This notice explains what personal information the Pathzero platform collects, why, who can see it, how long it is kept and the rights you have over it. Pathzero is a members-only net zero accreditation platform run by Cheltenham Zero in partnership with Cheltenham Borough Council.
Who we are
The data controller for Pathzero is Cheltenham Borough Council, Municipal Offices, Promenade, Cheltenham, GL50 9SA. You can contact us about your personal information at cheltzero@cheltenham.gov.uk. Our data protection officer can be contacted at data.protection@cheltenham.gov.uk. Our Information Commissioner’s Office registration number is Z7700989.
The short version
- We only collect what we need to run your membership and accreditation journey.
- Everything on the platform, including your submissions, documents and training materials, is only available to signed-in members and the staff who run the programme.
- We do not use advertising or analytics cookies, and we do not sell or share your information for marketing.
- You can download a copy of your data or delete your account yourself from your Settings page at any time.
What we collect
| Type of information | What it includes | Where it comes from |
|---|---|---|
| Account details | Your first and last name, email address, business name and password. Your password is stored as a one-way scrambled value, so nobody, including our staff, can read it. | You, when you register |
| Profile | Job title, phone number, location, business address and an optional profile photo. We remove hidden location data (such as GPS coordinates) from photos when you upload them. | You, during onboarding or in Settings |
| Journey submissions | Declarations you sign (the name you type and the date), quiz answers and scores, answers to data forms (for example your emissions target years), documents you upload (PDF or Word), confirmation that you have watched training videos or completed external steps, and your accreditation tier. | You, as you complete tasks |
| Team details | Which business team you belong to and your role in it. If a colleague invites you, the name and email address they enter, who sent the invitation and when. | You, your colleagues, or programme staff |
| Review decisions | Whether a submission was approved or rejected, any note from the reviewer, and the date. | Programme staff |
| Consent record | The date and time you agreed to this notice and which version it was. | Recorded automatically when you register |
| Activity and security records | A log of actions on your account (such as signing in, submitting a task or a review decision) with the date and time. For security events, such as failed sign-ins, we also store a one-way scrambled version of your IP address, which cannot be turned back into the address. | Recorded automatically |
| Technical information | Your IP address and browser details are processed by our hosting and security providers to deliver the website and protect it from attacks. | Your device |
How we use it and why
| Purpose | Lawful basis under UK GDPR |
|---|---|
| Creating and managing your account, running the accreditation journey, reviewing your submissions and awarding tiers | Consent (Article 6(1)(a)). You can withdraw your consent at any time by deleting your account. |
| Sending you service emails, such as email verification, account approval and account deletion confirmations | Consent (Article 6(1)(a)) |
| Keeping the platform and your account secure: sign-in protection, two-factor authentication for staff, and the activity log | Legitimate interests (Article 6(1)(f)) and our duty to keep personal data secure (Article 32) |
Quizzes are marked automatically so you can see your result straight away, but decisions about your accreditation are confirmed by a member of staff. We do not use your information for marketing, and we do not make decisions about you using automated profiling.
Who can see your information
- You and your team: everyone in your business team shares one accreditation journey, so team members can see each other’s names, email addresses, submissions and documents for that journey.
- Programme staff (reviewers and administrators): to approve members, review submissions and support you. Staff accounts must use two-factor authentication, and every document a member of staff downloads is recorded.
- Our service providers, who process data only on our instructions:
- Website hosting, content delivery and email delivery: 20i (servers in the United Kingdom)
- Website security (firewall, sign-in protection and two-factor authentication): Wordfence, provided by Defiant Inc. (United States)
- Anyone else only where the law requires it, for example a court order.
Where a provider is based outside the UK (for example Wordfence in the United States), the transfer is protected by the provider’s data processing agreement, which uses standard contractual clauses with the UK International Data Transfer Addendum.
How long we keep it
| Information | How long |
|---|---|
| Account, profile, submissions and documents | Until you delete your account. If you do not sign in for a year, we email you a warning and delete the account 30 days later unless you sign in. |
| After you ask to delete your account | Kept for 7 days so you can change your mind, then permanently deleted. This includes your profile, photo, submissions and uploaded documents. If you are part of a team, work you submitted for the shared journey stays with the team. |
| Team invitations | Expire after 7 days if not accepted |
| Activity log | 24 months. If your account is deleted, the entries are kept only in anonymous form, with no link to you. |
| Security records (sign-ins, failed sign-ins, blocked attempts) | 90 days |
| Email verification links | Expire after 24 hours |
| Backups | Kept securely by our hosting provider and overwritten after 1 month, so deleted information is removed from backups within a month |
Your rights
Under UK data protection law you have the right to:
- Get a copy of your data: go to Settings → Your data → Download my data for an instant copy in a standard, machine-readable format (JSON).
- Correct it: update your details in Settings at any time.
- Have it deleted: use Settings → Delete my account. Your account is deleted after 7 days, and you can cancel before then.
- Restrict or object to how we use your information.
- Take it elsewhere (data portability): use the download above.
To use any of these rights, or if you have a question, contact us at cheltzero@cheltenham.gov.uk. We will reply within one month. If you are unhappy with how we have handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or by calling 0303 123 1113.
Cookies
We only use cookies that are needed for the platform to work, so we do not ask for cookie consent. We do not use analytics, advertising or tracking cookies.
| Cookie | Why it is used | How long it lasts |
|---|---|---|
wordpress_logged_in_…, wordpress_sec_… | Keep you signed in securely | 8 hours for members, 2 hours for staff |
wordpress_test_cookie | Checks your browser accepts cookies when you sign in | Until you close your browser |
wfwaf-authcookie-… (Wordfence) | Lets the website firewall recognise signed-in users | 12 hours |
wf_loginalerted_… (Wordfence) | Staff only: recognises a device so administrators are alerted to sign-ins from new devices | 1 year |
How we protect your information
- All connections use HTTPS encryption.
- Passwords are stored as one-way scrambled values and are never visible to anyone.
- Uploaded documents are kept in private storage that only you and programme staff can open, and every staff download is recorded.
- The whole platform, including training materials, is only available to signed-in, approved members.
- Staff accounts must use two-factor authentication, and repeated failed sign-ins are blocked automatically.
Children
Pathzero is a service for businesses and organisations and is not intended for anyone under 18.
Changes to this notice
This is version 2.0 of this notice. If we make important changes, we will tell members by email or with a notice when you sign in. The date at the top of this page shows when it was last updated.