Who is responsible for your information?
LBC & Court operates Joanne and is responsible for deciding how personal information entered into the service is used. For privacy questions or requests, contact b33jay@gmail.com.
Information Joanne handles
Depending on your role and the records maintained, Joanne may handle:
- Account and sign-in information: name, email address, role, Google account identifier, profile image if supplied, account and session timestamps, and session security details such as IP address and browser user agent.
- Building and flat information: flat references, occupancy status, owner or occupier names, and contact email addresses.
- Financial and operational records: bank transaction details, charges, payment allocations, forecasts, expenses, suppliers, insurance records, compliance obligations, deadlines, evidence, works records, notes and audit history.
- Supporting documents: PDFs uploaded to support financial, compliance or works records, together with filenames and basic file metadata.
Some records or documents may contain personal information about residents, freeholders, suppliers or contractors. Members should enter only information needed for building administration and should avoid adding sensitive personal information unless it is necessary and authorised.
Google sign-in information
When you choose Google sign-in, Google provides Joanne with your verified email address, name, profile information and a stable Google account identifier. Joanne uses these details only to confirm your identity, match you to an enabled invited account and maintain that sign-in connection. Joanne requests the identity scopes openid, email and profile; it does not use this information for advertising or sell it.
Joanne stores the Google account association and encrypts OAuth access and refresh tokens in its database. The Google ID token is used to verify the sign-in and is not retained. Google handles information it receives under its own Privacy Policy.
Why information is used
LBC & Court uses information to:
- invite members, authenticate them, apply role-based access and protect the service;
- administer the building’s finances, flat accounts, forecasts, compliance duties, insurance and works;
- maintain accurate records, audit history, backups and service security; and
- respond to requests and meet applicable legal or accounting obligations.
The relevant lawful basis depends on the information and purpose. It includes LBC & Court’s legitimate interests in administering the building, providing access to its invited members and protecting its records, and compliance with legal obligations where they apply.
Who can receive the information?
Information is available to authorised Joanne members according to their assigned roles. It may also be processed by Google for sign-in, and by the hosting and backup infrastructure arranged by LBC & Court to operate the service. Information may be disclosed where required by law or where needed to administer the building. Joanne does not sell personal information or use it for targeted advertising.
Joanne’s server and configured backups are hosted by Hetzner in Germany. Germany is in the European Economic Area; UK adequacy regulations cover transfers to EEA countries, including Germany. Google may process identity information internationally. See Google’s information about international data transfers.
How long information is kept
Building, financial, compliance and works records are kept while they are needed to administer the building, meet applicable record-keeping duties and preserve an accurate audit history. An administrator can disable a member’s account; this ends their access and invalidates their active sessions, while historical records may remain.
Backups are retained for at least 30 days. Information removed from the live service may remain in a backup until that backup expires or is replaced.
Cookies and security
Joanne uses essential cookies to maintain sign-in sessions and complete the Google authentication flow. It does not use advertising or analytics cookies. The service uses role-based access controls, HTTPS and encrypted storage for Google OAuth tokens. No system can guarantee absolute security, so members must keep their sign-in accounts secure and report suspected unauthorised access.
Your choices and rights
You can ask LBC & Court for access to personal information about you, correction of inaccurate information, or deletion or restriction where the law provides that right. You may also have the right to object to some uses or request data portability, depending on the circumstances and lawful basis. Contact b33jay@gmail.com to make a request.
You can complain to the UK Information Commissioner’s Office if you are concerned about how your information is handled.
Changes to this policy
This policy may be updated when Joanne’s use of information changes. The date at the top shows when it was last revised.