CADO privacy notice

Draft for review, last updated 16 October 2026. Text in square brackets is still to be confirmed before publishing.

Contents

1. Who is responsible for your information

CADO (Communities Against Delinquent Ownership) is run by Kinship Works, the trading name of Kinship Project Limited, a private limited company registered in England and Wales (company number 16458730), of 86-90 Paul Street, London EC2A 4NE.

Kinship Works is the controller of the personal information described in this notice. Our registration number with the Information Commissioner’s Office is [ICO registration number].

For anything about CADO, including privacy and data protection:

  • Email: cado@kinship.works

  • Post: CADO, Kinship Works, 86-90 Paul Street, London EC2A 4NE

  • Data protection lead: [role title, e.g. CADO Programme Lead]

2. What CADO does

CADO maps buildings that have been empty or neglected for a long time and matter to their communities. Our page Which buildings go on the map explains which buildings we include.

Members of the public tell us about buildings and send photos, links, observations and local knowledge. We review every submission before deciding whether to publish an entry.

We also use what we learn to publish reports, support media coverage, and connect people campaigning to bring buildings back into use.

3. What this notice covers

This notice applies when you:

  • submit a building, or suggest an update to an entry;

  • appear in information sent to us or found in another source;

  • contact us about an entry;

  • ask us to correct something, make a complaint or make a data protection request;

  • subscribe to CADO news;

  • visit the CADO website; or

  • work with CADO as a partner, volunteer, contractor or adviser.

4. Information we collect

About you, if you submit a building or suggest an update

  • the name you give us (a first name is fine);

  • your email address;

  • your relationship to the building, for example local resident or member of a campaign group;

  • details of any local group or campaign you tell us about;

  • whether you want to be credited by name;

  • what you tell us about the building, your sources and your photos, what you’d like to happen to it and what you think is stopping that, with a record of the photo licence you gave us;

  • whether we may contact you in relation to your submission;

  • anything you tell us about problems with the form;

  • our correspondence with you; and

  • records of how we reviewed your submission.

We don’t publish your name or contact details unless you ask us to.

About buildings

  • the building’s address or location;

  • its type and condition;

  • how long it has been empty, as reported;

  • photos;

  • publicly available planning, heritage and council information;

  • the type of owner, and where that information came from; and

  • records of corrections, owner responses and updates.

A building’s address can be personal information if it is linked to an individual, for example a home. CADO does not include homes people live in.

About owners

Individual owners. If a building is owned by a private individual or sole trader, we record only “private individual”. We don’t keep their name. If a name reaches us, for example in a submission, we delete or redact it.

Companies and public bodies. We may keep the name of a company or public body that owns a building, with its company number, the source and the date we checked it. We don’t keep the names or contact details of directors, staff or officers.

We never publish the name of any owner.

About other people

Submissions sometimes mention other people, such as occupiers, neighbours or council staff. We remove this information unless we need it, for example to deal with a complaint.

Website and technical information

  • IP address;

  • browser and device information;

  • dates and times of access;

  • security and error logs; and

  • cookie-free usage statistics, such as which pages are viewed, that don’t identify you.

Newsletter

If you subscribe, we keep your email address and a record of your consent.

5. Where information comes from

  • the person it is about;

  • people who submit buildings or updates;

  • community groups and partner organisations;

  • government, council and other official sources;

  • Companies House and similar public registers;

  • planning, heritage and licensing records;

  • published news reports;

  • websites of owners or relevant organisations; and

  • our own correspondence and review records.

Information being publicly available doesn’t automatically mean we can reuse or publish it. We consider the source, its reliability, any licence terms, people’s reasonable expectations and the effect of publishing.

6. What is public and what stays private

A public entry may show:

  • the building’s name and location (sometimes approximate, to protect privacy);

  • its type and condition;

  • roughly how long it has been empty;

  • why it matters locally;

  • any response from the owner, up to 150 words;

  • photos;

  • the type of owner, such as “company” or “council”;

  • the date we last checked the entry; and

  • the name of the person who submitted it, only if they asked to be credited.

We never publish:

  • the name of any owner, whether an individual, company or public body;

  • contributors’ names or contact details, unless they ask to be credited;

  • private correspondence, phone numbers or email addresses;

  • information about anyone’s health, family, finances or personal circumstances;

  • allegations of crime or wrongdoing;

  • information that could identify a vulnerable person;

  • photos showing identifiable people or number plates, unless blurred; or

  • details of how to get into a building.

We edit submissions before publishing, so an entry usually contains less than the original submission.

7. Why we use information, and our lawful bases

What we do, and the lawful basis for it:

  • Receive, review and publish submissions; keep the map accurate; contact you in relation to your submission (for example to check details, hear more about the building and any local action, or ask whether you’d like to get more involved); correct or remove entries; prevent misuse. Legitimate interests: documenting buildings of community concern, supporting community action, and keeping the map accurate and safe.

  • Analyse submissions to publish reports and support media coverage, using anonymised or building-level information. Legitimate interests: informing public debate and policy about empty and neglected buildings.

  • Share ownership information from public records with like-minded partner organisations and with campaigners working on the same building. Legitimate interests, where any personal information is involved at all.

  • Credit you by name on an entry. Consent.

  • Send you CADO news. Consent.

  • Use non-essential cookies, if any. Consent.

  • Meet legal obligations, respond to regulators, and establish or defend legal claims. Legal obligation or legitimate interests.

Before relying on legitimate interests, we check that the purpose is legitimate, that the use is necessary for it, and that it doesn’t override the rights and interests of the people concerned. We have written this assessment down.

You don’t have to agree to news to submit a building. You can withdraw consent at any time by emailing cado@kinship.works or using the link in any email.

8. Information about someone else

We design CADO so that we hold as little information as possible about people who haven’t contacted us.

  • We don’t keep the names of individual owners or sole traders.

  • We remove information about occupiers, neighbours and other people unless we need it.

  • We don’t keep the names of company directors, staff or council officers.

If we ever need to keep identifiable information about someone who didn’t give it to us, we will record why, and tell them within one month, at our first contact with them, or before we share it, whichever comes first, unless the law gives an exception. We won’t rely on an exception without recording our reasons.

9. Sensitive circumstances and allegations

The submission form asks whether anyone is living in the building, or whether publishing it could cause a privacy or safety problem. Please answer without giving personal details.

If we receive information we don’t need about anyone’s health, disability, religion, ethnicity, sexual orientation, political views or other sensitive matters, we redact or delete it, normally within 30 days.

We never publish allegations of crime, fraud, threatening behaviour or similar wrongdoing. We isolate, redact or delete such material unless we have a recorded legal reason to keep it, for example to take legal advice or deal with a legal claim.

10. Homes and vulnerable people

CADO doesn’t include homes people live in. If a submission turns out to be about one, we won’t publish it, and we’ll delete it in line with section 14.

Where a building may be connected with a vulnerable person, we may show an approximate location, leave out photos or details, delay publication while we check, or decide not to publish. CADO is not intended to help anyone harass, trespass on or make unwanted contact with anyone.

11. Who we share information with

Service providers who run CADO’s systems for us, under contracts that limit them to our instructions:

  • Tally: submission and update forms. Data held in the European Union.

  • Airtable: storing and reviewing submissions. United States.

  • Google Workspace: email and documents. United Kingdom, European Union and United States (Google’s data centres).

  • Framer: hosting the website. Amazon Web Services data centres, with pages served from a global network [region to confirm with Framer].

  • Netlify: hosting the map. United States, with pages served from a global network.

  • OpenFreeMap: map tiles, which receive your IP address when the map loads. European Union, on dedicated servers [to confirm].

  • Mailchimp: sending CADO news. United States.

  • Claude (Anthropic): helping review public records. United States.

Others:

  • volunteers and contractors who help with moderation, under confidentiality agreements;

  • professional advisers, including lawyers and insurers;

  • like-minded partner organisations working to support communities, and campaigners working together to save the same building, who may receive ownership information from public records (such as a company name as shown at Companies House), never your details, and never journalists;

  • research partners, only with anonymised information or under a written agreement;

  • regulators, courts or law enforcement, where the law requires or allows it; and

  • another organisation taking on the CADO project, with appropriate safeguards.

We would only share your details without asking you if a court or the law required us to.

We don’t sell or rent personal information. We don’t give contributors’ details or ownership information to developers, buyers or agents.

12. Public information and reuse

Anything published on the map can be seen, copied and indexed by others. We keep published entries to what is needed, and our website terms forbid using CADO to harass, target or compile information about people.

Publication on the map doesn’t give anyone permission to use personal information unlawfully. Anyone reusing it is responsible for complying with data protection law.

We don’t currently release CADO data as open data. If we do, we’ll update this notice first.

13. International transfers

Some service providers store or access information outside the United Kingdom. Where they do, we rely on UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, or the UK’s International Data Transfer Agreement or addendum. You can ask us for details.

14. How long we keep information

Unless we need to keep something longer for a complaint, a legal claim or a legal obligation:

  • Unpublished or rejected submissions: deleted or anonymised 12 months after our decision or last contact.

  • Names of individual owners, if received: deleted or redacted at review.

  • Unneeded sensitive information and allegations: redacted or deleted within 30 days of review.

  • Evidence behind a published entry: while the entry is live, and up to two years after removal.

  • Your contact details: while needed to maintain the entry, and up to two years after our last contact or the entry’s removal.

  • Records of ownership information shared: three years.

  • Corrections, complaints and owner responses: three years after the matter is closed.

  • Data protection requests: three years after closure.

  • Security and access logs: 90 days.

  • Security incident records: three years.

  • Newsletter: until you unsubscribe, then a minimal record so we don’t contact you again.

  • Backups: overwritten within 90 days.

We review live entries at least once a year, and delete information sooner if it is inaccurate, excessive or no longer needed.

15. Security

We protect information by:

  • limiting access to the people who need it;

  • keeping private submissions separate from the public map;

  • requiring two-factor login on our systems;

  • using encryption in transit and, where appropriate, at rest;

  • requiring confidentiality from volunteers and contractors;

  • keeping secure backups; and

  • having a procedure for responding to security incidents, including reporting to the ICO where required.

No online service can be completely secure, and we review our safeguards regularly.

16. Your rights

Depending on the circumstances, you can ask us to:

  • give you a copy of your personal information;

  • correct information that is wrong or incomplete;

  • delete information;

  • restrict how we use it;

  • stop using it, where we rely on legitimate interests; or

  • give you information you provided in a portable format.

You can withdraw consent at any time where we rely on it.

These rights aren’t absolute. We may need to keep some information where the law allows or requires it, for example to deal with a legal claim. We may ask for information to confirm who you are. We’ll reply within one month.

When we answer a request, we won’t reveal who submitted a building or anyone else’s personal information.

To use any of these rights, email cado@kinship.works.

17. Correcting or responding to an entry

If you think an entry is inaccurate, out of date or unfair, or want to respond on behalf of an owner, use “Suggest an update” on the entry on the map or email cado@kinship.works.

We’ll look at significant concerns quickly, and aim to hide an entry within five working days while we check.

A concern about map content isn’t always a data protection complaint, but we’ll treat it as one where it’s about personal information.

18. Data protection complaints

To make a data protection complaint, email cado@kinship.works. We will:

  • acknowledge your complaint within 30 days;

  • investigate it;

  • keep you informed if it takes longer than expected; and

  • tell you the outcome without undue delay.

You can also complain to the Information Commissioner’s Office. We’d welcome the chance to put things right first, but you don’t have to contact us before going to the ICO.

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Telephone 0303 123 1113. ico.org.uk/make-a-complaint

19. Cookies, analytics and maps

We only use cookies that are needed to run and secure the website. Our analytics don’t use cookies.

When the website loads the map, our map provider receives technical information such as your IP address. Section 11 lists the providers we use and what they receive.

20. Children

CADO is not designed for children under 16. Children shouldn’t submit information without help from a parent, guardian, teacher or responsible organisation. If we find we’ve received unnecessary information about a child, we’ll delete it.

21. Automated decisions

We don’t use automated decision-making to decide whether a building is published. We may use technical tools to detect spam, security threats or duplicate submissions, and to help review public records, but a person checks what they find before we rely on it, and a person always makes publication decisions.

22. Changes to this notice

We’ll update this notice when CADO’s activities, service providers or legal obligations change, and show the date of the latest version at the top. If a change significantly affects how we use your information, we’ll take reasonable steps to tell you.

23. Contact us

Questions, requests and complaints: cado@kinship.works, or CADO, Kinship Works, 86-90 Paul Street, London EC2A 4NE.