Policies > Privacy & Data Protection

Last update: 29 July 2026

1. Overview

This Privacy & Data Protection Policy explains how FairSay Ltd processes personal data when providing the JustPost platform and related services.

JustPost is operated by FairSay Ltd, a company registered in England and Wales under company number 5244802.

FairSay processes personal data in accordance with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR) where applicable, and the Swiss Federal Act on Data Protection (FADP). We apply data protection principles designed to provide appropriate safeguards for individuals whose personal data we process.

You can contact us regarding privacy and data protection matters at:

Email: support@JustPost.pro

Postal address: FairSay Ltd, c/o Impact Hub London Euston, 1 Triton Square, London, NW1 3DX, United Kingdom

This policy explains:

what personal data is processed;
how personal data is protected;
the roles and responsibilities of FairSay Ltd and organisations using JustPost;
how personal data rights and security matters are handled.

2. Data Controller and Data Processor roles

JustPost operates primarily as a business-to-business platform enabling organisations to create supporter engagement campaigns.

The role FairSay Ltd performs depends on how JustPost is used.

When acting as Data Processor, FairSay Ltd processes customer personal data only on documented instructions from the relevant Data Controller except where required by law.

2.1 JustPost customers using their own campaigns

Where an organisation creates and manages its own JustPost campaign:

the organisation acts as the Data Controller;
FairSay Ltd acts as the Data Processor.

The organisation determines:

the purpose of the campaign;
the lawful basis for processing;
the information collected;
campaign content and recipients.

FairSay Ltd processes personal data only on documented instructions from the Data Controller.

FairSay Ltd will provide reasonable information and assistance to support customer audits and compliance enquiries relating to services provided through JustPost.

FairSay will provide reasonable assistance where customers receive enquiries from supervisory authorities concerning processing undertaken through JustPost.

2.2 FairSay-operated campaigns

Where FairSay Ltd creates and operates its own campaigns or supporter engagement activities, FairSay Ltd acts as the Data Controller.

In these circumstances, FairSay determines the purposes and means of processing and provides appropriate privacy information for those activities.

3. Personal data processed

The JustPost platform may process the following categories of personal data depending on campaign configuration:

3.1 Customer organisation users

Information relating to people authorised to manage JustPost accounts, including:

name;
email address;
role or permissions;
authentication information;
account activity information.

Customers are responsible for identifying authorised users requiring access to supporter information. Individual user accounts must be used and login credentials may not be shared. Data controllers will inform JustPost if staff leave.

Authorised users are responsible for keeping updated their web browsers, operating system security updates, security software and their email secure and private. Any login and API access credentials must also be kept secure and private.

3.2 Supporters and campaign participants

Information submitted by individuals participating in campaigns, including:

name;
email address;
postal address;
telephone number where requested;
messages submitted;
images submitted;
campaign participation information;
consent information where applicable;
technical information such as IP addresses and timestamps.

3.3 Recipient information

Campaign recipients may include individuals or organisations receiving printed communications.

Recipient information is generally:

publicly available reference information; or
supplied directly by the customer organisation.

3.4 Payment transaction information

JustPost stores payment transaction metadata such as:

transaction identifiers;
payment status;
amount;
currency;
related campaign/customer information.

Payment card details are processed directly by payment providers and are not stored or accessible by JustPost.

4. Special Category personal data

Depending on the nature and purpose of a campaign, JustPost may process information which could reveal:

political opinions;
political engagement;
activism;
or other special category personal data.

For example, participation in certain campaigns may reveal an individual's views or affiliations.

Where customers operate campaigns involving special category personal data, customers are responsible for ensuring that they have:

an appropriate lawful basis;
an applicable condition for processing special category data where required;
appropriate privacy information and safeguards.

FairSay Ltd processes such information only according to customer instructions when acting as a Data Processor.

5. How personal data is used

Personal data processed through JustPost may be used to:

provide the JustPost platform;
create and manage campaigns;
collect supporter participation;
moderate campaign submissions where configured;
prepare printed communications;
arrange printing and postal fulfilment;
provide reporting and data exports;
provide customer support;
maintain platform security and reliability.

FairSay will make optional AI-assisted features available to support moderation, translation, accessibility and platform functionality.

Where such features are made available, their use will be optional and controlled by the relevant campaign organiser or customer. Customers remain responsible for deciding whether these features are appropriate for their activities, ensuring they meet their own data protection obligations, and providing any required information to participants.

6. Moderation and automated decision-making

Where enabled by a customer, JustPost may provide moderation workflows for reviewing supporter submissions before printing or publication.

Moderation is currently performed by authorised human reviewers authorised by the organiser.

JustPost does not currently use automated decision-making or profiling of individuals within the meaning of Article 22 UK GDPR.

Future optional AI-assisted moderation features, if introduced, will be subject to appropriate review and customer configuration.

7. Data sharing and subprocessors

FairSay Ltd uses carefully selected service providers to operate JustPost.

These providers may process personal data only where necessary to provide agreed services.

Current categories of subprocessors include:

Managed database services
Application hosting
International and localisation
Backend API and script processing
Storage and content delivery
Transactional email delivery
Privacy-focused analytics
Printers
Postal services

Subprocessors are assessed for their data protection and security commitments.

A current list of subprocessors is maintained in JustPost's security and compliance documentation.

Where applicable, customers will be informed of material changes to subprocessors in accordance with contractual arrangements.

8. Printing and postal fulfilment

JustPost enables customers to create printed communications.

Printing partners may receive:

recipient name;
postal address;
postcard or letter content;
images;
information required for production.

Printing partners do not receive supporter email addresses.

Postal operators receive physical printed materials only and are not provided with additional electronic supporter information.

9. Data storage and international transfers

Customer personal data is primarily processed within European Union data centres.

Where personal data is processed in connection with users, customers or participants in Switzerland, FairSay applies safeguards consistent with applicable Swiss data protection requirements.

FairSay Ltd does not intentionally transfer customer personal data outside the EU except where required for supporting services.

Where international processing occurs, appropriate safeguards are applied in accordance with applicable data protection legislation.

Private software repositories used for development are hosted separately and do not contain customer personal data.

10. Data retention and deletion

The standard retention period for JustPost data is up to 24 months. Different retention periods may apply where agreed with customers, required by law, or necessary for specific operational or security purposes.

Customers may request shorter retention periods.

Where deletion is requested, data may be anonymised rather than physically removed where necessary to preserve limited non-personal information required for:

financial records;
audit purposes;
operational integrity;
security records.

Anonymised data is no longer attributable to an identifiable individual.

11. Security measures

FairSay Ltd applies appropriate technical and organisational measures designed to protect personal data.

These include:

restricted access controls;
multi-factor authentication for administrative access;
secure authentication practices;
encryption during transmission;
encryption at rest by managed database providers;
logical separation of customer data;
secure backup processes;
regular software updates;
manual code review;
automated testing;
logging of relevant platform activity.

Further details are available in the JustPost Security Policy and Technical & Organisational Measures documentation.

12. Customer responsibilities

Customers using JustPost are responsible for:

ensuring they have an appropriate lawful basis for processing;
providing appropriate privacy information to supporters;
determining authorised users;
ensuring user access is kept current;
preventing account sharing;
maintaining strong passwords;
keeping devices and browsers updated.

Customer Dashboard accounts support and require multi-factor authentication.

13. Data Subject rights

FairSay Ltd supports customers in responding to requests from individuals exercising their data protection rights, including:

access;
rectification;
deletion;
restriction;
objection;
portability.

Where FairSay acts as Data Processor, customers remain responsible for managing requests from their data subjects.

FairSay Ltd provides reasonable assistance where customer personal data processed through JustPost is involved.

14. Data breach notification

If FairSay Ltd becomes aware of a confirmed personal data breach affecting customer personal data, FairSay will notify affected Data Controllers without undue delay.

Information provided will include, where available:

the nature of the breach;
categories and approximate number of individuals affected;
categories and approximate number of records affected;
likely consequences;
mitigation measures taken;
a contact point for further information.

This includes incidents involving relevant third-party services used to provide JustPost.

14.1 Data inquiry and breach policy

If a request is received from a data subject and/or competent authority on compliance issues, the data controller will be informed and consulted
If the data controller received an inquiry from a data subject and/or competent authority that involved the platform, JustPost will respond to the inquiries to help resolve any compliance issues.
If a data breach is suspected or occurs, the data controller will be informed as soon as possible once we are aware. This includes at any of the third party services used to host the JustPost platform. This will include categories and number of supporters concerned; categories and number of records involved; likely consequences of the breach; steps take to mititgate and address the breach; a point of contact the data controller can contact about the breach.
JustPost will give guidance to the data controller to implement appropriate technical and organisation measures in the event of an data breach
JustPost can provide other information as requested as part of a data controller's audit/inspection

15. Law enforcement and government requests

FairSay Ltd has not received any requests from law enforcement or government authorities for access to customer personal data.

If such a request is received in the future:

the request will be reviewed for validity and scope;
FairSay will only disclose information where legally required;
disclosures will be limited to the minimum information required;
customers will be notified where legally permitted.

Where FairSay Ltd receives an enquiry relating to customer personal data from a supervisory authority, regulator or competent authority, FairSay will notify and cooperate with the relevant Data Controller where legally permitted and provide reasonable assistance in responding.

16. Updates to this policy

FairSay Ltd may update this Privacy & Data Protection Policy periodically to reflect:

changes to the JustPost platform;
changes to legal requirements;
changes to processing activities;
improvements to privacy and security practices.

The current version of this policy will be made available through the JustPost website.

Contact

For questions relating to privacy and data protection:

Email: support@JustPost.pro

FairSay Ltd, c/o Impact Hub London Euston, 1 Triton Square, London, NW1 3DX, United Kingdom