and results. We act only as its 'processor': we follow its documented instructions under a data processing agreement, and we never use election information for our own purposes. Contact your organisation first about anything to do with its elections.
We are the controller for administrator accounts, billing, support conversations, security records and this website. The rest of this notice explains how we handle that information.
3. What information do we collect?
Your name, email address and sign-in details if you administer an organisation. Our sign-in provider, Clerk, holds passwords in hashed form, so we never see them. We also record which organisation you belong to and your role (admin or member).
A record of credit purchases, grants, spends and refunds, with Stripe transaction references. Your card details go straight to Stripe, and we never see or store full card numbers.
Your name, email address, organisation and message when you contact us, so we can reply.
A tamper-evident log of administrator actions, and email delivery events so organisations can see whether ballot emails arrived.
Aggregate statistics about this website from our hosting provider, Cloudfare: visitor counts, page views, traffic sources and device types, collected by a first-party script using a random anonymous identifier stored on your device. We see totals and trends, never a profile of you (see section 10).
We do not use advertising trackers, sell your information, buy information about you or build profiles of individuals.
4. What information do we handle for your organisation?
When an organisation runs an election, we process the following on its instructions.
Names and email addresses your organisation uploads as its voter roll, plus a per-election record holding a hashed single-use voting token and email delivery status. We record that you have voted, to prevent double voting, but never how you voted.
Candidate names, statements, photos and supporting documents, and the names and email addresses of nomination supporters (proposers, seconders and assenters).
Ballots, which are anonymous by design. They are stored separately, with no link to your identity, carry no IP address, and their timestamps are rounded to the hour. Vote receipts are anonymous codes that let you check your ballot was counted without revealing anyone's choices.
5. What about sensitive information?
A voter roll belonging to a political party or trade union can reveal political opinions or trade union membership. The law calls this 'special category data' and gives it extra protection under Article 9 of the UK GDPR.
Your organisation, as controller, must have its own Article 9 condition for this information. For membership bodies this is usually Article 9(2)(d), which covers not-for-profit bodies handling their own members' information, or your explicit consent. We handle it solely on your organisation's instructions and protect it with the measures in section 8. How you voted, is never linked to your identity.
6. How do we use your information, and what allows us to?
Where we are the controller, the UK GDPR requires a 'lawful basis' for each use:
| Purpose | Information used | Lawful basis |
|---|---|---|
| Providing your account and running the platform | Account, profile, organisation roles | Contract |
| Taking payment and maintaining the credits ledger | Billing | Contract; legal obligation |
| Answering support and contact-form messages | Support and contact | Contract; legitimate interests |
| Keeping the platform and elections secure, preventing abuse and maintaining tamper-evident audit trails | Security and audit records | Legitimate interests |
| Understanding how our website is used, in aggregate | Site analytics | Legitimate interests |
| Service emails about your account or elections you administer | Account | Contract |
| Complying with the law and cooperating with regulators | Any of the above | Legal obligation |
You need to give us your name, email address and billing details to use the platform. Without them we cannot create your account, take payment or run your elections. We do not send marketing emails. If that ever changes, we will ask for your consent first, and you will be able to withdraw it at any time.
8. How do we keep your information secure?
Our security is designed around ballot secrecy and election integrity:
- Every database table is protected by row-level security, scoped to organisation membership.
- Ballots sit in an isolated part of the database that only server-side functions can reach. App users cannot, and ballots can never be joined to voter identity.
- Voting tokens are single-use, 128-bit random values, stored only as SHA-256 hashes.
- Ballots carry no IP addresses or precise timestamps, and are read in random order so nobody can de-anonymise votes from their sequence.
- An election's configuration is frozen and hashed the moment voting opens, and counts are deterministic, so anyone can re-run them from a standard export.
- Audit logs are append-only and hash-chained, and any staff access to an organisation's console is itself logged.
- We use a strict Content Security Policy and encrypt everything in transit (TLS). Ballot contents never reach any analytics or logging pipeline.
9. How long do we keep your information?
| Information | How long we keep it |
|---|---|
| Voter roll snapshots (per election) | Set by the organisation: 90 days after the election closes by default, 365 days at most. When retention lapses, the name, email and token snapshots are irreversibly nulled and the organisation's owner is notified. |
| Ballots and results | Anonymous by design; kept as part of the election archive. They cannot be linked back to voters. |
| Account and profile information | While your account is active; deleted or anonymised without undue delay after closure, except where another row in this table requires longer. |
| Billing records | Six years plus the current financial year, as UK tax and accounting law requires. |
| Audit log | For the life of the organisation's account. The log is append-only, so tampering is detectable. |
| Support messages | As long as needed to resolve the matter, then reviewed and deleted. |
| Site analytics | Kept as aggregate statistics; our hosting provider keeps the underlying technical logs for up to 90 days. |
| Suppression list | A one-way hash of erased email addresses, kept indefinitely so an erased person cannot be silently re-imported. |
11. What are your rights?
You have the right to ask for a copy of the personal information we hold about you (access), to have inaccurate information corrected or incomplete information completed (rectification), to have your information deleted where there is no good reason for us to keep it (erasure), to limit how we use it in certain circumstances (restriction), to receive information you gave us in a machine-readable format (portability), and to object to any use based on legitimate interests, including site analytics (objection).
We do not make solely automated decisions about you, and we do not profile you. Wherever we rely on consent, you can withdraw it at any time.
Email support@talvo.vote. We may need to verify your identity, and we will respond within one month, free of charge. If your request is complex, we may take up to two more months, and we will tell you if so.
If your information is on an organisation's voter roll, that organisation is the controller, so contact it first. Its administrators can erase your record, export your information for you and add you to a suppression list so you are not re-imported. We help organisations meet these requests, and we pass on any request we receive directly.
12. How to complain
You have a legal right to complain to us about how we use your personal information. Email support@talvo.vote. We will acknowledge your complaint within 30 days and respond without undue delay.
You can also complain to the Information Commissioner's Office (ICO) at any time:
ico.org.uk/make-a-complaint
0303 123 1113
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
13. Children's information
Talvo accounts are for people aged 18 or over acting for an organisation. An organisation may lawfully include members under 18 on its voter roll, in which case the organisation is the controller for that decision, and every protection in this notice applies equally.
14. Changes to this notice
We will post any changes on this page and update the date at the top. If a change materially affects you, we will email account holders before it takes effect.