Privacy notice

Privacy notice — planning applicants (DRAFT v3, awaiting Dan's approval)

Renamed 2026-08-20 (ticket 869em1n5x): the trading name changed

from Plan & Post to Just Granted. The controller is unchanged —

Blueworkz Ltd, company number 13258077. The contact address and

website named below still read planandpost.co.uk: the new domain

and mailbox are separate tickets (869em1nqu, 869em1ny7), and the

old address keeps working either way.

Status: DRAFT v3 (2026-08-11). Written by Claude for ticket D6,

revised against Dan's 7 Aug and 11 Aug reviews. Not legal advice.

Dan reviews, amends and approves before any real letter is sent. A

solicitor's read-through before launch was recommended and has now

been decided against: **on 2026-08-19 (ticket 869ef85a2) Dan

decided not to commission a formal review at this stage**, having

discussed the business model and this documentation with a solicitor

in detail; he may revisit it when revenue is material. Nothing here

has been approved by a lawyer. On Dan's approval this text is

published on the public website and its URL printed on every letter.

Changed in v2: operator named (Blueworkz Ltd trading as Plan &

Post); real contact details; the "no other source" claim corrected —

it was untrue; the "we do not sell data or send it outside the UK"

commitment removed and replaced with an accurate statement.

Changed in v3 (Dan's confirmations, 2026-08-11): the print

processor is named — Stannp Ltd, Article 28 contract confirmed by

Dan — in place of the last bracketed placeholder; the registered

office is corrected to Companies House order (Pitstone before Leighton

Buzzard); the legitimate-interests assessment is now offered as a

published summary rather than only on request; and the notice now

states that suppressed people are removed from subscriber exports

as well as from letters, which is enforced in code as of v0.109.0.

Who we are

Just Granted is a trading name of Blueworkz Ltd (company number

13258077), registered at 39 Crispin Field, Pitstone, Leighton

Buzzard, LU7 9BG, United Kingdom. Blueworkz Ltd is the

data controller for the personal data described in this notice.

Just Granted is a service that helps building-trade businesses contact

people who have submitted planning applications.

Contact us at hello@planandpost.co.uk, or by post at the registered

address above.

What data we hold about you and where it came from

If you (or an agent acting for you) submitted a planning application to

a local planning authority, that authority publishes the application on

its public planning register, as required by law. From that public

register we collect: the site address, the application reference,

a description of the proposal, decision dates and outcomes, and — where

the authority publishes it — the applicant's name.

We also use other public sources to complete the site address.

Council registers often publish an address without a usable postcode, or

in a form that cannot be posted to. To fix that we look the address up

against public address and postcode data — currently OpenStreetMap

(via the Nominatim service) and postcodes.io, the free postcode

directory built on Ordnance Survey and ONS open data. These sources tell

us about *addresses*, not about *people*: we send them an address and

they return a postcode and location. We may add further public address

or planning-data sources for the same purpose, and this notice will name

the categories we use.

We do not buy personal data from data brokers or marketing lists, and we

do not hold financial data, telephone numbers or email addresses about

applicants.

What we do with it

We make this public planning information searchable for our subscribers

(builders, architects, surveyors and similar trades), and we post

letters on their behalf to the applicant's site address offering

services relevant to the application — for example, a builder writing

about an approved extension.

A subscriber may write to you about a given application at two points:

when the application is submitted, and when it is decided. Those

are the only two triggers, and the second only happens if the subscriber

chooses to write again.

Our legal basis

Our legal basis under UK GDPR Article 6(1)(f) is **legitimate

interests**: ours and our subscribers' interest in offering relevant

trade services to people with live building projects, using only

information already published in a public register, by post only (no

email, no phone), with a clear route to stop further contact. We have

carried out and documented a legitimate interests assessment

(a "legitimate interests assessment", written on 9 August 2026 and

reviewed at least annually), which weighs our interests and our

subscribers' against your rights. It records the safeguards we rely on:

post only, at most two letters per application, an absolute and global

right to stop them, published retention limits, no special-category

data, and no profiling. A summary of that assessment is published at

planandpost.co.uk/legal/legitimate-interests/, and you can ask us

for a copy at hello@planandpost.co.uk.

How to stop letters (right to object)

Under UK GDPR **Article 21 you have an absolute right to object to

direct marketing**. Tell us once and letters stop for good — from every

business that uses Just Granted, not just the one that wrote to you:

• email hello@planandpost.co.uk, or
• post to Blueworkz Ltd, 39 Crispin Field, Pitstone, Leighton Buzzard,

LU7 9BG, or

• use the reference printed on the letter you received.

We add you to our suppression list within 10 working days (usually

much faster) and no further letters will be sent to you through

Just Granted. The suppression list stores the minimum needed to honour

your objection (address/postcode and, if you give it, your name) and

nothing else.

How long we keep data

See our retention policy: applicant personal data is deleted on the

timetable published there; the suppression list is kept for as long as

we operate, because deleting it would restart the letters you asked us

to stop.

Your other rights

You can ask for a copy of the data we hold about you (access), ask us

to correct it, ask us to erase it, and complain to the Information

Commissioner's Office (ico.org.uk). Requests to

hello@planandpost.co.uk; we respond within one month.

Sharing, processors and transfers

Letters are printed and posted by Stannp Ltd, acting as our

processor under a written contract that meets Article 28 of the UK GDPR.

They print and post; they do not use your data for anything else.

Subscribers can view applicant details in the service, and on some plans

download them for their own records. When a subscriber downloads data

they become a controller of that copy and must honour objections

independently — our terms oblige them to, and we log every export.

**If you have asked us to stop, your details are removed from those

downloads too**: the export leaves out anyone on our suppression list,

so an objection stops the data reaching new hands as well as stopping

the letters.

Our subscribers are normally in the UK. If a subscriber is based

outside the UK, or a supplier we use processes data outside the UK, that

transfer is made under the safeguards UK data protection law requires

(an adequacy decision, or the ICO's International Data Transfer

Agreement or Addendum). We do not sell personal data to data brokers or

marketing-list companies.