How this site handles personal data under the UK GDPR and the Data Protection Act 2018. Last updated 24 October 2026.
This site is run by Dr Bene Amin (the "controller"). It is a private analysis site of published public spending data. Contact details are at the end of this notice.
Account data for people given access: username, display name, role (viewer or admin), access level (mp, lords or admin), account creation date, last sign-in time, and a one-way password hash. Passwords are never stored in readable form. Purpose: to let you sign in and to keep the site private. Basis: legitimate interests (Article 6(1)(f)) in keeping access limited to invited users.
Technical data: when you use the site, the web server records your IP address, the time, the page requested and your browser type. Purpose: security and fault-finding. Basis: legitimate interests. These records are kept only as long as needed for that purpose.
Published spending data: the site analyses payments over £500 published by Bradford Council and Bradford Children and Families Trust under the Local Government Transparency Code, and figures released under the Freedom of Information Act. Supplier names are mostly companies. Some may identify a sole trader or other individual. Purpose: scrutiny of how public money is spent on children's care. Basis: legitimate interests, being the public interest in transparency. We add no further personal details about individuals.
We do not collect special category data, we do not sell data, and we do not use it for marketing or automated decisions about people.
MPs and councillors are asked to register before they can use the site. We hold the full name, official email address, constituency or ward, optional phone number and stated reason for access that you enter, with the time and IP address of the submission and the administrator's decision. Purpose: to check that only eligible people are given access. Basis: legitimate interests (Article 6(1)(f)). It is visible only to the site administrator, is not shared, and is deleted when your access ends or when you ask.
When you are signed in, the site records your visits: the time, your username, your IP address, the pages and data you request, your browser type, how long each page was open and in use, how far you scrolled, and which links, buttons and menus you clicked (their wording and destination). It also records each sign-in attempt, including failed ones, with the username typed, time, IP address and browser. It does not record what you type into forms, and never records passwords.
Purpose: security, checking who has had access, and understanding which parts of the site are used. Basis: legitimate interests (Article 6(1)(f)). The records are visible only to the site administrator, are held on our own server, are not shared, and are deleted after 400 days.
Some users are asked to accept a confidentiality agreement before viewing unredacted data. We keep a record of that acceptance: your name as typed, the time, your IP address and browser.
The site sets one cookie, spendsess. It keeps you signed in and protects the sign-in form. It is strictly necessary, is deleted when you close your browser, and is not shared with anyone. We set no advertising or third-party cookies and load nothing from other companies. The activity records described under "Activity records" are kept on our own server.
The site is hosted on a Hostinger server. Hostinger acts as our hosting provider (processor). Pages load no fonts, scripts or tracking from other companies. Your data is shared with no one else unless the law requires it.
Account data is kept while you need access and is deleted when you ask or when access ends. Technical records are kept briefly for security. Published spending data is kept while the analysis is in use.
You can ask to see the personal data we hold about you, to have it corrected or deleted, to restrict or object to its use, and to receive a copy you can reuse. You can object at any time to processing based on legitimate interests, including where you are a supplier named in the spending data. We will reply within one month.
If you are unhappy with how your data is handled you can complain to the Information Commissioner's Office: ico.org.uk, telephone 0303 123 1113.
Dr Bene Amin, by email at sher@btconnect.com. Put "Data request" in the subject line.