This page describes the implemented data boundaries and the transparency information still requiring owner approval before a wider live pilot.
VCFease may act as controller for platform identity, security, billing and service administration. An organisation normally controls its own volunteer, operational and case content, with VCFease acting under its documented instructions. The legal identity and public controller contact must be approved before wider live use.
Identity and account details; organisation membership and permissions; volunteer applications, optional accessibility requests and activity; organisation operational and reporting records; support-case records; technical security and audit data; billing contact and subscription state. Card data is not stored by VCFease.
Processing may be necessary to provide a requested service or perform a contract, meet legal obligations, pursue documented legitimate interests in secure service operation, or—only where appropriate—use explicit consent for a specific optional purpose such as accessibility information.
Authorised members of the relevant organisation, purpose-assigned Aspire caseworkers, contracted service providers and public authorities where required by law. The Observatory receives only reviewed, suppressed aggregates and never volunteer names, contact details or raw private pulse text.
Production processor locations and transfer safeguards will be listed in the approved processor schedule before rollout. The Microsoft production target uses UK/EU regional services where the selected service and contract support them.
Retention is defined by data class, purpose, trigger and legal requirement. VCFease’s retention engine begins with a dry run, checks legal holds and requires independent approval. No payment-state change silently deletes organisation records.
Depending on the circumstances, you may request access, correction, erasure, restriction, objection or portability, and withdraw optional consent at any time. Identity and third-party rights are verified before information is disclosed or removed.
Pilot governance notice: vcfease-platform-privacy-2026-08-20. A content hash is pinned when the owner-approved notice is published.
For independent guidance or a regulatory complaint, visit the Information Commissioner’s Office.