Data Protection and Privacy Policy

This document outlines how The Conservative Party processes and manages personal data and:

• Identifies the data controller.
• Explains the lawful basis for processing personal data.
• Outlines the personal data held and processed.
• Outlines the scope of the special category personal data held and processed.
• Outlines the process of Subject Access Requests. 

We operate as forum whereby you choose to sign up to receive information from us, and in doing so must consent to our policy, and our terms.

By interacting with our Website you must be willing to be bound by the data practices described in this Privacy Policy. If you do not agree with any part of this Privacy Policy, then please stop accessing our website, and do not communicate with us.

For the purposes of this Privacy Policy, the term ‘Personal Data’ means any information, which identifies you, or which allows you to be identified when combined with other information. It does not include data where your identity has been removed (‘Anonymised Data’).

1. Data Controller

The Data Controller is The Conservative Party

2. Contact

If you have any questions about this policy or for more information about how we use your data or would like to exercise any of your rights contact The Conservative Party ([email protected]).

3. Information we collect and how

When you use our Website or communicate with us, including attending any event we organise, we may collect certain Personal Data that can be used to identify you.  Any data that does not enable you to be identified will not be considered Personal Data.

We may collect information and Personal Data from you:

• Via your interaction with our Website;
• Through social media engagement including responses to online advertisement;
• By email;
• Over the phone; or
• In person (e.g. paper based records).

We may collect and process the following data about you:

Personal Data that we may require in order to keep you informed of our work and activity will include: First name, Last name, Email or Physical Address, Telephone numbers and social media account information.  Other information may be gathered depending on the circumstances.

We may also ask you to complete surveys that we use for research purposes, although you do not have to respond to them.

Device Information

When you use our Website, we automatically collect information on the type of device you use, operating system, resolution, application version, mobile device identifiers (such as your device ID, advertising ID), language, time zone and IP address.

Information we obtain from third parties

We may receive information about you from our third party service providers (such as Google Analytics or social media platforms like Facebook), who collect this information through our social media or from interaction with our Websites in accordance with their own privacy policies.

Social Sharing Features

Our online content may offer social sharing features and other integrated tools (such as the Facebook “Like” button), which let you share actions you take on our Sites with other media, and vice versa.  The use of such features enables the sharing of information with your friends or the public, depending on the settings you establish with the entity that provides the social sharing feature.  For more information about the purpose and scope of data collection and processing in connection with social sharing features, please visit the privacy policies of the entities that provide these features.

Aggregated Anonymised Data

The information we collect from you may be combined with information provided by others, but only in an anonymised format, to produce aggregated anonymised data sets for research purposes.  We refer to this combined data as ‘Aggregated Data.’  Aggregated Data is not considered to be Personal Data as it does not reveal your identity.

However, in the event that we combine or connect Aggregated Data with any of your Personal Data that enables you to be directly or indirectly identified, we will treat such data as Personal Data to be used in accordance with this Privacy Policy. 

Use of Cookies and Google Analytics

Our Website may use ‘cookies’ and similar technologies to enhance the users’ experience.  You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of our website may become inaccessible or not function properly.

You can view and change your cookie consent settings at any time.

4. Lawful basis for processing

All processing is carried out by consent or either under the legitimate interest of The Conservative Party, or public interest.  These cover processing to conduct casework, campaigning and communication.  Where processed under the lawful basis of a task carried out in the public interest, it is to support or promote democratic engagement.  This includes fundraising activity in order to support democratic engagement.

5. Data sources

Data held is that provided by you when you contact us and correspondence with third parties in response to cases taken up on your behalf. If you do not wish for us to contact you by telephone please do not provide this information. The Register of Electors that councils provide to authorised persons under the Representation of the People Act is also used for electoral purposes.

6. Data Security 

Personal data is stored electronically and securely. We ensure that our service providers comply with the same high standard that we do, and are in the UK.

7. Special category data

Special category data will be processed under the lawful basis indicated in section 3, as is permitted in clauses 22, 23 and 24 of schedule 1 of the Data Protection Act, covering political parties and elected representatives.  

8. Transferring your data outside of the European Economic Area

Some service providers are located outside of the European Economic Area (EEA) and therefore it may be necessary to transfer your personal data outside of the EEA. Where the transfer of your data outside of the EEA takes place we will make sure that it is protected in the same way as if the data was inside the EEA, and it only occurs with your consent.

We will use one of the following safeguards to ensure this:

• Where the European Commission has issued an adequacy decision determining that a non-EEA country or organisation ensures an adequate level of data protection.
• A contract is put in place with the recipient of the data obliging them to protect the data to the same standards as the EEA.
• The transfer is to an organisation that complies with the UK Extension to the EU-US Data Privacy Framework.

Legally it is not permitted to transfer certain types of data, such as Electoral Register Data, outside of the EEA, and we honour that obligation.

9. Data retention policy

Personal data will be held for no longer than necessary. Some types of data may be held for longer than others. Typically the maximum retention is two election cycles. Review of the data held will occur in each election cycle to determine whether it should be maintained or put beyond use.

10. Subject Access Requests

Subject Access Requests are dealt with in line with the guidance given by the Information Commissioner’s Office (ICO): 

• We will request verification of the identity of any individual making a request, and ask for further clarification and details if needed.
• We will respond within 28 calendar days once we have confirmed it is a legitimate request.
• Data subjects have the right to the following:
  • To be told whether any personal data is being processed
  • To be given a description of the personal data, the reasons it is being processed and whether it will be given to another organisations or people.
  • To be given a copy of the information comprising the data, and given details of the source of the data where this is available.

11. Will we share your data with anyone else?

We may use information about you for various purposes, including to:  Provide, maintain and improve our website and social media content, and for communication with you which will include sending you newsletters and other information on our activity or political content that we think will be of interest to you.

If you have contacted us about a personal or policy issue, your data may be passed on to a third-party in the course of dealing with your enquiry, such as local authorities, government agencies, public bodies, health trusts, regulators, and so on. Any third parties that we may share your data with are obliged to keep your details securely, and to use them only for the basis upon which they were originally intended.

We may need to share your data with a third party, such as the police, if required to do so by law.

Unless otherwise specified, data may also be shared with entities of Political Party associations, federations, branches, groups and affiliates in order to assist you or maintain contact with you in support of democratic engagement.

We may share information about you with consultants and other service providers who need access to such information to carry out work on our behalf, to maintain our online content or output of information; in response to a request for information if we believe disclosure is in accordance with any applicable law, regulation or legal process, or as otherwise required by any applicable law, rule or regulation; if we believe your actions are inconsistent with Terms then with our legal advisors. Our online activity is supported by a contract with NationBuilder, and your data will be stored on their servers, meaning outside the UK, you can see their privacy policy here: https://nationbuilder.com/privacy 

Your personal data is only used as outlined here and within your reasonable expectations based on the nature of the communication, and recognising the need of politically related engagement in wider support of democratic engagement.

12. Data Rights

At any point you have the following rights:

• Right of access – you have the right to request a copy of the information held about you.
• Right of rectification – you have a right to correct data held about you that is inaccurate or incomplete.
• Right to be forgotten – in certain circumstances you can ask for the data held about you to be erased from our records.
• Right to object – you have the right to object to certain types of processing, such as direct marketing.
• Right to object to automated processing, including profiling – you also have the right to be subject to the legal effects of automated processing or profiling.
• Right to judicial review: if our office refuses your request under rights of access, we will provide you with a reason why. You have the right to complain.

13. Making a complaint

If you are unhappy with the way that we have processed or handled your data then you have a right to complain to the Information Commissioner’s Office (ICO). The ICO is the supervisory body authorised by the Data Protection Act 2018 to regulate the handling of personal data within the United Kingdom. The contact details for the ICO are:

• Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF
• Telephone: 0303 123 1113
• Website: https://ico.org.uk/make-a-complaint/

If you have any questions about the data held please contact The Conservative Party via the contact information on this website.

Please note that proof of identity is required should you choose to exercise any of the above rights in relation to personal data.

14. Updates

We retain the right to update this policy at any time. If there are changes that significantly impact your rights, we will contact you in advance.