Privacy Policy

Last updated: 1 March 2026

Data Controller: Alba Continuation Group
Email: office@votealba.org

The Alba Continuation Group (“we”, “us”, “our”) is committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy explains what data we collect, why we collect it, how we use it, and your rights.

1. What Data We Collect

1.1 Declaration Form
When you sign the declaration, we collect your first name, last name, email address, town, and country. You may optionally provide your mobile phone number and upload a photograph. We also record your IP address and the date and time of submission.

1.2 Pledge Form
When you submit a pledge of financial support, we collect your first name, last name, email address, the pledge amount you select, and optionally a mobile phone number and a short message. We also record your IP address and the date and time of submission.

1.3 Communications Consent
On both forms, you may optionally consent to receive updates from the Alba Continuation Group by email and/or SMS. This consent is separate from the data processing consent and is entirely optional. You can withdraw communications consent at any time by contacting us or by replying “unsubscribe” to any message you receive.

1.4 Media Enquiry Form
When you submit a media enquiry, we collect your name, media outlet, email address, telephone number, deadline, and the text of your query.

1.5 Cookies and Analytics
We use essential cookies required for the site to function (such as your cookie consent preference). With your explicit consent, we also use Google Analytics (GA4) to understand how visitors use the site. Full details are provided in Section 7 below.

2. Legal Basis for Processing

We process your personal data on the following legal bases under Article 6 of the UK GDPR:

Consent (Article 6(1)(a)): When you voluntarily submit a declaration, pledge, or media enquiry, you consent to the processing of the data you provide for the purposes described. You may withdraw consent at any time by contacting us. For analytics cookies, we obtain explicit opt-in consent via our cookie banner before any analytics data is collected.

Legitimate interests (Article 6(1)(f)): We process IP addresses for anti-spam and security purposes, which is in our legitimate interest to maintain the integrity of the site. We have conducted a balancing test and determined that this processing does not override your rights and freedoms, as IP addresses are not displayed publicly and are used solely for moderation.

3. How We Use Your Data

Declarations: Your first name, last name, town, and country (and photograph, if provided) are displayed on the public declaration wall after moderation approval. Your email address, phone number, and IP address are not displayed publicly.

Pledges: Your pledge data is stored securely and used to record your non-binding expression of intent to contribute financially. Your email address may be used to contact you when a compliant donation mechanism is established, in accordance with Electoral Commission regulations. Pledge data is not displayed publicly.

Communications: If you consent to receive updates, we may email you or send SMS messages about the campaign, ballot updates, and key developments. We will not share your contact details with any third party for marketing purposes. You can withdraw consent at any time.

Media enquiries: Your data is used solely to respond to your enquiry within the timeframe you specify.

Analytics: If you consent to analytics cookies, anonymised usage data (pages visited, session duration, approximate location at city level) is collected by Google Analytics. This data cannot identify you personally. IP addresses are anonymised before processing.

4. Content Moderation

Submitted declarations (text and photographs) are screened for appropriateness before publication using automated moderation tools. This screening checks for profanity, hate speech, spam, or content unrelated to the campaign. Moderation decisions are reviewed by a human administrator before final approval or rejection. Content that is rejected is deleted and not stored beyond the moderation process.

5. Data Sharing and Transfers

We do not sell, rent, or share your personal data with any third parties for marketing purposes.

Your data may be processed by the following service providers, who act as data processors on our behalf:

• Web hosting provider: Our website is hosted on servers located within the United Kingdom or the European Economic Area.
• Anthropic (content moderation): Submitted text and images may be sent to Anthropic’s API for automated content moderation. Anthropic processes this data in accordance with their privacy policy and does not retain submitted content beyond the moderation request.
• Google Analytics: If you consent to analytics cookies, anonymised usage data is processed by Google. Google’s data processing terms apply. IP anonymisation is enabled, and no advertising features are used.

We do not transfer your personal data outside the United Kingdom or the European Economic Area unless adequate safeguards are in place as required by UK GDPR.

6. Data Retention

Declarations: Retained for the duration of the campaign and for up to 12 months after the Scottish Parliament election on 7 May 2026, unless you request earlier deletion.

Pledges: Retained until the pledge is either fulfilled through a compliant donation mechanism, or withdrawn by you, and for up to 12 months thereafter.

Media enquiries: Retained for up to 12 months after the enquiry is resolved.

IP addresses: Retained for up to 6 months for anti-spam purposes, then permanently deleted.

Cookie consent preference: Stored as a cookie on your device for up to 12 months.

7. Cookies

A cookie is a small text file stored on your device when you visit a website. We use two categories of cookies:

7.1 Essential Cookies (always active)

These cookies are strictly necessary for the website to function. They cannot be disabled.

• cookie_consent – Stores your cookie preference (accepted or essential). Expires after 12 months.
• PHPSESSID – Session cookie required for form submissions and admin functions. Expires when you close your browser.
• maintenance_bypass – Used during site maintenance to allow authorised access. Expires when you close your browser.

7.2 Analytics Cookies (require your consent)

These cookies are only set if you click “Accept All” or enable analytics in our cookie settings panel. They help us understand how visitors use the site so we can improve it.

• _ga – Google Analytics identifier. Expires after 2 years.
• _ga_[ID] – Google Analytics session identifier. Expires after 2 years.
• _gid – Google Analytics session identifier. Expires after 24 hours.

If you choose “Essential Only”, no analytics cookies are set and Google Analytics does not load. You can change your preference at any time by clicking “Cookie Settings” in the footer of any page.

We do not use any advertising cookies, social media tracking cookies, or third-party marketing cookies.

8. Your Rights

Under the UK GDPR, you have the following rights in relation to your personal data:

• Right of access (Article 15) – You can request a copy of the personal data we hold about you.
• Right to rectification (Article 16) – You can request correction of inaccurate personal data.
• Right to erasure (Article 17) – You can request deletion of your personal data. We will comply unless we have a lawful reason to retain it.
• Right to restrict processing (Article 18) – You can request that we limit how we use your data.
• Right to data portability (Article 20) – You can request your data in a structured, machine-readable format.
• Right to object (Article 21) – You can object to processing based on legitimate interests.
• Right to withdraw consent – Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, contact us at office@votealba.org. We will respond within one month of receiving your request, as required by law.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These include encrypted database connections (SSL/TLS), secure server infrastructure, access controls limiting data access to authorised administrators, and regular security reviews.

10. Children’s Data

This website is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has submitted data through this site, please contact us and we will delete it promptly.

11. Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk

We would appreciate the opportunity to address your concerns before you contact the ICO. Please email us at office@votealba.org in the first instance.

12. Changes to This Policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated “Last updated” date. We encourage you to review this page periodically.

13. Contact

For any questions about this privacy policy or your personal data, contact:
Alba Continuation Group
Email: office@votealba.org