Legal
Privacy Policy
Draft for legal review, not in force. This wording has not been approved and must not be relied on.
Last updated: not yet approved
- Bracketed text (to be confirmed)
- A detail TSP has not yet confirmed. It must be completed before approval.
- Legal review
- A point that needs a qualified adviser’s judgement before this document is finalised.
Questions about this document: enquiries@tspmedia.org.uk
Section 01
Who we are
The Silent Professional (‘TSP’) leads the People’s Charter Movement, a UK campaign for a nationwide referendum on a codified constitution. This website and its content are published by TSP Media, TSP’s company, whose legal name is Legal entity name (to be confirmed), Legal form and registration number (to be confirmed), with its registered address at Registered address (to be confirmed). In this policy, ‘TSP’, ‘we’, ‘us’ and ‘our’ mean Legal entity name (to be confirmed).
Legal entity name (to be confirmed) is the controller of your personal data. This means we decide why and how your personal data is used, and we are responsible for looking after it in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).
Our registration number with the Information Commissioner’s Office is ICO registration number (to be confirmed). Our data protection contact is Data-protection contact (name or role) (to be confirmed), who can be reached at enquiries@tspmedia.org.uk.
Section 02
What this policy covers
This policy explains how we collect, use, share and protect personal data when you:
- visit and read this website;
- sign up for free email updates;
- create a member account;
- join the Inner Circle, our £5-a-month subscription, and take part in its community;
- donate to the People’s Charter Movement Fund;
- contact us through the contact form or by email; or
- use the Action Hub letter builder.
Several of these features are not available yet. Where a feature has not launched, this policy describes how we intend to handle personal data once it does, and we will update the policy before launch if anything changes. TSP is also planning further Inner Circle features, such as a video forum; this policy will be updated to explain how they use personal data before any of them launches.
This policy does not cover other websites, including sites we link to and video platforms whose content we embed. Their own privacy policies apply.
Section 03
The data we collect
The summary below sets out, for each part of the website, what personal data we collect, why we collect it, our lawful basis and how long we keep it. The lawful bases are explained in the next section.
Reading the website
- Data
- TSP does not ask for any personal data when you simply read the website. Our hosting provider necessarily processes technical information to deliver pages to you (such as your IP address, browser and device type, the pages requested and the date and time) and may record it in server logs.
- Purpose
- To deliver the website, keep it secure and investigate faults or misuse.
- Lawful basis
- Legitimate interests: running a secure, working website.
- Retention
- Server log retention period (to be confirmed)
Visitor statistics
- Data
- Counted by Vercel Web Analytics: the page you visit, the website that referred you, your browser, operating system and device type, and your approximate location. No cookies are used and nothing is stored on your device. Vercel tells visitors apart with a code calculated from the request, which it discards after 24 hours, and does not link the statistics to your IP address. TSP sees totals only.
- Purpose
- To count visits and see which pages and links bring people to the website, for example after TSP shares a video on social media, and to show the total number of visitors on the homepage.
- Lawful basis
- Legitimate interests: knowing whether TSP’s work is reaching people.
- Retention
- Analytics retention period under Vercel’s plan (to be confirmed)
Free email updates
- Data
- Email address
- First name (optional)
- A record of your consent: the date and time you gave it and where you signed up
- Your subscription status, including any request to unsubscribe
- Purpose
- To send you the TSP email updates and published research you asked for, and to show that you consented.
- Lawful basis
- Consent, for sending the emails. Legal obligation and legitimate interests, for keeping a record of your consent and of any request to unsubscribe.
- Retention
- Until you unsubscribe. After that we keep a minimal record of your email address and unsubscribe request for Consent and suppression record retention period (to be confirmed), so that we do not email you again.
Member accounts
- Data
- Name and email address
- Your password, which is handled by our authentication provider and is never visible to TSP
- Postcode (optional), used only for the Action Hub
- Your email preferences
- Technical records needed to keep your account secure, such as sign-in dates and times
- Purpose
- To create and run your account, let you manage your email preferences, membership and receipts, and keep your account secure.
- Lawful basis
- Contract: providing the account you asked for. Legitimate interests: keeping accounts and the website secure.
- Retention
- While your account is open. We delete account data within Period after account closure (to be confirmed) of you closing your account, except records we must keep for longer, such as payment records.
Inner Circle subscription
- Data
- Name and email address
- Membership number, subscription status, start date, monthly renewal dates and end date
- Records of each monthly payment received from Stripe: amount, currency, date, payment reference and status Confirm whether card brand and last four digits are stored (to be confirmed)
- Any information needed for eligibility or political-finance checks Confirm what is collected (to be confirmed)
- Purpose
- To provide your £5-a-month subscription: to create your member account and switch on access to the essay archive and community automatically when your payment clears, send your welcome email, take monthly payments, issue your membership number, manage cancellations, send service emails and receipts, and keep the records the law requires.
- Lawful basis
- Contract: providing your membership. Legal obligation: keeping financial records and meeting any political-finance requirements that apply to TSP. See also ‘Political opinions and special category data’.
- Retention
- For as long as you are a member; financial records for Financial record retention period (proposed: six years) (to be confirmed).
Inner Circle community (planned feature, to confirm)
- Data
- Your display name and any profile details you choose to add Confirm which profile fields are offered (to be confirmed)
- Posts, comments and replies you write, and when you wrote them
- Moderation records, such as reports about posts and any action taken
- Purpose
- To run the members’ community: to show your posts and display name to other members, and to moderate the community so it stays safe and within its guidelines.
- Lawful basis
- Contract: providing the community as part of your subscription. Legitimate interests: moderating the community and keeping it safe. Confirm lawful basis and Article 9 condition for community posts (to be confirmed)
- Retention
- Retention of posts and profile details after cancellation or account closure (to be confirmed)
Donations to the People’s Charter Movement Fund
- Data
- Name and email address
- Amount, currency, date, payment reference and status, received from Stripe
- Any information the law requires us to collect to check whether we can accept your donation Confirm what is collected, e.g. home address or electoral-register details (to be confirmed)
- Purpose
- To process your donation, send you a receipt, carry out any checks the law requires and keep financial records.
- Lawful basis
- Contract: processing the payment you asked us to make. Legal obligation: financial records and any political-finance checks, records and reports.
- Retention
- Donation record retention period (proposed: six years) (to be confirmed), or longer where the law requires.
Contact form and emails to us
- Data
- Name and email address
- The enquiry category you choose
- Your message and anything else you decide to tell us
- Purpose
- To read and reply to your enquiry and keep a record of our correspondence.
- Lawful basis
- Legitimate interests: responding to people who contact us. If you choose to include sensitive information, we use it only to deal with your enquiry.
- Retention
- Contact enquiry retention period (to be confirmed)
The Action Hub letter builder
- Data
- None. What you type into the letter builder (including your name, address and letter) stays in your browser and is never sent to TSP.
- Purpose
- Not applicable.
- Lawful basis
- Not applicable. TSP does not process this data.
- Retention
- Not stored by TSP. It is cleared when you close or refresh the page.
Section 04
Our lawful bases explained
UK data protection law requires us to have a lawful basis for each way we use personal data. We rely on the following bases, as set out feature by feature above.
- Consent (Article 6(1)(a) UK GDPR), for sending email updates. You can withdraw your consent at any time; this does not affect anything we did before you withdrew it.
- Contract (Article 6(1)(b)), where we need your data to provide something you have asked for, such as an account, a subscription, the members’ community or processing a donation.
- Legal obligation (Article 6(1)(c)), where the law requires us to keep or share data, such as financial records, any political-finance records that apply to TSP, or responding to a lawful request from a court or regulator.
- Legitimate interests (Article 6(1)(f)), where we need to use data to run TSP effectively and that need is not outweighed by your interests and rights: for example, keeping the website secure, responding to enquiries, preventing fraud and misuse, and establishing or defending legal claims. Confirm legitimate interests assessments are completed (to be confirmed)
You have the right to object to processing based on legitimate interests (see ‘Your rights’).
Where we use special category data, such as information that reveals political opinions, we also need a separate condition under Article 9 UK GDPR. This is explained in the next section.
Section 05
Political opinions and special category data
Signing up for updates, creating an account, joining the Inner Circle, posting in its community or donating to a movement that campaigns for a referendum on a codified constitution may reveal, or allow others to infer, your political opinions. Under UK GDPR, personal data revealing political opinions is ‘special category data’ and receives extra protection.
What you post in the Inner Circle community, and your display name, can be seen by other members. Please think about what you share there.
We therefore treat the fact that you support TSP, and related information we hold about you, as special category data. We limit access to the people who need it to do their work, use it only for the purposes in this policy, and do not disclose it outside TSP except as described in ‘Who we share data with’.
The condition we rely on to process this data is Article 9 UK GDPR condition (to be confirmed).
Legal reviewNeeds adviser sign-off
Supporting or joining a political movement may reveal political opinions, which are special category data under Article 9 UK GDPR. The Article 9 condition must be confirmed before any feature that collects personal data goes live. Options include:
- Article 9(2)(d): processing by a not-for-profit body with a political aim, in the course of its legitimate activities and with appropriate safeguards, relating only to members, former members or people in regular contact with it, and not disclosed outside the body without consent. Whether this is available depends on TSP’s legal form and on who counts as a member or regular contact.
- Article 9(2)(a): explicit consent, which would need a clear, separate consent statement at each point of collection and an easy way to withdraw.
- If TSP registers as a political party, the ‘political parties’ condition in Schedule 1, Part 2, paragraph 22 of the Data Protection Act 2018, which requires an appropriate policy document.
Also consider whether a data protection impact assessment (Article 35) and a data protection officer (Article 37) are required, since processing information about political opinions may be a core activity carried out at scale.
The planned community makes members’ posts visible to other members. Confirm the Article 9 condition covers this sharing, what members are told before they first post, and how moderation records are handled.
Section 06
Email updates and consent
We send TSP email updates and published research only to people who have asked to receive them. The consent box is never pre-ticked, and signing up is always optional and separate: you can create an account, become a member or make a donation without agreeing to receive updates.
When you sign up, we record your email address, your first name if you give it, the date and time you consented and where you signed up. PECR and UK GDPR require us to be able to show that you agreed, so we keep this record for as long as we need to demonstrate your consent.
You can unsubscribe at any time, free of charge:
- by using the unsubscribe link included in every update;
- by changing your email preferences in your member account, once accounts are available; or
- by emailing enquiries@tspmedia.org.uk.
Unsubscribing does not affect your account or membership. We keep a short record that you unsubscribed so that we do not email you again by mistake.
If you have an account or membership, we will also send you the service emails you need, such as the welcome email when your subscription starts, payment receipts, renewal reminders and notice of important changes to your membership or to this policy. These are not marketing and are sent whether or not you have signed up for updates.
Our emails are sent using Email delivery provider (planned: Resend) (to be confirmed). Confirm: emails do not use open or click tracking (to be confirmed)
Section 07
Payments
Inner Circle subscription payments, taken monthly, and donations to the People’s Charter Movement Fund will be processed by Stripe using Stripe Checkout, a secure payment page hosted by Stripe. You enter your card details directly with Stripe. They are never sent to or stored by TSP, and we never see your full card number or security code.
Stripe tells us whether a payment has succeeded and gives us limited information about it, such as the amount, currency, date, a payment reference and its status Confirm whether card brand and last four digits are received or stored (to be confirmed). We treat a subscription payment or donation as confirmed only once Stripe has confirmed the payment to us. When your first subscription payment is confirmed, your member account is created and your access is switched on automatically.
Stripe also uses personal data for its own purposes, such as preventing fraud and meeting its legal obligations. Stripe acts as Independent controller and/or processor (role to confirm) (to be confirmed), and its own privacy policy applies: stripe.com/privacy.
Subscriptions and donations are not open yet.
Section 08
The Action Hub
The Action Hub’s letter builder runs entirely in your web browser. Nothing you type into it (including your name, address, your MP’s details or the text of your letter) is sent to TSP or stored by us. When you close or refresh the page, what you typed is cleared.
Copying, downloading and printing your letter also happen in your browser. TSP never sends messages to MPs on your behalf and does not receive a copy of your letter. If you send it, you do so yourself, and the privacy policies of the service you use (such as your email provider) and of the office you write to apply.
If you add a postcode to your member account, it is used only for the Action Hub. Adding it is optional, and you can remove it at any time.
The Action Hub links to the UK Parliament’s Find your MP service, which is run by UK Parliament under its own privacy notice.
Section 11
International transfers
Some of the providers we plan to use are based outside the UK, or may store or access data outside the UK, for example in the European Economic Area or the United States.
Where personal data is transferred outside the UK, we will make sure it is protected to the standard UK law requires, using one of the following safeguards:
- UK ‘adequacy’ regulations, which recognise that a country (such as the EEA countries) or a framework (such as the UK Extension to the EU–US Data Privacy Framework, for certified US organisations) provides adequate protection; or
- the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with any supplementary measures needed.
The safeguard used for each provider is: International-transfer safeguard for each provider (to be confirmed). You can ask for more information about these safeguards by emailing enquiries@tspmedia.org.uk.
Section 12
Keeping your data secure
We use appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. These include:
- encrypted connections (HTTPS) across the whole website;
- keeping card details entirely with our payment provider, so that TSP never handles them;
- limiting access to personal data to people who need it, with access controlled by role; and
- Further security measures, e.g. audit logging and staff training (to be confirmed).
No website or online service can be completely secure. If a personal data breach occurs, we will report it to the Information Commissioner’s Office where the law requires, and tell you without undue delay if it is likely to result in a high risk to your rights and freedoms.
Section 13
How long we keep data
We keep personal data only for as long as we need it for the purposes described in this policy, including to meet legal, accounting and reporting requirements. When we no longer need it, we delete it or anonymise it so that it can no longer be linked to you.
| Data | Proposed period |
|---|---|
| Email update subscriptions | Until you unsubscribe |
| Consent records and unsubscribe (suppression) records | Retention period (to be confirmed) |
| Member account data | While your account is open, then Period after account closure (to be confirmed) |
| Community posts and profile details | Retention period after cancellation or account closure (to be confirmed) |
| Subscription and donation financial records | Proposed: six years from the end of the financial year of the transaction (to be confirmed) |
| Records required by political-finance law | As required by law (to confirm) (to be confirmed) |
| Contact form enquiries and correspondence | Retention period (to be confirmed) |
| Server logs held by our hosting provider | Retention period (to be confirmed) |
| Visitor statistics (aggregate, held by Vercel) | Retention period under Vercel’s plan (to be confirmed) |
| Action Hub letters | Not stored by TSP |
Legal reviewNeeds adviser sign-off
All retention periods are proposals and must be confirmed. Financial records are commonly kept for six years; this is a proposed default to confirm with TSP’s accountant or adviser. Confirm the periods for consent and suppression records, closed accounts, enquiries and server logs, and any longer period required by political-finance rules, and adopt a written retention schedule before launch.
Section 14
Your rights
Under UK data protection law you have the following rights. Some apply only in certain circumstances; if a right does not apply to your request, we will explain why.
- Access: to ask for a copy of the personal data we hold about you and information about how we use it.
- Rectification: to ask us to correct inaccurate data or complete incomplete data.
- Erasure: to ask us to delete your data. We may need to keep some records, such as financial records, where the law requires.
- Restriction: to ask us to limit how we use your data, for example while we check its accuracy.
- Data portability: to receive data you gave us in a structured, commonly used, machine-readable format, or to ask us to send it to another organisation, where we process it by automated means on the basis of your consent or a contract.
- Objection: to object to our use of your data where we rely on legitimate interests. You have an absolute right to object to direct marketing, which includes campaign emails.
- Withdrawing consent: where we rely on your consent, you can withdraw it at any time. This does not affect anything we did before you withdrew it.
- Automated decision-making: not to be subject to decisions based solely on automated processing that have legal or similarly significant effects on you. TSP does not make any such decisions, and none are planned.
Section 15
How to exercise your rights
To exercise any of your rights, email enquiries@tspmedia.org.uk and tell us which right you want to use. You can also write to us at Registered address (to be confirmed). Our data protection contact is Data-protection contact (name or role) (to be confirmed).
There is normally no charge. We may need to ask for information to confirm your identity before we act on your request. We will respond within one month of receiving your request, or of receiving any information we need to confirm your identity. If your request is complex, or you make several requests, we may extend this by up to two further months; if so, we will tell you within the first month and explain why.
Once member accounts are available, you will also be able to update your details and email preferences in your member account.
Section 16
Complaints
If you are unhappy with how we have handled your personal data, please contact us first at enquiries@tspmedia.org.uk so that we can try to put things right.
You also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO):
- Website: ico.org.uk
- Telephone: 0303 123 1113
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Legal reviewNeeds adviser sign-off
Confirm the regulator’s current name and contact details before publication: the Data (Use and Access) Act 2025 provides for the ICO to be replaced by the Information Commission. The same Act requires controllers to have a process for handling data protection complaints, including acknowledging them within 30 days; confirm TSP’s complaint-handling procedure.
Section 17
Children
Our services are not designed for children. You must be at least Minimum age (to be confirmed) to sign up for email updates or create an account, and at least Minimum age for the Inner Circle and donations (to be confirmed) to join the Inner Circle or make a donation.
If we learn that we hold personal data about someone below the minimum age without a lawful basis, we will delete it. If you think this has happened, please contact us.
Section 18
Changes to this policy
We will review this policy regularly and update it before any new feature that uses personal data goes live. The ‘last updated’ date at the top of this page shows when it was last changed. If we make significant changes to how we use your data, we will tell you by email or by a notice on the website before the change takes effect, where we are able to.
Section 19
Contact
If you have any questions about this policy or how we handle your personal data, please contact us.
- enquiries@tspmedia.org.uk
- Post
- Legal entity name (to be confirmed), Registered address (to be confirmed)
- Data protection
- Data-protection contact (name or role) (to be confirmed)
- ICO registration
- ICO registration number (to be confirmed)