Privacy notice

The controller

Who we are

England 927 is operated by Rob Green, trading as Greystokes Foundation. Rob Green is the current data controller. Greystokes Foundation is in the process of being incorporated as a limited company; incorporation has not yet been completed.

For anything to do with your data, write to info@england927.com.

The details

What we collect

To sign the petition, you provide your name and email address and declare that you are a UK resident or a British citizen living abroad. Age, gender, postcode and your answer to our voting-intention question are optional. We record the petition wording, your consent choices and their dates, and whether you confirmed your email. If you separately join the newsletter, we store your name, email, optional postcode and consent.

We do not run advertising trackers or make automated decisions about you. The petition keeps a keyed fingerprint of your IP address for short-term abuse prevention, rather than storing the address in your signature record. Hosting access logs may separately contain IP addresses and requested URLs. The private dashboard uses a necessary login-session cookie.

The purpose

Why we collect it

We use consent under UK GDPR Article 6(1)(a) to verify and count your support. The petition agreement also asks for explicit consent under Article 9(2)(a) to any optional research answers you choose to give, including political opinions. You may leave every optional answer blank and still sign. We use that research to understand our supporters, not to target individuals with political persuasion. Separate, optional consent covers campaign and fundraising emails. Signing does not subscribe you. Fraud prevention relies on our legitimate interest in keeping the petition accurate. You may withdraw consent without affecting the lawfulness of earlier processing.

Storage & access

Where it is kept, and who sees it

Petition records are held in a protected database on the campaign hosting provided by GoDaddy, accessible to authorised administrators. Google Workspace processes email addresses and message content to deliver confirmation and other requested emails through the Gmail API. These providers may process information internationally under their applicable data-processing terms and transfer safeguards. If you provide a postcode, we send that postcode alone to postcodes.io to identify its administrative area for private supporter analytics. For petition signatures this happens after email confirmation and only with your optional research consent. We do not send your name, email, age, gender or political answer to that service. The separate newsletter form also uses the service to locate support on the private map.

We will present the confirmed signature total to the Government and invite media attention. We will not publish or hand over your email address, political answer or other personal details as part of that presentation without a further appropriate basis and notice. Only anonymous research summaries may be published, with small groups suppressed to avoid identifying people. We do not sell the supporter list. How we handle donations is explained under Donations below.

Donations

What we keep when you give

Donations are taken by Stripe (the Stripe group, including Stripe Payments UK, Ltd.), on Stripe's own secure payment page. Your card details are entered there and never reach England 927. Stripe takes your payment for us and also uses some details for its own purposes, such as preventing fraud; its privacy notice is at stripe.com/gb/privacy.

When you donate, we keep a record of the payment: your name, your email address, the amount in pounds, whether it was one-off or monthly, the date, Stripe's reference numbers and event number, and the page you donated from. If a payment is refunded, a monthly gift is cancelled, or a monthly payment fails, we add a note of that to your record. We do not store a postcode or location for donations.

We keep these records to count donations, show the total on our private dashboard, stop a payment being counted twice, and send you a receipt. Rob Green, trading as Greystokes Foundation, is the controller of these records. Our lawful bases are legitimate interests (taking and recording your donation, and sending your receipt) and legal obligation (keeping accounting records).

We keep donation records for six years, because we must keep accounting records for that long. Daily backup copies of them are kept for 14 days.

Rob Green sees your name, email address, amount, and reference on our private dashboard and in Stripe's own dashboard. Stripe processes the payment, and receipts are sent through Google Workspace. Records are kept in a private folder on our hosting provider, GoDaddy, that the web cannot read. Stripe, Google, and GoDaddy may process these details outside the UK, including in the United States, under their data-processing terms and transfer safeguards; Stripe's safeguards include the UK International Data Transfer Addendum and the UK Extension to the EU-U.S. Data Privacy Framework.

After a payment goes through, we email you a receipt showing the amount, the date, and the reference. It is not a tax receipt.

If you want to correct your details or cancel a monthly gift, reply to your receipt email or write to info@england927.com. We cannot erase a donation record before the six years are up, because we must keep it for our accounts.

Retention

How long we keep it

Unconfirmed requests are held privately while you confirm your email and are excluded from supporter tables, analytics and supporter backups. Confirmation links expire after 48 hours; the scheduled maintenance worker then erases any request that remains unconfirmed, together with its queued email and delivery records. Rate-limit fingerprints are removed after approximately 24 hours as new requests arrive. Confirmed signatures remain while needed for the continuing petition, unless you withdraw them. We review that need annually; the one million milestone is not a reason to keep personal data forever. We remove campaign records within 12 months of the campaign ending, except donation records, which we keep for six years as explained under Donations. Downloaded backups must be kept securely and removed when obsolete; erasure requests must also be applied to any restored backup.

Under UK GDPR

Your rights

Under UK GDPR you can ask us to:

• Tell you what we hold about you, and give you a copy.
• Correct anything that is wrong.
• Delete your details entirely.
• Stop using them, or restrict what we do with them.
• Withdraw your consent, which you can do at any time.

The management link in your confirmation email lets you unsubscribe from petition campaign emails, erase optional research answers, or withdraw your signature and delete its details. For access, correction, portability or help with a separate newsletter subscription, email info@england927.com. We normally respond within one month, subject to the extensions permitted by law. Withdrawing research or email consent does not withdraw your signature.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk, though we would rather you told us first so we can have a fair chance at putting  it right.

Keeping you posted

Changes to this notice

Our eligibility declaration follows the published approach of the UK Parliament petitions service: British citizens and UK residents may sign. See Parliament's eligibility guidance and its privacy notice. Our petition is independent: email confirmation is not proof of identity or citizenship, postcode is optional here, and Parliament's statutory legal basis does not apply to us. Material changes to our own processing will be explained here and, where appropriate, directly to affected supporters.

Last updated: the 19th of October 2026.