Privacy & Cookies Policy

This policy explains what personal data we collect when you use this website, why we collect it, who we share it with, how long we keep it, and the rights you have over it. GBP Corporation Limited is the “data controller” for this data, which means we decide how and why it is processed.

It applies to this website only. It does not cover other sites we link to, such as our online shop, our policy platform, or our social media pages — each of those has its own privacy policy.

The data we collect

Information you give us directly, depending on how you use the site:

• Account and membership details — your name and email address when you register as a supporter or join one of our membership tiers.
• Contact and enquiry details — the name, email address and message you send when you use our contact, report or “promote an idea” forms.
• Donation and payment information — when you donate or pay for membership, our payment processor (Stripe) handles your card details directly. We receive a record of the payment (amount, date, and a Stripe reference) but we never see or store your full card number.
• Optional “About you” details — information you choose to give us in your account to help us tailor and evaluate our campaigns, starting with whether you belong to a UK political party. This is entirely optional and, because it can reveal your political opinions, we only collect it with your explicit consent (see “Political views and other optional details you choose to share” below).

Information collected automatically when you visit:

• Technical and usage data — your IP address, browser type, device and operating system, the pages you view and how you move through the site. This is collected through Google Analytics (see “Cookies and analytics” below) and only when you have not opted out.

How we use your data

We use your data to:

• create and manage your supporter or membership account and give you access to the member area;
• take and record payments and donations, and meet our financial and legal record-keeping duties;
• respond to your enquiries, reports and submissions;
• send you campaign updates, newsletters and other emails you have asked to receive;
• understand how the site is used so we can improve it (analytics).

Our legal bases

Under UK data protection law we must have a lawful basis for using your data. We rely on:

• Contract — to manage your account and membership and to process payments you have asked us to take.
• Consent — to send you marketing emails, and to run analytics cookies. You can withdraw this at any time (unsubscribe links are in every marketing email, and you can opt out of analytics using the “Manage cookies” link).
• Legitimate interests — to respond to your enquiries, keep the site secure, and run our organisation efficiently, where doing so does not override your rights.
• Legal obligation — to keep financial records and to comply with the law.

Political views and other optional details you choose to share

Your account has an “About you” area where you can optionally tell us things that help us match you to the campaigns most relevant to you, and understand which of our campaigns resonate with supporters of different parties — starting with whether you are a member of a UK political party and, if so, which. Information about your political opinions or affiliations is “special category” data under UK data protection law, so we only collect and store it where you have given us your explicit consent by ticking the consent box when you provide it. Our lawful basis for this data is your explicit consent (UK GDPR Article 9(2)(a)).

This information is private: it is never shown publicly and is never shared with other members of the PAC. We use it only to tailor and evaluate our own campaigns. Providing it is entirely optional — the default is “Prefer not to say” — and you can change it, or withdraw it completely, at any time from the “About you” page in your account, which deletes the stored details. Being a member of the PAC is fully compatible with membership of any political party, and withdrawing this information has no effect on your membership.

Email marketing

If you sign up as a supporter or member, or otherwise ask to hear from us, we will send you campaign updates and newsletters through our email provider, Brevo. Every email includes an unsubscribe link, and you can stop receiving them at any time. Unsubscribing from marketing does not affect service messages we need to send you about your account or a payment.

Who we share data with

We do not sell your data. We share it only with the service providers we use to run the site, and only as far as they need it to provide their service to us:

• Supabase — hosts our database and powers your account sign-in.
• Stripe — processes donations and membership payments.
• Brevo — sends our newsletters and campaign emails.
• Google Analytics — provides website usage statistics (only if you have not opted out).

Each of these is bound to protect your data and use it only on our instructions. We may also disclose data where we are legally required to do so, or to protect our rights, property or safety. Some of these providers may process data outside the UK; where they do, we rely on appropriate safeguards (such as UK/EU-approved data transfer terms).

Cookies and analytics

Cookies are small files stored on your device. We use two kinds:

Essential cookies (always on)

These are needed for the site to work and cannot be switched off. They include the sign-in cookies that keep you logged in to your account (set by Supabase), cookies set by Stripe during payment to prevent fraud, and a small cookie that remembers your cookie choice. We do not need your consent for these.

Analytics cookies (Google Analytics)

We use Google Analytics 4 to understand how visitors use the site — for example, which pages are popular and how people arrive. It sets cookies (typically named “_ga” and “_ga_…”) to recognise returning visitors and measure usage. This is anonymous, aggregated reporting; we do not use it to identify you personally.

Analytics is on by default, but you are in control. When you first visit, a small banner lets you accept or reject analytics. You can change your choice at any time using the “Manage cookies” link in the footer or below. If you opt out, we stop sending data to Google Analytics and clear its cookies from your browser.

You can also block or delete cookies through your browser settings, and Google provides a browser add-on to opt out of Google Analytics across all sites.

Campaign attribution

When you arrive from one of our own short links (for example a link we share on social media, of the form greatbritishpac.com/go/…), we log the click and set a first-party cookie so we can see, in aggregate, which posts and campaigns lead to sign-ups, memberships, donations or petition signatures — helping us focus our limited resources on what actually works. On key pages such as our membership Join page, we also record — in the same pseudonymous, aggregate way — which steps you reach (viewing the page, choosing a club, starting checkout), so we can find and fix where people get stuck. These records are pseudonymous (we store a one-way hash of your IP address, never the address itself), and we only set the linking cookie if you have not rejected cookies. We never sell this data or share it with advertisers.

How long we keep your data

We keep your data only for as long as we need it. Account and membership data is kept while your account is active and for a reasonable period afterwards. Payment and donation records are kept for as long as the law requires us to keep financial records. Enquiry messages are kept only as long as needed to deal with your query. Analytics data is retained by Google for a limited period and then deleted or aggregated. If you ask us to delete your data, we will, unless we are legally required to keep it; even then, it may remain on secure backups for a short time before being overwritten.

Keeping your data secure

We use technical and organisational measures to protect your data. Access to your account is protected by sign-in, the site is served over an encrypted (HTTPS) connection, and your data is held on secure, access-controlled systems. Payment details are handled entirely by Stripe over encrypted connections. If you believe your data has been misused or accessed without authorisation, please tell us straight away at info@greatbritishpac.com.

Your rights

Under UK data protection law you have the right to:

• Access — ask for a copy of the data we hold about you.
• Rectification — ask us to correct data that is wrong or incomplete.
• Erasure — ask us to delete your data.
• Restriction — ask us to limit how we use your data.
• Portability — ask us to transfer your data to you or another provider.
• Objection — object to our use of your data, including for marketing or where we rely on legitimate interests.
• Withdraw consent — at any time, where we rely on your consent (for example, marketing or analytics).

To exercise any of these rights, email us at info@greatbritishpac.com. We will respond within one month. There is normally no charge.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at https://ico.org.uk/ or by calling 0303 123 1113. We would, however, appreciate the chance to address your concerns first.

Children

This site is intended for adults. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

Changes to this policy

We may update this policy from time to time to reflect changes to the site or the law. The latest version will always be on this page, and significant changes will be highlighted. This policy was last reviewed in June 2026.

Contact us

For any privacy question, or to exercise your rights, email info@greatbritishpac.com or write to us at GBP Corporation Limited, Webb House, 20 Church Green East, Redditch, Worcestershire, B98 8BP.