Last updated 7th July 2022
Keeping your data safe
Personal data means data which relate to a living individual who can be identified –
- from those data, or
- from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual.
Who are we?
In this document, when you see the words ‘we’ ‘us’ or ‘our’, it refers to the Back Zack campaign, which is an unincorporated association set up to keep supporters informed of his political activities.
Who is in control?
It is important that you understand who is responsible for keeping your data safe. We are the “controller” of all personal data collected and used by the Back Zack campaign for the purposes set out in this Privacy Notice. This means that we are responsible for deciding how and why your data is used and for ensuring that your data is handled legally and safely.
What data do we collect and where from?
Website subscription forms – we collect the details you submit to us when you complete an online form asking us to keep you updated on our activities and related issues.
Petitions and surveys – we also collect information that you voluntarily provide to us when you respond to petitions or surveys including your responses to any questions they might ask.
Cookies and IP addresses – we collect information about how you interact with our websites using Cookies and your connection’s Internet Connection (IP) Address if your browser is set to accept/provide such.
Social media – we also collect anonymised publicly available information from social networking sites such as Facebook and Twitter, for example likes, shares, tweets and posts about Zack Polanski and his activities and campaigns. This information is provided to us by the third-party social media platform.
What do we use your data for?
We use the data you provide us to communicate with our supporters about campaign activities and events. We use your data, including any voluntarily provided information, to choose which campaigns or activities we believe may be of interest to you. Our communications may be via Post, Telephone, Email or Social Media.
Your address information (where provided) may be used in an automated way to inform you of campaigns of geographical relevance.
As a political campaign, we use your expressed political opinions to inform our campaigning including what issues we promote, how we contact you and what we say to you.
This ensures that we can continue to represent supporters’ views in a democratic way and to help us generate revenue to fund our political activities.
What is our legal basis for using your data?
In order to process personal data lawfully, we may use different lawful grounds for processing. For example, we may use Consent where it is informed and specific to the purposes for which it was gathered, such as for fundraising or campaigning. In a similar way we may use our Legitimate Interest where we believe the individual may have a reasonable expectation that their data is processed. Broadly, our processing activities include but are not limited to:
Informing members and supporters of Back Zack activities and campaigns
We process this personal data on the basis that we ensure that we communicate effectively with actual and potential supporters of the Back Zack campaign. This ensures that we can continue to represent supporters’ views in a democratic way. This processing is considered to be fundamental to our role in promoting democracy in the public interest. Political opinions are classed as ‘special category’ data under data privacy legislation and our processing of this data is in accordance with Article 9 (g) of the General Data Protection Regulations which states that “processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law…”
Who do we share your data with?
Third party platforms
Where you comment on a social media post we have made, we may repost your comment or share your comment on another social media channel. We will do this in our Legitimate Interest. Where you post information on our social media channels which are in the public domain, we may not be able to control information which is reposted or copied by a third parties.
Facebook is able to connect the data with your Facebook account and use the data for their own advertising purposes, in accordance with Facebook’s Data Use Policy found here. Facebook Conversion Tracking also allows Facebook and its partners to show you advertisements on and outside Facebook. In addition, a cookie will be saved onto your computer for these purposes.
From time to time we may need to share some of your data with third party data processors (such as technology providers, website hosts, online systems). Where we do so we will have a data processing agreement with the third party, and where they are located outside the United Kingdom we will ensure that they provide enough security and privacy to enable us to meet our legal obligations to you.
An example of this would be where we use a third-party email provider to deliver our emails to you. We would need to share your email address with the supplier to carry out this function, but their processing of your data would be in line with a data processing agreement we would have with them.
How long do we keep your data for?
Where you sign up, your data will be held for as long as we run the Back Zack campaign. If you choose to unsubscribe, your record may be deleted from our records.
Where you have donated to the campaign, the related data may be held for a period of 6 years to ensure we can comply with our legal obligations.
What rights do you have?
You have a number of rights under data protection law. Some of these rights and how you can exercise them are set out in this section: more information can be found from the Information Commissioner’s office (https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/).
We will normally need to ask you for proof of your identity before we can respond to a request to exercise any of the rights in this section and we may need to ask you for more information, for example to help us to locate the personal data or ask for a ‘scope’ that your request relates to.
The right to be informed
A right to access your information
You have a right to ask us to send you a copy of your all personal data that we hold about you (subject to some exceptions). A request to exercise this right is called a “subject access request” and must be made in writing to firstname.lastname@example.org
A right to object to us processing your information
You have a right to object to us processing any personal data that we process where we are relying on legitimate interests as the legal basis of our processing. You also have the right to withdraw your consent from our processing that requires it (such as our email communications). Every communication will have an option for you to withdraw your consent directly, or you can email email@example.com at any time to exercise this right.
A right to ask us not to market to you
You have the right to opt-out of any marketing or personally addressed direct mailings we send to you. If the communication is electronic it will include simple links and instructions to ‘unsubscribe’. For other media please email firstname.lastname@example.org
A right to have inaccurate data corrected
You have a right to ask us to correct inaccurate data that we hold about you. If we are satisfied that the new data you have provided is accurate, we will correct your personal data as soon as possible.
A right to have your data erased
You have a right to ask us to delete your personal data in certain circumstances, for example if we have processed your data unlawfully or if we no longer need the data for the purposes set out in this Privacy Notice.
A right to have processing of your data restricted
You can ask us to restrict processing of your personal data in some circumstances, for example if you think the personal data is inaccurate and we need to verify its accuracy, or if we no longer need the data but you require us to keep it so that you can exercise your own legal rights. Restricting your personal data means that we only store your personal data and don’t carry out any further processing on it unless you consent, or we need to process the data to exercise a legal claim or to protect a third party or the public.
To exercise any of the rights above please email email@example.com
To further understand your rights please visit the website of the Information Commissioner’s Office (ICO) at http://www.ico.gov.uk