Introduction
Derros Ltd is a company registered in Jersey (company number 159837) and acts as a controller under the Data Protection (Jersey) Law 2018. This notice explains what personal information we collect about you, why we collect it, how we use and share it, and the rights you have over it.
Information may be collected through our website forms, by email, by telephone, or in person at meetings and events. We review this notice regularly and update it to reflect changes in our services and the law.
What information we collect about you
Depending on how you interact with us, we may collect the following types of information about you:
- name
- email address
- organisation and role (optional)
- telephone number (optional)
- the content of messages you send us through our contact form or by email
- responses to surveys, polls and feedback forms you choose to complete
- IP address, browser type, device information and approximate location, recorded automatically when you visit our website
- access credentials for any password-protected area of the site you have been invited to use
We do not ask you to share special category data about yourself (such as your own health, political views or religious beliefs) through our contact forms, newsletter sign-up or general correspondence, and you should not send us that kind of information unless we have specifically asked for it and explained why. Our impact assessments and the Trellis platform do work with sensitive impact themes such as health and wellbeing, but only as aggregated, anonymised statistics. We explain how this works in Special category and sensitive data below.
Information we collect through our impact assessments
When you or your organisation takes part in a Derros impact assessment (for example our Economic, Social & Environmental Impact Assessment) we collect information about the organisation you are representing as well as about you personally. Most of this information is organisational rather than personal, but some of it can be linked back to individuals.
Depending on which sections of the assessment apply to you, we may ask for:
- About the organisation - legal name, legal form (charity, non-profit, social enterprise, CIC, provider, international branch and so on), registration status, primary and secondary sectors of activity, geography, the countries you operate in, and a short description of what you do
- Your role in the organisation - role type (governor or trustee, chief executive, manager, administrator, clinician, health or care practitioner, or other), and name and contact details if you are happy to be contacted about your answers
- Activities and beneficiaries - the activities you carry out, who benefits, whether services are free or paid, whether work is delivered on behalf of a government body, and how your work is funded
- Financial data - total income, income by source (gifts and donations, earned income from trading, investment income, grants, subscriptions, long-term contracts, contributions in kind, other), total expenditure, staff costs, free reserves, borrowing, and the number of years of financial data you can provide
- Employment, skills and volunteering data - paid and unpaid headcount (primary location and overseas), full-time equivalents, total volunteer hours, and the proportion of time spent by different categories of staff and volunteers (managers, professional, associate professional and technical, administrative, skilled trades, caring, sales, process and machine operatives, and so on)
- Assumptions and free-text commentary you add to explain your figures
We treat financial figures, headcount data and other operational information that could identify an organisation as confidential. We only publish this information in a form that identifies you or your organisation if you have given us permission to do so. Aggregated, anonymised and benchmarking outputs may be shared more widely (for example, in reports or on the Derros platform) but are designed so that individual organisations and individuals cannot be identified from them.
Where volunteer or employee headcount figures involve identifiable individuals (for example, when you list named staff or contacts), those individuals are also data subjects under this policy and the same rights apply.
Information we collect through our Consultations
We do not require personal information to take part in our consultations, and you can respond without giving any. Where we ask for personal information it is always optional, for example a name and email address if you would like us to follow up. Any personal information you choose to provide will be processed in line with this privacy policy, specifically:
- personal information that you provide in a free text box
- your name and email address for follow-up
- your email address to subscribe to the Derros newsletter
Special category and sensitive data
Some of the impact themes our work measures are sensitive in nature. Our impact framework and the Trellis platform cover areas such as health, care and protection (including physical health, mental health and wellbeing, and healthy behaviours), safety, justice and rights, and basic needs and living standards. Under the Data Protection (Jersey) Law 2018, information about a person's health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric data, sex life or sexual orientation is special category data, and information about criminal offences is treated as similarly sensitive.
The way our method works, we capture these themes as aggregated, anonymised statistics about groups of people, not as records about identifiable individuals. For example, an organisation might tell us how many people improved on a validated wellbeing scale, or how many people accessed a care service, without naming anyone. Figures like these describe a cohort, not a person, and are not intended to identify or be linked back to any individual.
Because of this, we do not knowingly collect special category data about identifiable individuals through our assessments or the platform. We ask the organisations who supply impact data to provide it in aggregated, de-identified form and not to include information that identifies the individuals it relates to. Where an organisation holds the underlying personal data about its own beneficiaries, that organisation remains the controller for that data and is responsible for having its own lawful basis and, where relevant, the additional condition required to process special category data before it shares any results with us.
If we ever needed to process special category data about identifiable individuals for a specific piece of work, we would only do so where the law allows it (for example, with explicit consent or another condition recognised under the Data Protection (Jersey) Law 2018), and we would explain the purpose and the safeguards to you first. Please do not enter health, beliefs, criminal-history or other special category information about identifiable people into free-text boxes in our assessments, surveys or consultations.
Why we collect information about you
We collect and hold information about you in order to:
- respond to your enquiry and provide information you have asked for
- carry out the work or services you have engaged us to deliver
- complete the impact assessment you or your organisation has started and share the results back with you
- produce aggregated and anonymised benchmarks, insights and research outputs that help other organisations make better decisions
- send you our newsletter or other updates if you have subscribed
- give you access to private or password-protected content we have prepared for you
- understand how our website is used and improve it
- keep records required for tax, accounting, legal and regulatory purposes
- protect our website and services from fraud, abuse and technical attack
Our lawful bases for processing are your consent (for example, when you subscribe to the newsletter), the performance of a contract with you, our legitimate interests in running our business, and compliance with legal obligations.
How we use your information and who we share it with
Protecting your privacy matters to us. We maintain appropriate policies and safeguards to protect your information from loss, misuse or unauthorised access. Where necessary we use encryption, both in transit and at rest. We will use the information you provide in a manner that conforms to the Data Protection (Jersey) Law 2018.
We may not be able to provide you with a service unless we have enough information, or your permission to use that information.
We work with a small number of trusted suppliers who process information on our behalf, such as our hosting, email, analytics, error-monitoring and AI providers, together with our accounting platform for invoicing and billing records. They are contractually required to protect your personal data and use it only for the purposes we specify. The full list is set out in the Third-party processors section below, along with where each is based and the safeguards we rely on for any transfers outside Jersey, the United Kingdom and the European Economic Area.
We will not disclose information you have given us in confidence to anyone else without your permission, except in the limited situations where disclosure is required by law or where we have good reason to believe that not sharing the information would put someone at risk. Where possible we will tell you before we do so.
We will not pass your information to other organisations for marketing or sales purposes, or for any commercial use, without your prior express consent.
Your rights as a data subject
Under the Data Protection (Jersey) Law 2018 you have a number of rights in relation to the personal information we hold about you. You can:
- ask us what information we hold about you and request a copy of it
- ask us to correct information that is inaccurate or incomplete
- ask us to delete information where it is no longer needed or where you withdraw consent
- ask us to restrict how we use your information while a concern is resolved
- object to us using your information where we rely on our legitimate interests
- ask us to transfer the information you have given us to another organisation
- withdraw consent at any time where we rely on consent to process your information
- unsubscribe from our newsletter at any time using the link at the bottom of every email
To exercise any of these rights, please contact us using the details at the end of this notice. If you are not satisfied with our response, you can raise a concern with the Jersey Office of the Information Commissioner at jerseyoic.org.
How long we keep your information
We keep your information only for as long as we need it for the purpose we collected it, or for as long as the law requires. In practice this means:
- newsletter subscribers - until you unsubscribe
- contact form and email enquiries - typically up to two years after our last contact, unless a longer period is needed for an ongoing engagement
- client records - for the duration of the engagement and for the period required by Jersey tax and accounting rules afterwards
- website logs and analytics - for a short rolling window, typically no more than 12 months
We will ask you to confirm your information is still correct from time to time and will delete anything we no longer need.
Where we host your information
This website, derros.com, is served by Cloudflare. Messages sent through our contact form, and answers to our surveys and consultations, are stored in Cloudflare's database service.
The Trellis platform runs on servers we rent from Hetzner, in Hetzner's data centre park in Helsinki, Finland. The application, its database and its search index all run there, so the information you enter into Trellis is stored and processed inside the European Union. Documents uploaded to Trellis, and encrypted backups of its database, are kept in Cloudflare's storage service in its EU region. Cloudflare also sits in front of the platform to filter out malicious traffic, and the connection between Cloudflare and our servers is encrypted.
Hetzner is a German company, and its Finnish data centre is operated by its subsidiary Hetzner Finland Oy. Both are subject to the EU General Data Protection Regulation. Germany is widely regarded as having some of the strictest data protection rules in the EU, adding its own national law and active regulators on top of the GDPR, and Hetzner's German parent company works under that regime. Jersey's data protection law treats EU and EEA countries as giving personal information an adequate level of protection, so keeping Trellis data in Finland needs no additional transfer safeguards.
Hetzner's security credentials
- Hetzner's information security management system is certified to ISO/IEC 27001:2022, the international standard for information security. The certificate covers the infrastructure, operation and customer support of its data centre parks in Nuremberg, Falkenstein and Helsinki, and an independent body, SOCOTEC Certification, audits it regularly.
- Hetzner's data centre parks are enclosed by a high-security perimeter fence under video monitoring. Entry is through electronic access control, video surveillance covers the relevant areas around the clock, and qualified staff are on duty 24 hours a day.
- Power is protected by redundant UPS systems, a backup power supply for long outages and a redundant connection to the substation. Fires are caught by early-warning detection and automatic alarms, and the cooling has N+2 redundancy.
You can read more on Hetzner's certification page.
Third-party processors
We work with a small number of trusted suppliers who process information on our behalf. Each is bound by a contract that requires them to protect your personal data and use it only for the purposes we specify. Some are based outside Jersey, the United Kingdom and the European Economic Area; where that is the case we rely on appropriate safeguards (such as standard contractual clauses or equivalent mechanisms) to protect your information during the transfer.
| Processor | What it does for us | Location |
|---|---|---|
| Hetzner Online GmbH / Hetzner Finland Oy | Runs the servers behind the Trellis platform, including its database, in Hetzner's data centre in Helsinki. See Where we host your information above. | Finland (EU) |
| Cloudflare, Inc. | Hosts this website, including the storage behind our contact form, surveys and consultations. Sits in front of the Trellis platform to provide security and bot management, and stores documents uploaded to Trellis and our encrypted database backups in its EU storage region. | Global network; storage in the EU |
| Blue Flame Digital Solutions Limited | Our development partner. Builds and maintains this website and the Trellis platform and may access data in the course of support and maintenance. | Jersey |
| Google LLC | Provides Google Analytics (website usage measurement), Google Workspace (our email, calendar and document storage), embedded YouTube video, and the maps shown in Trellis. | USA / global |
| Postmark (Wildbit / ActiveCampaign) | Delivers transactional and notification emails sent from our services, including the Trellis platform. | USA |
| Anthropic, PBC | Provides the Claude AI models behind some Trellis features, such as the automatic summaries of documents uploaded to a project. Under Anthropic's commercial terms, content we send is not used to train its models. | USA |
| Functional Software, Inc. (Sentry) | Records errors in the Trellis platform so we can find and fix them. It is set up not to collect personal information such as IP addresses, although an error report can occasionally include data from the request that failed. | USA |
If your organisation uses Trellis, the terms on which we process its data, and the list of sub-processors that applies to it, are in our Data Processing Agreement.
We may add or change processors from time to time as our services evolve, and will update this list when we do. We will not pass your information to other organisations for marketing or sales purposes, or for any other commercial use, without your prior express consent.
Links to other websites
Links on our site may take you to other websites that are not under our control. Following those links does not mean that those organisations can access information we hold about you.
This policy covers the Derros website and the Trellis platform. Websites linked to from this site are covered by their own privacy policies and we are not responsible for their content.
Changes to this policy
We may revise this privacy notice from time to time without prior notice, so please check it when you next visit. The date at the bottom of this page shows when it was last updated. Continued use of the site after a change is made constitutes acceptance of the revised notice.
How to contact us
If you have any questions about this notice, would like to exercise any of your rights, or want to raise a concern about how we are handling your information, please get in touch:
- Email: hello@derros.com
Last updated: 18 September 2026