How we handle your register
The electoral register is the most sensitive thing you will put into Cadrify. This page sets out what happens to it: where it goes, who can see it, how long we keep it and how you get it back or delete it.
What the electoral register is
The electoral register is the list of everyone registered to vote in an area. Your local council’s electoral registration officer compiles it, republishes it in full once a year and issues updates in between.
There are two versions of it, and they are not interchangeable.
The full register
Every registered elector, with name and address, plus the polling district, register number and elector markers a campaign works from. It is not on public sale. It may be supplied only to the people and bodies named in law, and used only for the purposes named in law. Candidates and their election agents at an election, and registered political parties, are among those entitled to a copy.
The open register
An extract of the full register that leaves out every elector who has asked to be left out. Anyone may buy it and use it for any purpose, including commercial marketing. A large share of electors opt out, so it is an incomplete picture of an area. Opting out has no effect on a person’s right to vote.
Cadrify is built for the full register, the copy supplied to a candidate, an election agent or a registered political party under the Representation of the People Act 1983 and the regulations made under it. That is the copy that carries the polling districts and register numbers rounds are built from.
If you are not entitled to the full register, do not upload it
Entitlement is decided by law and by who your organisation is, not by what your Cadrify account allows. A community campaign or a charity that is not a candidate, an election agent or a registered party is not entitled to the full register. Cadrify still works for you: use the open register, your own membership and supporter lists or the records you collect at the door yourself.
The rules differ across Britain and Northern Ireland. Scotland has its own regulations covering supply and use. In Northern Ireland the register is held by the Chief Electoral Officer for Northern Ireland rather than by councils, and there is no open register at all.
What you may and may not do with it
One rule governs everything else. The register supplied to you for electoral purposes may be used for electoral purposes only.
You may:
- Identify and contact electors about elections, candidates and the democratic process
- Build door-knocking rounds, walk sheets and knock-up lists from it
- Check the register when you canvass, telephone or write to electors
- Record what an elector tells you at the door against their register entry
- Use it to prepare nomination papers and check that subscribers are registered in the right area
- Keep it for as long as you remain entitled to hold it
You may not:
- Use it for a commercial purpose of any kind, or to build a marketing list
- Sell it, rent it, publish it or post any part of it in public
- Pass it to another organisation, including a friendly one, another party, a supplier or a consultant, unless that organisation is entitled to it in its own right
- Use it for anything unconnected with elections and the democratic process
Supplying or using the full register outside the permitted purposes is a criminal offence under the electoral regulations, punishable by a fine. That duty sits alongside your obligations under the UK GDPR and the Data Protection Act 2018. It does not replace them.
Cadrify cannot make this judgement for you. Your organisation is the data controller. You decide what you are entitled to hold and what you may do with it. We process it on your instructions and on nothing else.
What happens when you upload a register file
The import runs in six steps.
- You upload the file. It travels over an encrypted connection (HTTPS). It is never written to a public folder and never given a guessable web address.
- Cadrify reads it in memory. The file is parsed from its raw bytes inside the application. Nothing is left on disk for anyone to find.
- You confirm the columns. You say which column holds the surname, which holds the register number, which holds the polling district. While you do that the parsed rows are held as a compressed draft in the database, stamped with your organisation’s id. A draft you abandon is cleared automatically after 30 days.
- Cadrify matches the rows to electors you already hold. Registers rarely arrive clean: people move, change name or get a new register number when the register is reissued. Cadrify compares surname, forename, date of birth, postcode, address and register number, and scores each pair. Confident matches are linked automatically. Borderline matches go to a review queue for someone in your campaign to decide. Everything else becomes a new elector.
- You commit the import. The rows are written into your organisation’s own elector records. Every row carries your organisation’s id.
- The draft is cleared.
The import itself is recorded: the file name, who uploaded it, when, the register date it covers, the ward or district it covers and how many electors were matched, created and marked as no longer registered.
An elector on your previous register who is absent from the new one is marked as no longer registered rather than deleted, so your record of contact with them survives a reissue.
Your file is yours
It is not pooled with another organisation’s data, not aggregated into a shared dataset, not sold and not used to train anything. There is no national elector database sitting behind Cadrify. Every organisation’s register is its own.
One organisation can never see another’s electors
Every table holding elector data carries an organisation id, and the check on it runs in two independent places.
In the application
Every query filters by the organisation of the signed-in account, resolved from the session rather than from anything the browser sends.
In the database
PostgreSQL row-level security is switched on for every table that carries an organisation id, and forced, so it applies even to the database account that owns those tables. Each transaction declares which organisation it is acting for before it reads anything. A row comes back only when its organisation id matches.
The second layer is the one that matters. Application filters are written by people, and a line can be missed. The database rule is not something a forgotten line of code can slip past, and it fails closed: a connection that declares no organisation sees no rows at all, rather than seeing everyone’s.
Deleting an organisation cascades. Its electors, addresses, door-knock records, imports, marked register entries and voting history are removed with it.
Who inside your campaign can see what
Cadrify does not hand everyone in your organisation the whole register.
Your organisation is a tree of branches. A branch might be a local party, a constituency, a region or a single campaign team. Each branch is assigned the wards or constituencies it works. Those are matched by GSS code rather than by name, because British ward names collide across council areas and matching on the name alone would hand a branch the wrong ward.
Two rules run in opposite directions along that tree, and together they decide what a person sees.
- Roles inherit downward. A role granted at a branch applies to that branch and to every branch beneath it. A regional organiser covers the branches below them.
- Geography aggregates upward. A branch’s geography is what it holds directly plus everything held by the branches beneath it. A branch never picks up geography that belongs only to a branch above it.
| Role | What it reaches |
|---|---|
| Admin | The organisation and every branch beneath their own, including settings, people and the full register within their geography. |
| Organiser | Electors, rounds and people within their own branch and the branches beneath it. Nothing outside that geography. |
| Data protection officer | The audit trail and the tools for handling data rights requests. |
| Door-knocker | Only the doors on the round they have been given. |
A door-knocker out on a round sees the addresses and electors on that round and nothing else. They cannot search the register, open another round or export anything. Round access is time-limited, and an organiser can withdraw it at any point. When the round expires the access expires with it.
Every export of elector data is written to an audit trail: who exported, what, how many rows and when. Your admins and your data protection officer can read that trail in the compliance area and download it as CSV.
What Cadrify staff can and cannot see
A small number of Cadrify platform accounts can reach customer data where support or incident response requires it. The constraints on that access:
- Access is limited to a small number of named platform accounts, not to everyone who works at Cadrify.
- Every access is written to a separate operator access log recording the account, the action, the organisation and the timestamp. The person doing the access cannot edit or delete that record through the application.
- Access to an organisation outside normal support hours is treated as a security anomaly and reviewed.
- We do not use your register for analytics, benchmarking, product research or model training.
- Our email provider never receives elector or door-knock data. It carries password resets, invitations and notifications only.
- No elector or door-knock data goes to an external CRM unless your organisation connects one itself with its own account. Even then only supporter and volunteer contact details sync. Register and door-knock records never do.
Two things we cannot do:
- We cannot read your password. Passwords are stored as one-way scrypt hashes, so there is nothing to read.
- We cannot recover data you have deleted once it has passed out of the backup retention window.
If you need a written statement of which Cadrify accounts reached your organisation and when, ask support@cadrify.org and we will produce it from the operator access log.
The marked register
After an election the returning officer keeps the marked copy of the register, the copy the polling clerks worked from, with a mark against every elector who was issued a ballot paper. The postal voters list is marked in the same way.
It records that a person voted, never how
The marked register carries no information about which candidate or party anyone chose. Nobody can read that from it, the returning officer included. The secrecy of the ballot is untouched.
Campaigns entitled to the full register may obtain a copy of the marked register after an election, usually on payment of a fee, and may use it for the same restricted electoral purposes.
In Cadrify a marked register is imported against one named ballot. Each entry links one elector to that ballot and records whether they voted and by which method: in person, by post or by proxy. Those entries build each elector’s voting history, which is what turnout targeting and knock-up lists are drawn from.
You can supply it as a data file where the council provides one, or as scans of the paper copy, which Cadrify digitises page by page. Either way it lands in your organisation’s own records under the same isolation rules as the rest of your register.
Voting intention is special category data
When a door-knocker records that an elector is a strong supporter, or which party they lean towards, that is a record of the elector’s political opinion. Political opinions are special category data under Article 9 of the UK GDPR. They carry a higher bar than a name and an address.
Cadrify records support on a 1 to 5 score: 1 strong supporter, 2 leaning supporter, 3 undecided, 4 leaning opponent, 5 strong opponent. It can also hold a core party and a small set of political flags.
What that means for you in practice:
- You need a lawful basis under Article 6 and, on top of it, a condition under Article 9. Registered political parties and certain not-for-profit bodies with a political aim usually rely on Article 9(2)(d) for their own members and people in regular contact with them. Other campaigns generally need a different route, most often explicit consent.
- Where you rely on a Schedule 1 condition under the Data Protection Act 2018, you need an appropriate policy document in place before you start.
- A score is an estimate made by a volunteer on a doorstep in a few seconds. It is not something the elector has confirmed and it should be treated as an impression, not a fact.
- An elector can ask you what you hold about them. Cadrify assembles that for you. See How to get everything out.
Cadrify holds this data in the same isolated, row-level-secured tables as the rest of your elector records, and audits every export of it. What Cadrify cannot do is choose your lawful basis. That decision is yours as controller, and you should write it down.
How long we keep it
Your register data stays for as long as your organisation has an account, because holding it is what the product is for. Everything else has a stated limit.
| What | How long |
|---|---|
| Your elector, door-knock and marked register records | For the life of the account, then 30 days after it closes |
| Abandoned import drafts | 30 days, then cleared automatically |
| Elector records you erase | Name and date of birth erased at once, door-knock logs and change history deleted. Copies age out of encrypted backups within the backup retention window |
| Authentication and account log | Minimum 12 months |
| Organisation audit log | Minimum 12 months |
| Operator access log | Life of the platform |
| Application server logs | 30 days |
| Billing records | 7 years, a statutory requirement |
At the end of a trial
A trial runs for 30 days. If you decide not to continue, the account closes and the data is deleted after the 30-day window that follows. Export anything you want to keep before then. Nothing is charged.
If you leave
The same 30-day window applies. Ask us to delete sooner and we will, and we confirm in writing when it is done.
Cadrify does not yet let an organisation set its own automatic retention period for elector data. That is planned and not built. Until it ships, deletion is something you do yourself or ask us to do.
Retention is your decision. If you no longer have a lawful reason to hold an elector’s record, delete it. Cadrify provides the tools and your organisation makes the judgement.
How to get everything out
Your data leaves in open formats. There is no exit fee.
- Elector and door-knock exports as CSV or XLSX, from the register, from a filter or from a saved segment. Every download is audited.
- Round and walk sheet PDFs for anything already generated.
- One elector’s whole file, for a subject access request. Cadrify assembles the register entry, the address, the voting history, every door-knock log and the full change history as structured data you can hand over.
- The audit trail as CSV, available to admins and to your data protection officer.
- A scheduled pull into your own systems through the secure export API, where your organisation wants one.
If you want a complete copy of everything your organisation holds and cannot assemble it yourself, email support@cadrify.org and we will produce it.
How to delete everything
Deletion works at three levels.
One elector
An erasure request is raised against the elector and tracked in the compliance area. On approval the name and date of birth are erased from the record, and the elector’s door-knock logs, change history and audit snapshots are deleted. The stripped record stays in place, so ward and round counts do not change. A copy can persist in an encrypted backup until that backup ages out of its retention window.
One import
An import loaded in error can be reversed. Email support@cadrify.org with the import reference and we will take it out.
Everything
Closing your organisation cascades through every table that holds your data: electors, addresses, door-knock logs, imports, marked register entries, voting history, rounds and activists. The rows are deleted, not hidden behind a flag.
Backups
Encrypted backups exist so a mistake can be undone. A deleted row can persist in a backup until that backup ages out of its retention window. Nothing is restored from a backup without an incident and a record of it.
To have your organisation and all its data deleted, email support@cadrify.org from an admin address. We confirm what will go before we act, and confirm again once it is done.
Who to contact
| What you need | Where to write |
|---|---|
| Questions about this page or about how your register is handled | support@cadrify.org |
| Data protection, subject access requests, erasure | privacy@cadrify.org |
| A security concern or a suspected breach | security@cadrify.org |
| Procurement paperwork, a signed data processing agreement | sales@cadrify.org |
Related documents: Privacy policy · Security · Security whitepaper · Data processing agreement
Cadrify Ltd, company number 17244539, registered in England and Wales. ICO registration ZC158949. Registered address 7 Malvern Road, Hornchurch, Essex, RM11 1BG.
This page explains how Cadrify works. It is not legal advice. If you are unsure whether your organisation is entitled to hold the full register, ask your electoral registration officer or your own solicitor before you upload anything.