Skip to content

PRIVACY POLICY

Starboard Systems Limited trading as Scribe and Civic.ly

Company number 10297703

ICO registration number ZA372176

hello@scribeaccounts.com

(updated June 2026)

Key Things to Know

This summary is for your convenience only. Please read the full Privacy Policy below.

🏢 Who We Are

  • Scribe and Civic.ly are two product names of one company, Starboard Systems Limited
  • We are registered with the Information Commissioner's Office (ICO)
  • Questions about your data go to hello@scribeaccounts.com

📊 Your Council's Data, Your Control

  • Your council is the Data Controller for the data it puts into Scribe; we are the Data Processor
  • We only use that data to provide the service, on your council's instructions
  • We never sell your data

🌍 Where Your Data Lives

  • All Scribe data is hosted in the UK
  • Some of our support and development team work outside the UK and may access data to help you, with appropriate safeguards in place

🔒 Keeping Data Secure

  • Data is encrypted in transit and at rest
  • Your council's administrator can require two-factor authentication for every user
  • We hold Cyber Essentials certification

🗑️ How Long We Keep Data

  • Your council's data is kept while you are a customer
  • When you leave, you have 30 days to ask for a copy, then it is deleted
  • Deleted data is gone from all backups within 180 days

📧 Hearing From Us

  • We may email you about our products, training and events, including Civic.ly
  • Reply to any of our emails at any time to tell us you'd rather not hear from us

PRIVACY POLICY

1. WHO WE ARE

1.1 This Privacy Policy explains how Starboard Systems Limited ("Scribe", "we", "us") collects and uses personal data when you use the Scribe software at app.scribeaccounts.com, our website www.scribeaccounts.com, and our services.

1.2 Starboard Systems Limited is one company that trades under two product names: Scribe (accounts, bookings, cemetery, allotments and meetings) and Civic.ly (asset management). Both are run by the same company and the same team. Civic.ly has its own privacy policy for the Civic.ly software.

1.3 This Privacy Policy covers every Scribe module, including Scribe meetings.

1.4 Starboard Systems Limited is incorporated and registered in England and Wales with company number 10297703, and its registered office is at 2 Meridian Way, Dencora Court, Norwich, Norfolk, NR7 0TA.

2. OUR ROLE: CONTROLLER AND PROCESSOR

2.1 Your council's data in Scribe. When you or your users put personal data into Scribe (for example, names and addresses of booking customers, burial records, allotment tenants, payees or meeting attendees), your council is the Controller and we are the Processor. We use that data only to provide the service, on your council's instructions, as set out in our Terms and Conditions and Service Agreement.

2.2 Our own business data. For the contact details of the people we deal with at councils, and of people who enquire, register for events or use our website, we are the Controller.

3. DATA PROTECTION CONTACT

3.1 Our Data Protection Officer is John Fagan. For any question about this Privacy Policy, or to exercise your rights, email hello@scribeaccounts.com.

3.2 We are registered with the Information Commissioner's Office (ICO), registration number ZA372176.

3.3 You have the right to complain to the ICO at any time (ico.org.uk). We would appreciate the chance to deal with your concern first, so please contact us in the first instance.

4. THE DATA WE COLLECT AND WHY

4.1 Where we are the Controller, we collect and use the following:

Contact details (name, job title, council, work email and phone number). We get these from you when you sign up, enquire, book training or contact support; from events you register for; and from contact details your council publishes on its own website. We use them to set up and run your account, provide support and training, bill you, tell you about changes to our terms or this policy, and tell you about our products and events (see clause 5). Lawful basis: performance of a contract, and our legitimate interests.

Billing details. We get these from you when you subscribe or pay, and use them to invoice and collect payment. Lawful basis: performance of a contract, and legal obligation.

Website and usage data (IP address, browser, device and pages visited). We get this from cookies and analytics tools on our website, and use it to run, secure and improve our website and software. Lawful basis: our legitimate interests.

Support records (tickets, emails and call notes). We get these from your contact with us, and use them to provide and improve support and to train our team. Lawful basis: our legitimate interests.

4.2 Where we are the Processor, we hold any personal data your council or its users enter into or import into Scribe, and we use it only to provide the Scribe service to your council.

4.3 We may combine usage data into anonymous statistics (for example, how many users use a feature). Anonymous statistics do not identify anyone.

4.4 Scribe does not use artificial intelligence to process your data.

5. MARKETING

5.1 We sometimes email the people we deal with at councils about our products, training and events, including Civic.ly, where we think they will be relevant to the council's work. We do this on the basis of our legitimate interests in telling councils about services that may help them.

5.2 You can ask us to stop at any time, either by replying to any of our emails or by emailing hello@scribeaccounts.com. Opting out of marketing does not affect emails about your account, support or service.

5.3 We do not sell your data, and we do not share it with any other organisation for its own marketing.

6. WHO WE SHARE DATA WITH

6.1 We share personal data only with the service providers we need to run Scribe, and only for that purpose:

  • Cloud hosting providers in the UK, which host the Scribe software, databases and files
  • Security and network providers, which protect the Scribe software from attack
  • Email and text message providers, which deliver the emails and texts the Scribe software sends
  • Business systems we use for our customer records, support tickets, email and documents, including data councils send us to import
  • Payment providers, which collect and record payment of our own invoices

6.2 Each provider is bound by contract to protect the data and use it only on our instructions. Councils can ask us for a list of the providers we use.

6.3 We may also share data with professional advisers (such as lawyers, accountants and insurers), with HMRC, regulators or the police where the law requires it, and with a buyer or successor if all or part of our business is sold or merged.

7. INTERNATIONAL TRANSFERS

7.1 All Scribe data is hosted in the UK.

7.2 Some of our support and development team work outside the UK and can access personal data in order to provide the service. Where they do, we protect it with the UK International Data Transfer Agreement, confidentiality obligations and strict access controls.

7.3 Where a service provider in clause 6 processes data outside the UK, it does so under the UK's adequacy regulations or the UK International Data Transfer Addendum.

8. DATA SECURITY

8.1 We protect personal data in the following ways:

  • All Scribe data is hosted in UK data centres
  • Data is encrypted in transit and at rest
  • Your council's administrator can require two-factor authentication for every user
  • Our own staff need multi-factor authentication to reach our systems, and see only what their role requires
  • Every laptop our team uses for work has full disk encryption
  • We hold Cyber Essentials certification

8.2 If we become aware of a personal data breach affecting your council's data, we will tell your council without undue delay, so that it can meet its own obligations.

8.3 If a breach affects data we control, we will report it to the ICO within 72 hours where the law requires, and tell the people affected where there is a high risk to them.

9. DATA RETENTION

9.1 Your council's data in Scribe is kept while your council is a customer. When your contract ends, your council has 30 days to ask us for a copy of its data, as set out in our Terms and Conditions. After that it is deleted, including the audit trail of changes to your records. As Controller, your council should keep whatever it needs to meet its own retention obligations, such as for financial records.

9.2 Our own records (contacts, support tickets and emails) are kept while there is a business need, and deleted on a valid request unless the law requires us to keep them.

9.3 Backups. Daily backups are kept for 30 days and monthly backups for six months. Deleted data is removed from all backups within 180 days.

10. YOUR RIGHTS

10.1 You have the right to:

  • ask for a copy of the personal data we hold about you
  • ask us to correct it
  • ask us to delete it
  • ask us to restrict or stop using it
  • object to our using it, including for marketing
  • ask for it in a portable format
  • withdraw consent, where we rely on consent

10.2 To use any of these rights, email hello@scribeaccounts.com.

10.3 Where the data belongs to your council (clause 2.1), we will pass your request to the council and help it respond, because the council is the Controller.

11. COOKIES

11.1 Our website uses cookies. Some are needed for the site to work. Others are analytics and marketing cookies, which help us understand how the site is used, improve it, and recognise returning visitors.

11.2 You can block or delete cookies in your browser settings. Blocking some cookies may stop parts of the site from working properly.

12. CHILDREN

12.1 Scribe is a service for councils and is not intended for children. We do not knowingly collect data about children except where a council enters it into Scribe as part of its own records.

13. CHANGES TO THIS PRIVACY POLICY

13.1 We review this Privacy Policy at least once a year. The date at the top shows when it last changed.

13.2 Our Terms and Conditions explain how we provide the service.