Just Granted
Log in Create an account

Privacy notice — applicants

Privacy notice — planning applicants (APPROVED 2026-08-27, was v3)

Renamed 2026-08-20 (ticket 869em1n5x), and the contact address followed on 2026-08-27 (869ee2apd): the trading name changed from Plan & Post to Just Granted, and the address to write to is now hello@justgranted.co.uk on Dan's instruction. The controller is unchanged — Blueworkz Ltd, company number 13258077. hello@planandpost.co.uk is the same mailbox and still receives, so a letter or an objection sent to the old address is not lost.

APPROVED BY DAN, 27 August 2026 (869eqx27v): "I have read the complete GDPR pack, I approve all of it." The draft banner is lifted on every document in this pack at once, which is what he asked for. What his approval is not: it is not legal advice, no solicitor has read any of it (his decision of 2026-08-19, 869ef85a2), and it did not create the DPIA that §12.6 of the LIA says is needed before the first bulk-file sale — that DPIA was written on 2026-08-29 at his instruction (869eqy933 Q2), is at docs/gdpr/DPIA-BULK-DATA-FILE.md, and he signed it off separately on 2026-08-30 (869erd3f6 §3.1, "sign it off as written") — a different act from the pack approval above, and one that cleared a single condition (C8) rather than opening a sale: no bulk data file has ever been sold, offered for sale, or produced. The history below is kept as written.

History — status was: DRAFT v3 (2026-08-11). Written by Claude for ticket D6, revised against Dan's 7 Aug and 11 Aug reviews. Not legal advice. Dan reviews, amends and approves before any real letter is sent. A solicitor's read-through before launch was recommended and has now been decided against: on 2026-08-19 (ticket 869ef85a2) Dan decided not to commission a formal review at this stage, having discussed the business model and this documentation with a solicitor in detail; he may revisit it when revenue is material. Nothing here has been approved by a lawyer. On Dan's approval this text is published on the public website and its URL printed on every letter.

Changed in v2: operator named (Blueworkz Ltd trading as Plan & Post); real contact details; the "no other source" claim corrected — it was untrue; the "we do not sell data or send it outside the UK" commitment removed and replaced with an accurate statement.

Changed in v3 (Dan's confirmations, 2026-08-11): the print processor is named — Stannp Ltd, Article 28 contract confirmed by Dan — in place of the last bracketed placeholder; the registered office is corrected to Companies House order (Pitstone before Leighton Buzzard); the legitimate-interests assessment is now offered as a published summary rather than only on request; and the notice now states that suppressed people are removed from subscriber exports as well as from letters, which is enforced in code as of v0.109.0.

Who we are

Just Granted is a trading name of Blueworkz Ltd (company number 13258077), registered at 39 Crispin Field, Pitstone, Leighton Buzzard, LU7 9BG, United Kingdom. Blueworkz Ltd is the data controller for the personal data described in this notice, and is registered with the Information Commissioner's Office, registration reference ZB220579.

Just Granted is a service that helps building-trade businesses contact people who have submitted planning applications.

Contact us at hello@justgranted.co.uk, or by post at the registered address above.

This notice is about planning applicants. If you subscribe to Just Granted, work for a business that does, or have left your email address with us, what we hold about you is a different set of data under different lawful bases, and it has its own notice at justgranted.co.uk/legal/privacy/customers/.

If you are a planning agent, architect or consultant named on somebody else's application, and we have written to you about Just Granted, that is a third set of data under a third lawful basis — where Blueworkz Ltd is the sender rather than a subscriber — and it has its own notice at justgranted.co.uk/legal/privacy/agents/.

What data we hold about you and where it came from

If you (or an agent acting for you) submitted a planning application to a local planning authority, that authority publishes the application on its public planning register, as required by law. From that public register we collect: the site address, the application reference, a description of the proposal, decision dates and outcomes, and — where the authority publishes it — the applicant's name.

We also use other public sources to complete the site address. Council registers often publish an address without a usable postcode, or in a form that cannot be posted to. To fix that we look the address up against public address and postcode data — currently OpenStreetMap (via the Nominatim service) and postcodes.io, the free postcode directory built on Ordnance Survey and ONS open data. These sources tell us about addresses, not about people: we send them an address and they return a postcode and location. We may add further public address or planning-data sources for the same purpose, and this notice will name the categories we use.

We do not buy personal data from data brokers or marketing lists, and we do not hold financial data, telephone numbers or email addresses about applicants.

What we do with it

We make this public planning information searchable for our subscribers (builders, architects, surveyors and similar trades), and we post letters on their behalf to the applicant's site address offering services relevant to the application — for example, a builder writing about an approved extension.

A subscriber may write to you about a given application at two points: when the application is submitted, and when it is decided. Those are the only two triggers, and the second only happens if the subscriber chooses to write again.

We also intend to license a bulk file of this planning-application data to organisations who buy it for market research and business planning. That is a separate purpose from posting you a letter, we have assessed it separately, and nothing has been sold. What it means for you is set out under "Sharing, processors and transfers" below — including the most important part, which is that if you have asked us to stop, you are not in the file.

Our legal basis

Our legal basis under UK GDPR Article 6(1)(f) is legitimate interests: ours and our subscribers' interest in offering relevant trade services to people with live building projects, using only information already published in a public register, by post only (no email, no phone), with a clear route to stop further contact. We have carried out and documented a legitimate interests assessment (a "legitimate interests assessment", written on 9 August 2026 and reviewed at least annually), which weighs our interests and our subscribers' against your rights. It records the safeguards we rely on: post only, at most two letters per application, an absolute and global right to stop them, published retention limits, no special-category data, and no profiling. A summary of that assessment is published at justgranted.co.uk/legal/legitimate-interests/, and you can ask us for a copy at hello@justgranted.co.uk.

How to stop letters (right to object)

Under UK GDPR Article 21 you have an absolute right to object to direct marketing. Tell us once and letters stop for good — from every business that uses Just Granted, not just the one that wrote to you:

We add you to our suppression list within 10 working days (usually much faster) and no further letters will be sent to you through Just Granted. The suppression list stores the minimum needed to honour your objection (address/postcode, if you give it your name, how the objection reached us, and which kind of post it stops) and nothing else. An objection from a householder stops everything we would send to that address.

How long we keep data

See our retention policy: applicant personal data is deleted on the timetable published there; the suppression list is kept for as long as we operate, because deleting it would restart the letters you asked us to stop.

Your other rights

You can ask for a copy of the data we hold about you (access), ask us to correct it, ask us to erase it, and complain to the Information Commissioner's Office (ico.org.uk). Requests to hello@justgranted.co.uk; we respond within one month.

Sharing, processors and transfers

Letters are printed and posted by Stannp Ltd, acting as our processor under a written contract that meets Article 28 of the UK GDPR. They print and post; they do not use your data for anything else.

Subscribers can view applicant details in the service, and on some plans download them for their own records. When a subscriber downloads data they become a controller of that copy and must honour objections independently — our terms oblige them to, and we log every export. If you have asked us to stop, your details are removed from those downloads too: the export leaves out anyone on our suppression list, so an objection stops the data reaching new hands as well as stopping the letters.

Organisations who purchase a bulk data file. We intend to license a weekly file of planning-application data — the same information described above — to organisations who want it for market research and business planning, for a fee. If you have asked us to stop, you are not in that file: the same suppression list that stops our letters is applied when the file is produced, and the system that produces it refuses to produce one at all if the list is missing or out of date. A licensee is bound by a written contract to use the file for the purpose we license it for, to replace it with a fresh copy each week and delete the old one, and to honour your objection as we do. No such file has been sold, and none will be before this notice is approved.

Our subscribers are normally in the UK. If a subscriber is based outside the UK, or a supplier we use processes data outside the UK, that transfer is made under the safeguards UK data protection law requires (an adequacy decision, or the ICO's International Data Transfer Agreement or Addendum). We do not sell personal data to data brokers or marketing-list companies: a licence to a named organisation under a contract that binds them to honour your objection is not the same thing as selling your details onto an open market, and we do not do the second.