Vestigia privacy notice

About Vestigia

DAUK uses a private workspace called Vestigia to prepare, send and manage subject access requests, freedom of information requests and related information request support. The workspace may contain your identity and contact details, request scope, correspondence, deadlines, delivery information and documents you provide. It may also contain information about other people where that is relevant to the request.

Some records may include health, employment, professional association or other special category information, allegations or criminal offence data. We use this information only where it is necessary and a valid additional legal condition applies.

Where the information comes from

We usually receive information from the person seeking support or someone assisting them. We may also receive correspondence and documents from request recipients, contact details from reviewed public authority and contact sources, information from DAUK records and relevant public sources. Where information is obtained indirectly, we use only what is relevant to the request or support being provided.

Why we use the information

We use the information to provide and administer the support you ask for, prepare and evidence lawful requests, manage deadlines, keep the workspace secure and respond to complaints or legal claims. Our main lawful basis is legitimate interests. We assess the interests and impact in each case. We may also use information where it is necessary for a contract with you or a specific legal obligation.

For special category information we generally rely on the legal claims condition where the information is necessary to establish, exercise or defend legal rights. Limited internal activity concerning members, former members or people in regular contact may use the not for profit body condition where its strict safeguards apply. For criminal offence data we use an applicable DPA 2018 Schedule 1 condition, most commonly legal claims or the limited not for profit body condition. We use consent only where you have a genuine choice and can withdraw it.

Who processes the information

Access is limited to authorised DAUK users and depends on role and case type. All signed-in users may read ordinary freedom of information and general request cases. Subject access request cases are restricted to the owner, explicitly added viewers and administrators. Only the owner and administrators may manage or send a case.

We use Supabase for the database and authentication, Vercel for the application and Resend for transactional email. Supabase primary project data and Vercel functions are configured in London. Resend dispatches from Ireland. Vercel and Resend also process some account, message, log or backup data in the United States. The suppliers’ contractual UK transfer safeguards apply. Contact us at contact@dauk.org to ask about the contractual UK transfer safeguards or obtain further information, including a copy. We do not use email tracking in Vestigia.

How long we keep it

We normally keep freedom of information and general information request records for up to six years after case closure, and subject access request records for up to three years after closure. Verified identity evidence becomes eligible for manual deletion 30 days after verification. Administrators review it daily and delete it as soon as reasonably practicable after that deadline, keeping only a minimal note of the check. We review retention and may keep a limited record longer where a complaint, legal claim or binding obligation requires it. Provider logs and backups expire through their documented rotation periods.

Your rights and contact

You may have rights to ask for access, correction, deletion or restriction. Where processing is automated and based on contract or consent, you may also have a right to data portability. Where we rely on consent, you can withdraw consent at any time. Withdrawal does not affect processing that was lawful before it. Rights can depend on the circumstances and applicable law.

Contact DAUK at contact@dauk.org. Dr Matt Kneale is DAUK’s data controller contact. You may also complain to the Information Commissioner’s Office.