Privacy notice: how we use your data

GOV.UK Digital Service Platform is provided by Government Digital Service (GDS), which is part of the Cabinet Office. The data controller for GDS is the Cabinet Office. A data controller determines how and why personal data can be processed.

Read the Cabinet Office’s entry in the Data Protection Public Register for more information.

What data we collect from you

  • your Internet Protocol (IP) address and details of which version of web browser you used
  • information on how you use the site using cookies and page tagging techniques

Where you provide your consent, we use Google Analytics cookies and a Real User Monitoring (RUM) cookie from SpeedCurve to collect information about how you use GOV.UK Digital Service Platform. This includes IP addresses.

Google Analytics processes information about:

  • the pages you visit on GOV.UK Digital Service Platform
  • how long you spend on each page
  • how you got to the site
  • what you click on while you’re visiting the site

We also receive the same information from other government digital services and GOV.UK.

We make sure you cannot be directly identified by Google Analytics data. We do this by using Google Analytics’ IP address anonymisation feature and by removing any other personal data from the titles or URLs of the pages you visit. We will not combine analytics information with other data sets in a way that would directly identify who you are.

SpeedCurve RUM software processes anonymised information about:

  • how well the pages performed on your device (for example how quickly they loaded)
  • performance problems your device experienced
  • JavaScript errors your device encountered

Find out more about how we use Google Analytics and other cookies on GOV.UK.

If you register your interest in using GOV.UK Digital Service Platform we’ll collect your:

  • email address
  • full name
  • organisation
  • job role

We use the Mailchimp platform to send email updates about GOV.UK Digital Service Platform to you. This involves us sharing your email address with the platform provider, Intuit, as a data processor.

Intuit also collects some personal data via the Mailchimp platform as a data controller in their own right. For example, technical information about your device. For more information, you can read Mailchimp’s cookie statement and the Intuit privacy statement.

Our legal basis for processing your data

Your consent is the legal basis for processing data collected with Google Analytics and SpeedCurve RUM on GOV.UK Digital Service Platform and other government digital services.

Why we need your data

We use the information we collect through Google Analytics and SpeedCurve RUM to see how you use GOV.UK Digital Service Platform and to see how well the site performs on your device.

We do this to help:

  • make sure GOV.UK Digital Service Platform is meeting the needs of its users
  • make improvements, for example improving site search
  • make performance improvements, for example improving page load time and data usage

We combine Google Analytics information with similar data from other government digital services to help understand and improve user journeys within GOV.UK Digital Service Platform and other government digital services.

What we do with your data

The data we collect with Google Analytics cookies is transferred and stored with Google where we analyse it with Google Analytics software (Google Analytics 4). We do not allow Google to use or share this data for their own purposes.

We will not:

  • sell or rent your data to third parties
  • share your data with third parties for marketing purposes

How long we keep your data

We will only retain your personal data for as long as it is needed for the purposes set out in this document or for as long as the law requires us to. We will:delete access log data which contain your IP address after 120 days.

Children’s privacy protection

Our services are not designed for, or intentionally targeted at, children 13 years of age or younger. We do not intentionally collect or maintain data about anyone under the age of 13.

Where your data is processed and stored

We design, build and run our systems to make sure that your data is as safe as possible at any stage, both while it’s processed and when it’s stored.

All personal data is stored in the European Economic Area (EEA). Data collected by Google Analytics may be transferred outside the EEA for processing.

How we protect your data and keep it secure

We are committed to doing all that we can to keep your data secure. We set up systems and processes to prevent unauthorised access to or disclosure of the data we collect about you – for example, we protect your data using varying levels of encryption. All third parties that process personal data for GDS are required to keep that data secure.

Your rights

You have the right to request:

  • information about how your personal data is processed
  • a copy of that personal data
  • that anything inaccurate in your personal data is corrected immediately

You can also:

  • raise an objection about how your personal data is processed
  • request that your personal data is erased if there is no longer a justification for it
  • ask that the processing of your personal data is restricted in certain circumstances

If you have any of these requests, get in contact with our Data Protection Officer. The contact details are at the bottom of the page.

Questions and complaints

Contact gds-privacy-office@digital.cabinet-office.gov.uk if you either:

  • have questions about anything in this document
  • think that your personal data has been misused or mishandled

You can also contact the Cabinet Office Data Protection Officer.

Data Protection Officer
DPO@cabinetoffice.gov.uk
Cabinet Office
70 Whitehall
London SW1A 2AS

If you have a complaint, you can also contact the Information Commissioner, who is an independent regulator set up to uphold information rights.

casework@ico.org.uk
0303 123 1113
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF

Changes to this policy

We may change this privacy notice. When we make changes to this notice, the ‘last updated’ date at the bottom of this page will also change. Any changes to this privacy notice will apply to you and your data immediately. If these changes affect how your personal data is processed, GDS will take reasonable steps to make sure you know.

Last updated: 12 April 2023