Speak-Up privacy notice
Who we are
RODMENA LIMITED, 14 Keppel Row, America House, Flat 2, London SE1 0FB, is the controller of personal data processed through this portal (ICO registration ZC202334). Contact us about privacy at privacy@rodmena.co.uk.
What we collect and why
- Your work email address and a one-time code, to confirm you work at RODMENA before you can submit. The code is stored only as a keyed hash; your email address is held with it for up to 24 hours.
- Your report: the category and what you choose to tell us, which may include information about other people. It is delivered by email to the people who handle Speak-Up concerns; the portal’s database does not store it.
- A delivery record: your report reference, the date, the category, whether you asked for identity protection, email delivery receipts, and a keyed pseudonym of your email address, so we can show every concern was received and limit abuse.
- Security data: keyed pseudonyms of your IP address and email address, used only to rate-limit code requests and reports.
We do not use analytics, advertising or tracking. The portal sets only strictly necessary cookies, scoped to its API, to carry your verification step and your 60-minute verified session; they are cleared when you send your report or when they expire. Your theme choice is kept in your browser’s local storage and never sent to us.
Our lawful basis
We process this information because it is necessary for our legitimate interests in detecting and dealing with wrongdoing, protecting the people who report it, and keeping the channel secure (UK GDPR Article 6(1)(f)), and where relevant to comply with our legal obligations (Article 6(1)(c)). Where a report contains special category or criminal offence data, we process it under UK GDPR Articles 9 and 10 using the substantial public interest condition in Schedule 1, paragraph 10 of the Data Protection Act 2018 (preventing, investigating or detecting unlawful acts). We keep the appropriate policy document that this condition requires, adopted on 5 October 2026.
Where it is held and for how long
Speak-Up portal and its database
- What it holds
- Your work email with your code or session (up to 24 hours); a delivery record keyed by a pseudonym of your email; no report text
- Where
- RODMENA servers in the United Kingdom; database standby replica in Germany; encrypted backups in France
- How long
- Codes and sessions: deleted within 24 hours. Delivery records: 6 years. A deleted record can remain in encrypted backups for up to 16 days
Email sending service (operated by RODMENA)
- What it holds
- The report, receipt and code emails while they are sent
- Where
- RODMENA servers in the United Kingdom; database standby replica in Germany; encrypted backups in France
- How long
- Message text removed from the live system immediately after sending; it may persist in encrypted backups for a limited period
Rate-limiting service (operated by RODMENA)
- What it holds
- Keyed pseudonyms of your email and IP address, never the address itself
- Where
- Application in the United Kingdom; database in France; standby replica in Germany; encrypted backups in France
- How long
- Retained indefinitely as keyed pseudonyms
Web server logs (operated by RODMENA)
- What it holds
- Page requests with the last part of your IP address removed and without query strings; requests to the reporting form are not logged. Records of server errors may include a full IP address and the address of the page requested
- Where
- RODMENA servers in the United Kingdom
- How long
- Request logs: up to 90 days. Error records: up to 14 days
RODMENA mailboxes (Google Workspace)
- What it holds
- The report email and any correspondence with the people handling it
- Where
- Google Workspace, under Google’s storage locations, acting as our processor
- How long
- As long as the matter requires, normally no longer than 6 years after it is closed
All of these systems are in the United Kingdom or the European Union.
Who sees it
Only the people who handle Speak-Up concerns, and anyone they need to involve to investigate or put things right, on a strictly need-to-know basis. We may have to share information with a regulator, the police or a court where the law requires it.
Your rights
You have rights to access, correct and erase your data, to restrict or object to its use, and to complain. Some rights may be limited where using them would prejudice an investigation or reveal information about another person. To exercise a right, email gdpr@rodmena.co.uk.
If you are unhappy with how we have used your data, please complain to us first at privacy@rodmena.co.uk; we will acknowledge your complaint within 30 days. You can also complain to the Information Commission (ico.org.uk, 0303 123 1113).
If you are named in a report
If a concern mentions you, we handle that information fairly and confidentially. We may delay telling you about it, or limit what we tell you, where doing so would prejudice an investigation or reveal who raised the concern, as data protection law allows.