Platform Privacy Notice

About this document

Citizen Centric Platform Privacy Notice

How Politis Ltd handles personal information when operating Citizen Centric.

Publication details

Operator — Politis Ltd (company number 13661766)

Version — 1.1

Effective date — 18 August 2026

Important information

This is the platform-level privacy notice. Each research study must also provide study-specific privacy information identifying its controller, purposes, lawful bases, data uses and retention arrangements.

About this notice

Citizen Centric is a research participation and study-management platform operated by Politis Ltd. It includes the participant mobile application, public websites and APIs, and researcher and organisation administration services.

This notice explains the processing for which Politis Ltd is responsible. It should be read with the Participant Information Sheet and privacy notice supplied by the organisation responsible for the relevant study.

When Politis Ltd is controller

Politis Ltd acts as controller when it decides why and how personal information is used to operate, secure, administer and support Citizen Centric, including customer and researcher account administration, platform security, service support and operational diagnostics.

When Politis Ltd is processor

For information collected and used for a particular research study (Study Data), the research organisation normally acts as controller and Politis Ltd acts as its processor. Politis Ltd processes that Study Data on the controller's documented instructions. The study-specific privacy notice identifies the controller and explains the arrangements for that study.

Any different allocation of responsibilities must be documented before the study begins.

Information handled by Citizen Centric

Depending on how the Platform and a study are configured, Citizen Centric may handle:

• account and access information, including researcher and organisation account details, participant invitation records, and session and authentication information;
• study participation information, including enrolment, research-consent status, withdrawal status, activity responses, diary entries and structured responses;
• participant-submitted material, including text, photographs, documents and audio, with associated submission metadata;
• messages and support enquiries;
• technical and security information, including IP address, device or browser information, timestamps, diagnostic events, audit logs and security events;
• information stored on a participant's device for operation of the app, including drafts, cached content and queued submissions awaiting upload; and
• where a study enables an approved AI-assisted feature, processing inputs and researcher-facing outputs such as transcriptions, translations, summaries, suggested codes or themes.

Why Politis Ltd uses information

Where Politis Ltd acts as controller, it uses personal information for the following purposes and lawful bases:

Where Politis Ltd relies on legitimate interests, it considers whether the processing is necessary and balances those interests against the rights and interests of the individuals affected.

The study controller selects and documents the lawful basis for Study Data and, where relevant, a condition for special-category or criminal-offence data. Consent to participate in research is not automatically the same as consent used as a data-protection lawful basis.

• to provide the Platform and perform agreements with customers and users, where processing is necessary for the performance of a contract;
• to administer customer and researcher relationships and provide support, where necessary for contract performance or for Politis Ltd's legitimate interest in managing its services and business relationships;
• to protect accounts, prevent misuse, investigate security events, maintain auditability and operate a reliable service, based on Politis Ltd's legitimate interests in security, integrity and service continuity;
• to comply with legal, regulatory and accounting obligations, where processing is necessary to comply with law; and
• to diagnose faults and improve operational reliability, based on Politis Ltd's legitimate interest in maintaining a secure and dependable service.

Sensitive information

A study may collect special-category information, such as health information or information revealing political opinions, ethnicity, religion or sexual orientation, where this is necessary for the approved research design. The study controller must identify a valid Article 9 condition, provide suitable privacy information and complete any required ethics review or Data Protection Impact Assessment before launch.

If criminal-offence data is processed, the study controller must also identify and document an applicable legal condition. Politis Ltd processes this information only within the applicable instructions and Platform controls.

AI-assisted processing

Approved server-side AI services may be enabled for a study to support functions such as transcription, translation, summarisation, semantic search, suggested qualitative codes, accessibility processing, content moderation, security screening or support. A feature is not treated as active unless it has been deployed, tested and governed under the applicable AI Services Schedule.

• The participant mobile application does not send material directly to third-party AI endpoints; authorised processing is mediated through services operated or controlled by Politis Ltd.
• Participant material and Study Data are not used to train or improve public or shared foundation models.
• AI outputs are research-assistance material and require human review.
• Citizen Centric does not use AI as the sole basis for decisions producing legal or similarly significant effects on participants.
• Any active study-specific AI processing must be explained in the study's Participant Information Sheet and privacy notice where required.

Cookies, local storage and telemetry

The participant app does not include advertising or marketing-tracking software. Operational diagnostics, security logging and service-performance telemetry may be used to operate and protect the service. They are not used for advertising, cross-site behavioural tracking or participant marketing profiles.

The mobile app uses secure device storage for session credentials and local device storage for drafts, cached content and safe offline queueing. Website cookies and similar technologies are described in the Citizen Centric Cookie and App Technologies Policy. Non-essential technologies requiring consent will not be enabled before valid consent is obtained.

Who receives information

Politis Ltd uses contracted service providers, including Microsoft Azure services, to host, secure and operate Citizen Centric. The current Sub-processor Schedule identifies active providers and services. Providers may process information only for the contracted service and subject to appropriate confidentiality, security and data-protection obligations.

• Study Data is not sold.
• Access is limited to authorised personnel, the relevant study organisation and approved collaborators with a legitimate role.
• Information may be disclosed to professional advisers, insurers, auditors, regulators, courts or public authorities where reasonably necessary or legally required.
• The study controller is responsible for identifying study-specific sponsors, funders, collaborators or other recipients in its own privacy notice.

Where information is processed

Citizen Centric's approved platform policy is to host and process personal information in the United Kingdom and/or the European Union or European Economic Area. Primary production services are hosted in the United Kingdom. Supplier support or service arrangements may involve access or processing from another country.

Where processing creates a restricted international transfer, the relevant controller and processor will use an appropriate legal mechanism, such as adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to approved EU Standard Contractual Clauses, with supplementary safeguards where required. Study-specific arrangements must be stated in the relevant study privacy notice.

How long information is kept

Study Data follows the retention period or retention criteria approved and documented by the study controller before launch. There is no single retention period that is appropriate for every study. When Politis Ltd acts as processor, it follows the controller's documented retention and deletion instructions, subject to limited legal, regulatory, security, dispute-resolution and backup requirements.

• Operational and security records are kept only for as long as reasonably necessary for their purpose and applicable legal obligations.
• Local drafts and queued items are cleared through the relevant app workflows, subject to successful synchronisation and any study-specific requirements.
• After confirmed deletion from active systems, protected production backups expire within up to 14 days and are not used for ordinary research access.
• Irreversibly anonymised information is no longer personal information and may be retained for approved research, statistical or analytical purposes. Pseudonymised information remains personal information.

Security

Politis Ltd uses technical and organisational measures designed to protect personal information, including scoped access controls, encryption in transit using HTTPS, protected cloud storage, audit and security logging, file-validation controls, tenant and study separation, and secure session handling. No internet-connected service can be guaranteed completely secure.

Suspected security incidents or data-protection concerns may be reported to info@politisconsulting.co.uk.

Your choices and rights

Withdrawal from a study, deletion of Study Data and deletion of a Citizen Centric account are separate actions. The study's information must explain their consequences. Withdrawal does not necessarily require deletion of information already lawfully processed or retained, and information already irreversibly anonymised or incorporated into completed analysis may no longer be linkable to an individual.

Depending on the circumstances and lawful basis, individuals may have rights to be informed, access personal information, correct inaccurate information, request erasure, restrict processing, object to processing, receive eligible information in a portable format, and safeguards relating to solely automated decisions. Statutory conditions and research exemptions may apply.

Important information

Right to object: where processing is based on legitimate interests or a public task, you may have the right to object. This right is brought to your attention separately because it depends on the purpose and lawful basis for the processing.

For Study Data, contact the controller named in the study-specific privacy notice. You may also contact Politis Ltd. Further details are provided in the Citizen Centric Data Rights Policy.

Data-protection complaints

You may make a data-protection complaint to the relevant study controller or to Politis Ltd using the contact details below. Politis Ltd will provide a clear route for complaints, acknowledge a complaint within 30 days, take appropriate steps to investigate it without undue delay, keep the complainant appropriately informed and communicate the outcome.

You also have the right to complain to the Information Commissioner's Office. Visit https://ico.org.uk/make-a-complaint/ or telephone 0303 123 1113. You do not have to contact Politis Ltd before contacting the ICO, although doing so may allow the concern to be resolved more quickly.

Children and young people

Citizen Centric is invitation-only. A study involving children or young people must establish appropriate age, capacity, parental-responsibility, safeguarding, ethics and transparency arrangements before launch. The study controller must provide information in a form the intended participants can understand. No universal parental-consent age is imposed by this platform notice because the applicable requirements depend on the study, its legal basis and its ethics arrangements.

Changes and contact

Material changes to this notice will be versioned and published with an updated effective date. Study-specific notices are separately versioned. Continued use will not be treated as a substitute where renewed consent or acceptance is legally required.

Politis Ltd The Old Courthouse, Orsett Road, Grays, Essex, England, RM17 5DD Email: info@politisconsulting.co.uk ICO registration reference: ZB738312