Privacy Policy

1. Important information and who we are

This privacy policy explains how Rise Movement (“we”, “us”, or “our”) collects and uses your personal data through your use of our website at www.risemovement.co.uk, including any data you may provide when you sign up to our movement, subscribe to communications, or make a donation.

This website is not intended for children and we do not knowingly collect data relating to children.

Data Controller

Rise Movement is the data controller and responsible for your personal data. If you have any questions about this privacy policy, including any requests to exercise your legal rights, please contact us at: privacy@risemovement.co.uk.

2. The types of personal data we collect about you

Personal data means any information about an individual from which that person can be identified. We may collect, use, store and transfer the following kinds of personal data about you:

• Identity Data: your first name and last name.
• Contact Data: your email address and postcode.
• Financial Data: payment card details provided when making a donation. These are processed directly by Stripe and are not stored by us (see section 6 for details on how Stripe handles your data).
• Transaction Data: details of donations you have made, including the amount and date.
• Communications Data: your preferences in receiving communications from us.

3. How is your personal data collected?

We collect data from you directly through the following methods:

• Signup form: When you complete the signup form on our website, providing your name, email address and postcode.
• Donation form: When you make a donation through our website, your payment is processed by Stripe. We receive your name and transaction details (amount, date, and a truncated reference to your payment method), but your full payment card details are handled entirely by Stripe and are never stored on our systems.
• Correspondence: When you contact us by email or through our contact form.

We do not use any analytics services, advertising networks, or tracking technologies on our website. We do not collect Technical Data such as IP addresses, browser types, or browsing behaviour for analytics purposes.

4. How we use your personal data

Legal basis

The law requires us to have a legal basis for collecting and using your personal data. We rely on the following:

• Consent: Where you have actively agreed to receive communications from us by completing the signup form. You may withdraw your consent at any time.
• Performance of a contract: When you submit a donation, you are entering into an agreement with us for us to process that donation and, where applicable, provide you with a receipt or confirmation. Processing your payment data is necessary to fulfil that agreement.
• Legitimate interests: Where it is necessary for our organisational purposes, such as administering our supporter base, understanding the geographic reach of our movement, and maintaining our website. We ensure that our interests do not override your rights.
• Legal obligation: Where we need to comply with a legal or regulatory obligation, such as maintaining financial records.

Purposes for which we use your personal data

Opting out of communications

You can ask us to stop sending you communications at any time by following the opt-out or unsubscribe link in any communication we send you, or by contacting us at privacy@risemovement.co.uk.

Is providing your personal data required?

Providing your personal data is voluntary. However, if you do not provide the required information on our signup form (name, email and postcode), we will be unable to register you as a supporter or send you communications. If you do not provide your name and payment details when making a donation, Stripe will be unable to process the transaction. There are no statutory requirements to provide us with your personal data.

5. Cookies

Our website does not use any analytics, advertising, or tracking cookies. The only cookies that may be set are those that are strictly necessary for the website to function (such as session management) and those set by Stripe to prevent fraud when processing donations. These are classified as strictly necessary cookies and do not require your consent under UK law.

6. Disclosures of your personal data

We may share your personal data with the following parties where necessary:

Stripe (payment processing)

When you make a donation, your payment is processed by Stripe, Inc. Stripe performs a dual role in relation to your personal data:

• As a data processor on our behalf: Stripe processes your payment transaction in order to complete the donation you have requested. In this capacity, Stripe acts on our instructions and processes your data solely for the purpose of fulfilling the transaction.
• As an independent data controller: Stripe also collects and uses certain personal data for its own purposes, including fraud prevention and detection, complying with financial regulations, and improving its services. When acting as an independent controller, Stripe determines the purposes and means of processing and is directly responsible for that processing under its own privacy policy.

Your full payment card details are entered directly into Stripe’s secure payment form and are never transmitted to or stored on our systems. Stripe is certified to PCI DSS Level 1, the highest level of certification in the payments industry. We receive only your name, donation amount, date, and a truncated reference to your payment method (e.g. the last four digits of your card).

For full details on how Stripe handles your personal data, please refer to: Stripe Privacy Policy and Stripe Privacy Centre.

Other third parties

• Email service provider: If we use a third-party platform to send communications, that provider will process your name and email address on our behalf as a data processor.
• HM Revenue & Customs and regulators: Where required by law for financial reporting purposes.
• Professional advisers: Including accountants and legal advisers, where necessary.

We require all third parties acting as data processors to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process it for specified purposes and in accordance with our instructions.

7. International transfers

Stripe, Inc. is headquartered in the United States and may transfer your personal data outside the UK in order to process donations and fulfil its obligations as both a data processor and an independent data controller. Where your data is transferred outside the UK, we ensure a similar degree of protection is afforded by relying on one or more of the following safeguards:

• Transfers to countries deemed by the UK to provide an adequate level of data protection.
• The UK Extension to the EU-US Data Privacy Framework, where the recipient is certified under that framework.
• The UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.

For information on Stripe’s international data transfer mechanisms, see: Stripe Privacy Policy – International Transfers.

8. Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We limit access to your personal data to those individuals who have a genuine need to access it.

We have procedures in place to deal with any suspected personal data breach and will notify you and the Information Commissioner’s Office where we are legally required to do so.

9. Data retention

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements.

Signup and contact data

We retain your signup data (name, email, postcode) for as long as you remain an active supporter. We review our supporter records every 12 months to identify inactive accounts. Due to the nature of political organising, where supporters may have extended periods of reduced engagement before returning to active involvement, we retain the data of inactive supporters for up to 5 years from the date of their last engagement with us.

To ensure we are not holding data unnecessarily, we take the following steps to manage inactive supporter records:

• After 2 years of inactivity: We will send you a re-engagement communication to check whether you wish to remain on our records and continue receiving communications from us.
• After 4 years of inactivity: We will send you a final reminder, informing you that your data will be removed if we do not hear from you.
• After 5 years of inactivity: If you have not responded to our re-engagement communications or otherwise engaged with us, your personal data will be erased within 30 days.

You may request deletion of your data at any time, regardless of these timelines, by contacting us at privacy@risemovement.co.uk.

Donation and transaction data

We retain records of donations (including your name, the amount, and the date of the transaction) for six years after the date of the transaction, in accordance with HMRC requirements for financial record-keeping.

Correspondence

We retain correspondence for as long as necessary to resolve the matter, and for up to two years thereafter.

In some circumstances we may anonymise your personal data so that it can no longer be associated with you, in which case we may use this information indefinitely without further notice to you.

10. Automated decision-making

We do not carry out any automated decision-making or profiling using your personal data. No decisions that have a legal or similarly significant effect on you are made by solely automated means.

11. Your legal rights

Under UK data protection law, you have the following rights in relation to your personal data:

• Right of access: You can request a copy of the personal data we hold about you.
• Right to rectification: You can ask us to correct any inaccurate or incomplete personal data.
• Right to erasure: You can ask us to delete your personal data in certain circumstances.
• Right to object: You can object to our processing of your personal data where we rely on legitimate interests. You have an absolute right to object to direct marketing at any time.
• Right to data portability: You can request that we transfer your data to you or a third party in a structured, machine-readable format.
• Right to restrict processing: You can ask us to suspend the processing of your personal data in certain circumstances.
• Right to withdraw consent: Where we rely on your consent, you may withdraw it at any time. This will not affect the lawfulness of any processing carried out before you withdrew your consent.

If you wish to exercise any of these rights, please contact us at privacy@risemovement.co.uk. We will respond to all legitimate requests within one month.

You will not normally have to pay a fee. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive.

12. Complaints

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to address your concerns before you approach the ICO, so please contact us in the first instance.

13. Changes to this privacy policy

We keep this privacy policy under regular review. Any changes will be posted on this page with an updated revision date. We encourage you to check this page periodically.

14. Third-party links

Our website may include links to third-party websites and social media platforms, including X (Twitter) and Instagram. We do not control these third-party websites and are not responsible for their privacy practices. We encourage you to read the privacy policy of every website you visit.

15. Contact details

If you have any questions about this privacy policy or about our use of your personal data, please contact us:

Rise Movement

Email: privacy@risemovement.co.uk