CADO privacy notice

Last updated: 2 November 2026.

Contents

1. Who is responsible for your information

CADO (Communities Against Delinquent Ownership) is run by Kinship Works, the trading name of Kinship Project Limited. Kinship Works is a social purpose organisation working to support civic renewal and community-led development. Kinship Works is registered as a private limited company in England and Wales (company number 16458730), at 86-90 Paul Street, London EC2A 4NE. In these terms, “we” and “us” mean Kinship Works.

Kinship Works is the controller of the personal information described in this notice. Our registration number with the Information Commissioner’s Office is ZC107593.

For enquiries related to CADO, including issues pertaining to privacy and data protection, contact:

  • Email: cado@kinship.works

  • Post: CADO, Kinship Works, 86-90 Paul Street, London EC2A 4NE

  • Data protection lead: Emily Macaulay cc James Plunkett

2. What CADO does

CADO maps buildings that have been empty or neglected for a long time and that matter to their communities. CADO exists to raise the profile of these buildings and to support people in their efforts to bring these buildings back into use.

Members of the public tell us about buildings and send photos, links, observations and local knowledge. We review submissions before deciding whether to publish an entry. Our page Which buildings go on the map explains which buildings we include on the map.

We also use what we learn to inform reports, support media coverage, and to connect together people campaigning to bring buildings back into use.

3. What this notice covers

This notice applies when you:

  • submit a building, or suggest an update to an entry;

  • appear in information sent to us or found in another source;

  • contact us about an entry;

  • ask us to correct something, make a complaint or make a data protection request;

  • subscribe to CADO news;

  • visit the CADO website; or

  • work with CADO as a partner, volunteer, contractor or adviser.

4. Information we collect

About you, if you submit a building or suggest an update

  • the name you give us (a first name is fine);

  • your email address;

  • your relationship to the building, for example local resident or member of a campaign group;

  • details of any local group or campaign you tell us about;

  • whether you want to be credited by name;

  • what you tell us about the building, your sources and your photos, what you’d like to happen to it and what you think is stopping that, with a record of the photo licence you gave us;

  • whether we may contact you in relation to your submission;

  • anything you tell us about problems with the form;

  • our correspondence with you; and

  • records of how we reviewed your submission.

We don’t publish your name or contact details unless you ask us to.

About buildings

  • the building’s address or location;

  • its type and condition;

  • how long it has been empty, as reported;

  • photos;

  • publicly available planning, heritage and council information;

  • the type of owner, and where that information came from; and

  • records of corrections, owner responses and updates.

About owners

Individual owners. If a building is owned by a private individual or sole trader, we record only the type of owner, as “private individual”.

Companies and public bodies. We may keep the name of a company or public body that owns a building, with its company number, the source and the date we received the information. We don’t keep the names or contact details of directors, staff or officers.

We do not publish the name of individual owners.

About other people

Submissions may mention other people, such as occupiers, neighbours or council staff. We remove this information unless it is relevant to the purposes of CADO, for example to deal with a complaint or to support a campaign to save a building.

Website and technical information

  • IP address;

  • browser and device information;

  • dates and times of access;

  • security and error logs; and

  • cookie-free usage statistics, such as which pages are viewed, that don’t identify you.

Newsletter

If you subscribe, we keep your email address and a record of your consent.

5. Where information comes from

Most of the information we hold is submitted by members of the public or is collected from public data sources. This includes:

  • people who submit buildings or updates;

  • community groups and partner organisations;

  • government, council and other official sources;

  • Companies House and similar public registers;

  • planning, heritage and licensing records;

  • published news reports;

  • websites of owners or relevant organisations; and

  • our own correspondence and review records.

When considering publication, we consider the source, its reliability, any licence terms, people’s reasonable expectations and the effect of publishing.

6. What is public and what stays private

A public entry may show:

  • the building’s name and location (sometimes approximate, to protect privacy);

  • its type and condition;

  • roughly how long it has been empty;

  • why it matters locally;

  • any response from the owner, up to 150 words;

  • photos;

  • the type of owner, such as “company” or “council”;

  • the date we last checked the entry; and

  • the name of the person who submitted it, but only if they asked to be credited.

We never publish:

  • the name of any owner, whether an individual, company or public body;

  • contributors’ names or contact details, unless they ask to be credited;

  • private correspondence addresses (unless connected with a local campaign and a person has asked for the information to be shared);

  • information about anyone’s health, family, finances or personal circumstances;

  • allegations of crime or wrongdoing;

  • information that could identify a vulnerable person;

  • photos showing identifiable people or number plates, unless blurred; or

  • details of how to get into a building.

7. Why we use information, and our lawful bases

What we do, and the lawful basis for it:

  • Receive, review and publish submissions; keep the map accurate; contact you in relation to your submission (for example to check details, hear more about the building and any local action, or ask whether you’d like to get more involved); correct or remove entries; prevent misuse. Legitimate interests: documenting buildings of community concern, supporting community action, and keeping the map accurate and safe.

  • Analyse submissions to publish reports and support media coverage, using anonymised or building-level information. Legitimate interests: informing public debate and policy about empty and neglected buildings.

  • Share ownership information from public records with like-minded partner organisations and with campaigners working on the same building. Legitimate interests, where any personal information is involved at all.

  • Credit you by name on an entry. Consent.

  • Send you CADO news. Consent.

  • Use non-essential cookies, if any. Consent.

  • Meet legal obligations, respond to regulators, and establish or defend legal claims. Legal obligation or legitimate interests.

Before relying on legitimate interests, we check that the purpose is legitimate, that the use is necessary, and that it doesn’t override the rights and interests of the people concerned.

You can withdraw consent at any time by emailing cado@kinship.works.

8. Information about someone else

We design CADO so that we hold as little information as possible about people who have not contacted us.

  • We don’t keep the names of individual owners or sole traders unless directly relevant to CADO’s work helping people to save buildings;

  • We remove information about occupiers, neighbours and other people where not relevant;

  • We don’t keep the names of company directors, staff or council officers.

  • If we receive information we don’t need about anyone’s health, disability, religion, ethnicity, sexual orientation, political views or other sensitive matters, we redact or delete it, normally within 30 days.

We never publish allegations of crime, fraud, threatening behaviour or similar wrongdoing. We isolate, redact or delete such material unless we have a recorded legal reason to keep it, for example to take legal advice or deal with a legal claim.

9. Homes and vulnerable people

CADO doesn’t include residential homes. If a submission turns out to be about a home, we will not publish the information and will delete it.

Where a building may be connected with a vulnerable person, we may show an approximate location, leave out photos or details, delay publication while we check, or decide not to publish. CADO must not be used to help anyone harass, trespass on or make unwanted contact with anyone.

10. Who we share information with

Service providers who run CADO’s systems:

  • Tally: submission and update forms. Data held in the European Union.

  • Airtable: storing and reviewing submissions. United States.

  • Google Workspace: email and documents. United Kingdom, European Union and United States (Google’s data centres).

  • Framer: hosting the website. Amazon Web Services data centres, with pages served from a global network [region to confirm with Framer].

  • Netlify: hosting the map. United States, with pages served from a global network.

  • Mailchimp: sending CADO news. United States.

  • Claude (Anthropic): helping review public records. United States.

  • OpenFreeMap: map tiles (receives your IP address when the map loads). European Union.

Others:

  • volunteers and contractors who help with moderation, under confidentiality agreements;

  • professional advisers, including lawyers and insurers;

  • like-minded partner organisations working to support communities, and campaigners working together to save the same building, who may receive ownership information from public records (such as a company name as shown at Companies House), never your details, and never journalists;

  • research partners, only with anonymised information or under a written agreement;

  • regulators, courts or law enforcement, where the law requires or allows it; and

  • another organisation taking on the CADO project, with appropriate safeguards.

We would only share your details without asking if a court or the law required us to.

We don’t sell or rent personal information. We don’t give contributors’ details or ownership information to developers, buyers or agents.

11. Public information and reuse

Anything published on the map can be seen, copied and indexed by others. We limit published entries to the information needed for our purpose, and our website terms forbid using CADO to harass, target or compile information about people.

Publication on the map doesn’t give anyone permission to use personal information unlawfully. Anyone reusing the data is responsible for complying with data protection law.

We don’t currently release CADO data as open data.

12. International transfers

Some service providers store or access information outside the United Kingdom. Where they do, we rely on UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, or the UK’s International Data Transfer Agreement or addendum. You can ask us for details.

13. How long we keep information

Unless we need to keep something longer for a complaint, a legal claim or a legal obligation:

  • Unpublished or rejected submissions: deleted or anonymised 12 months after our decision or last contact.

  • Names of individual owners, if received: deleted or redacted at review.

  • Unneeded sensitive information and allegations: redacted or deleted within 30 days of review.

  • Evidence behind a published entry: while the entry is live, and up to two years after removal.

  • Your contact details: while needed to maintain the entry, and up to two years after our last contact or the entry’s removal.

  • Records of ownership information shared: three years.

  • Corrections, complaints and owner responses: three years after the matter is closed.

  • Data protection requests: three years after closure.

  • Security and access logs: 90 days.

  • Security incident records: three years.

  • Newsletter: until you unsubscribe, then a minimal record so we don’t contact you again.

  • Backups: overwritten within 90 days.

14. Security

We protect information by:

  • limiting access to the people who need it;

  • keeping private submissions separate from the public map;

  • requiring confidentiality from volunteers and contractors;

  • keeping secure backups; and

  • having a procedure for responding to security incidents, including reporting to the ICO where required.

No online service can be completely secure, and we keep our safeguards under review.

15. Your rights

Depending on the circumstances and for legitimate reasons, you can ask us to:

  • give you a copy of your personal information;

  • correct information that is wrong or incomplete;

  • delete information;

  • restrict how we use information;

  • stop using information, where we rely on legitimate interests; or

  • give you the information you provided in a portable format.

You can withdraw consent at any time where we rely on it.

These rights are not absolute. We may need to keep some information where the law allows or requires it, for example to deal with a legal claim.

When we answer a request, we won’t reveal who submitted a building or anyone else’s personal information.

To use any of these rights, email cado@kinship.works.

16. Correcting or responding to an entry

If you think an entry is inaccurate, out of date or unfair, or want to respond on behalf of an owner, use “Suggest an update” on the entry or email cado@kinship.works.

We’ll look at significant concerns quickly, and may hide an entry while we check, depending on the circumstances.

17. Data protection complaints

To make a data protection complaint, email cado@kinship.works. We will:

  • acknowledge your complaint within 30 days;

  • investigate your complaint;

  • keep you informed if it takes longer than expected; and

  • tell you the outcome without undue delay.

You can also complain to the Information Commissioner’s Office. We’d welcome the chance to put things right first, but you don’t have to contact us before going to the ICO.

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Telephone 0303 123 1113. ico.org.uk/make-a-complaint

18. Cookies, analytics and maps

We only use cookies that are needed to run and secure the website. Our analytics don’t use cookies.

When the website loads the map, our map provider receives technical information such as your IP address. Section 10 lists the providers we use and what they receive.

19. Children

CADO is not designed for children under 16. Children shouldn’t submit information without help from a parent, guardian, teacher or responsible organisation. If we find we’ve received unnecessary information about a child, we’ll delete it.

20. Automated decisions

We don’t use automated decision-making to decide whether a building is published. We may use technical tools to detect spam, security threats or duplicate submissions, and to help review public records, but a person checks all publications.

21. Changes to this notice

We’ll update this notice when CADO’s activities, service providers or legal obligations change, and show the date of the latest version at the top. If a change significantly affects how we use your information, we’ll take reasonable steps to tell you.

22. Contact us

Questions, requests and complaints: cado@kinship.works, or CADO, Kinship Works, 86-90 Paul Street, London EC2A 4NE.