Krowd Privacy Policy

This Policy applies to personal data processed through Krowd websites, including krowd.org.uk, and our products such as House Krowd, Signals, Krowd Source, and Insights.

It should be read alongside our Terms of Service, which explain service usage, commercial terms, and product-specific obligations.

Krowd Group Limited is the controller for personal data where we determine why and how that data is processed, including website, account, security, service-operation, product-governance, audit and customer-relationship activities.

Our role can differ by workflow and category of personal data. Where a customer uses our platform to process resident, tenant, participant, workforce or other personal data under that customer's instructions, Krowd will generally act as processor for that processing and the customer will remain controller.

In some workflows Krowd and a customer or service provider may each act as independent controllers for the processing they separately determine. If a workflow requires a joint-controller arrangement, that arrangement will be documented separately rather than assumed merely because the parties use the same platform or exchange data.

Some Krowd products, including Signals, are designed to preserve a machine-readable record of how data, opportunities and transactions move through a workflow. These records may include source, timing, configuration, selection, declarations, consent or other authority, provider choice, transmission, delivery and disclosure events.

We use provenance and audit records to operate and secure the Services, evidence how a workflow arose, investigate incidents, resolve disputes, support customer and regulatory audits, prevent misuse and meet legal or regulatory obligations. Where we act as a processor, we process those records in accordance with the customer's documented instructions except where law requires otherwise or where limited processing is necessary for our own security, integrity or legal obligations.

Depending on context, we rely on contract, legitimate interests, legal obligation, and where required, consent. Our legitimate interests can include operating and improving the Services, maintaining security and integrity, preserving audit and provenance records, preventing misuse, supporting compliance and resolving disputes, provided those interests are not overridden by the rights and freedoms of the individual.

Where a customer is controller, that customer is responsible for identifying the lawful basis and any additional consent, notice, authority or other condition required for the purpose it configures. The availability of a Krowd feature, filter, export or integration does not itself create a lawful basis for processing or disclosure.

We share personal data only where there is an appropriate basis to do so. This can include infrastructure providers, analytics services, support tooling, professional advisers and recipients that a customer or user has validly configured or selected as part of a workflow.

Where a customer determines the recipient, purpose or scope of an export or disclosure, the customer is responsible for ensuring that disclosure is lawful and consistent with applicable notices, permissions, consent, authority and provider-choice requirements. Krowd may apply technical or governance controls before allowing a destination, field set or workflow to operate.

A failed or rejected technical delivery does not, by itself, create authority to disclose personal data to a different recipient. Any retry or rerouting must remain within the permissions and other conditions applicable to that workflow.

We require service providers acting on our behalf to implement appropriate technical and organisational safeguards, confidentiality commitments, and data protection obligations.

Subject to applicable law, you may have rights to access, correct, erase, restrict, or object to processing of personal data, and to request portability.

If we process data solely on behalf of a customer, please contact that customer first so they can handle your request as controller. If Krowd is controller for the relevant processing, you may contact us directly using the details below.