Your rights
UK data protection law gives you real, enforceable rights over the personal data we hold. Every one of them works here, from one place, across every application we run. No forms to print, no addresses to hunt for — sign in to the portal and press the button.
The clock, in plain words
For each of the rights below, the law gives us one month to respond (UK GDPR Article 12(3)). We aim for days. For genuinely complex or numerous requests the law lets us take up to two further months — but only if we tell you within the first month, with reasons.
One honest wrinkle from the Data (Use and Access) Act 2025: if we need to check you are who you say you are, or to ask what exactly you want, the clock pauses until you answer — then carries on where it left off. We'll always tell you when it's paused and why.
Access — see what we hold
UK GDPR Article 15
Ask for a copy of everything we hold about you, along with why we hold it, where it came from and who it's shared with. One request in the portal searches every application and assembles a single downloadable bundle.
Rectification — correct what's wrong
UK GDPR Article 16
If something we hold is inaccurate or incomplete, you can have it corrected. Tell us what's wrong in the portal and we'll fix it in every application that holds it.
Erasure — have it deleted
UK GDPR Article 17
The "right to be forgotten". Ask us to delete your data and we will, everywhere, unless a specific law requires us to keep something (we'll say exactly what and why). Erasure also puts your address on the do-not-contact list, so deleting your data never means hearing from us again by accident. Start in the portal.
Portability — take it with you
UK GDPR Article 20
Get the data you gave us in a structured, machine-readable format you can reuse anywhere. Request an export in the portal.
Restriction — press pause
UK GDPR Article 18
While we check an accuracy dispute or an objection, you can require us to stop using your data — we keep it, frozen, but don't touch it until the question is settled. Ask in the portal.
Objection — say no
UK GDPR Article 21
You can object to our processing of your data, and for direct marketing the right is absolute: no balancing test, no exceptions, no discretion on our side. For a political party, "direct marketing" includes campaigning and fundraising messages — object once and every application stops, permanently.
Object in the portal — the suppression takes effect the moment we receive it, before anything else happens.
The marketing opt-out — one click, everywhere
PECR regulation 22; UK GDPR Article 21(3)
Electronic marketing — email and text — needs your consent in the first place, and you can withdraw it at any time. The opt-out page takes you off every list in one click, and lets you check the do-not-contact list ever after.
Complain to us — and be answered
DPA 2018 s.164A
Since June 2026 the law requires every controller to make complaining easy, with an electronic form, and to acknowledge within 30 days. Ours is right here — and we promise the acknowledgment, on the clock, in public.
Two ways to complain
Both routes are yours, both are free, and you never need our permission to use either. They are equals — you don't have to complain to us first.
To us
Our electronic complaint form (DPA 2018 s.164A). We acknowledge within 30 days and tell you the outcome — the whole register is deadline-tracked and audited.
To the regulator
The Information Commissioner's Office (ICO) is the UK's independent data protection authority. Complain directly to them (DPA 2018 s.165), whenever you wish.