01Who we are
Westminster Monitor is a product of Pryme Studio Ltd, a company registered in England and Wales (company number 15812340), with its registered office in London. For the purposes of UK GDPR and the Data Protection Act 2018, Pryme Studio Ltd is the data controller for personal data collected through this website and the Westminster Monitor application.
This policy explains what personal data we collect, how we use it, and the rights you have over it. We have tried to write it in plain English; if any of it is unclear, email privacy@westminstermonitor.com and we will explain.
02What we collect
We collect three categories of personal data:
- Account data — name, work email address, organisation, job title, and the password hash for your account. Provided by you when you sign up or are added to a workspace.
- Configuration data — the watchlists, keywords, politicians of interest, and delivery preferences you configure inside the product. This data is associated with your account.
- Usage data — server logs (IP address, browser, pages viewed, timestamps), analytics events, and product telemetry sufficient to debug issues, prevent abuse, and measure aggregate usage.
Westminster Monitor processes the public UK parliamentary record. We do not ingest your client documents, internal correspondence, or any non-public material you produce.
03Why we collect it
We process personal data on the following lawful bases under UK GDPR:
- Performance of contract — to provide the Westminster Monitor service to you and your organisation, including authenticating accounts, delivering briefings, and supporting your use of the product.
- Legitimate interests — to operate, secure, and improve the service; to investigate suspected misuse; and to communicate operational notices to you. We balance our interests against your rights and only rely on this basis where the impact on you is proportionate.
- Consent — for non-essential cookies, optional marketing communications, and any optional analytics. You can withdraw consent at any time.
04Sharing & processors
We do not sell personal data, and we do not share your account or configuration data with third parties for their own purposes. We use the following sub-processors to run the service:
- UK-based cloud infrastructure for application hosting, database, and primary storage. All customer data is stored in UK data centres.
- Transactional email for delivering daily briefings and operational notifications. Messages are encrypted in transit.
- Error monitoring for diagnosing platform issues. PII is redacted before transmission.
A current sub-processor list, including subprocessor identities and locations, is available on request from privacy@westminstermonitor.com. We do not transfer personal data outside the United Kingdom for routine processing.
05Retention
Account data is retained for the lifetime of your account plus 90 days, after which it is deleted from production systems. Backups are retained for an additional 35 days on a rolling cycle. Configuration data is retained on the same schedule.
Server logs are retained for 90 days. Aggregated, non-identifying usage statistics may be retained indefinitely for product analytics.
06Your rights
Under UK GDPR you have the right to access your personal data, correct it, delete it (subject to limited exceptions), restrict or object to processing, and to data portability. You also have the right to lodge a complaint with the Information Commissioner's Office.
To exercise any of these rights, email privacy@westminstermonitor.com. We respond to all rights requests within one calendar month.
07Security
We take security seriously. Data is encrypted in transit (TLS 1.2+) and at rest. Access to production systems is restricted, MFA-enforced, and logged. We carry out regular security review and use industry-standard controls. Enterprise customers can request our information-security questionnaire and Data Processing Agreement.
08Contact
For any privacy question, email privacy@westminstermonitor.com. For postal enquiries, write to: Pryme Studio Ltd, Privacy Office, London, United Kingdom (full registered address provided on first reply for verification).