Privacy notice

How your details are used on the Poppy Appeal Volunteer Rota, in plain English.

Last updated 2 October 2026

Who looks after your data

This website is run by Dale Jefferies, who is responsible for your personal data (the “data controller”). It is an independent volunteer tool to help Royal British Legion branches organise Poppy Appeal collecting. For any question about your data, email rbl@ubique-apps.co.uk.

What we collect

• Your account: name, email address, phone number, your Legion branch, and the name of any group you collect with. Your password is stored scrambled (hashed), so nobody, including us, can read it.
• Your bookings: which shifts you’ve booked and how many people are coming.
• People added by organisers: when an organiser books someone who doesn’t use the website (for example a cadet unit or someone who phoned), we store the name, group, phone and email the organiser enters.
• Technical details: one cookie to keep you logged in, and for security, the internet (IP) address used when organisers make changes or when someone gets a password wrong.

We don’t collect anything about children. Young people collect as part of a group booked by an adult leader, and only the group’s name and the leader’s details are stored.

Why we use it

• To let you book collecting shifts, and to send you booking confirmations and cancellations.
• So your branch organisers can arrange the rota and contact you about your shifts.
• For your branch to send you a handful of emails a year about the appeal (at most 5). You can turn these off at any time.
• To keep the website secure and stop misuse.

The legal basis is our legitimate interest in organising the Poppy Appeal with the volunteers who’ve asked to take part, and the agreement you give when you sign up.

Who can see your details

• Your branch organisers see your name, email, phone and bookings, to run the rota.
• Other volunteers in your branch see only your first name and initial (for example “Dale J.”) on the branch rota. Groups are shown by name. They never see your phone number or email.
• The site administrator (Dale Jefferies) can see all branches, to run and support the website.
• The companies that host the website and send its emails store the data on our behalf and may not use it for anything else.

We never sell your details, use them for advertising, or pass them to anyone else, including the Royal British Legion nationally, unless you ask us to or the law requires it.

How long we keep it

• Your account and bookings: until you delete your account, or after 3 years without logging in, when it is deleted automatically.
• People added by organisers: their contact details are removed 12 months after the shift.
• Security records: wrong-password records for 1 day; the organisers’ activity log for 2 years.
• Password reset links stop working after 1 hour (or 24 hours if sent by an organiser).

Your rights

• See your data: on your Account page, press Download my data for a copy of everything we hold about you.
• Correct it: change your details on the Account page, or ask your organiser.
• Delete it: press Delete my account on the Account page. This removes your details and cancels your shifts straight away.
• Stop branch emails: untick the option on the Account page.
• Ask a question or object: email rbl@ubique-apps.co.uk. We’ll reply within one month.

If you’re unhappy with how your data has been handled, you can complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint or 0303 123 1113. We’d appreciate the chance to put things right first.

Keeping it safe

The site uses an encrypted connection, scrambled passwords, automatic log-out, protection against password guessing, and organisers can only see their own branch. Downloads of personal data are logged. See also Cookies.

Changes

If this notice changes in a way that matters, we’ll update the date at the top and tell you by email.