Privacy notice

Who is responsible

The data controller is Eleanor Rofe, as a candidate in the SDP leadership election. The campaign is separate from the party: nothing you send through this site goes to the SDP as an organisation unless you ask us to pass it on.

Questions about your data, and requests to see or delete it, go to info@sdpthatcan.com.

What we collect, and why

Nothing is collected until you choose to send something. The site has no login and sets no cookies.

• Ask a question: your name, email address and the question, whether you are happy for it to be answered publicly, the page you sent it from, the consent wording you agreed to, and the time. We use these to reply to you and, if you ticked the box, to answer on the Updates page without your name.
• I'd like to help: your name, email address, the area you chose and what you said you could bring, plus the page, consent wording and time. We use these to get in touch about helping.
• Book a conversation: handled by Calendly. It collects your name, email address and the time you choose, under Calendly's own privacy notice. We see the booking and use it to hold the call.
• Surgeries: registration is handled by Zoom, which collects your name and email address under Zoom's own privacy notice. We see who registered so we can run the session. Surgeries are recorded so that we can write up what members said. The recordings are not published; if you join with your camera or microphone on, you will be in the recording.
• WhatsApp announcements: joining the group is handled by WhatsApp (Meta) under its own privacy notice. The group's admins can see your phone number, and so can Meta. It is announcements only; you can leave at any time and your number goes with you.
• Website analytics: we use Vercel Web Analytics to count page views. It sets no cookies and does not identify you. We see aggregate figures such as which pages are read, from which country and on what kind of device.
• Server logs: like every website, the hosting provider (Vercel) briefly records the IP address and browser of each request for security and to keep the site running. We do not use these to identify visitors.

Party membership and political opinions

If you write to a leadership campaign, it is a fair inference that you are an SDP member and that you hold political opinions. Data protection law treats both as special-category data, which needs a stronger basis than most personal data.

Our basis for the forms is your explicit consent: the wording shown under each form's button says what you are agreeing to, and we store that exact wording with what you send. You can withdraw consent at any time by emailing info@sdpthatcan.com, and we will delete what you sent.

Our basis for analytics and server logs is our legitimate interest in running a working, secure website. Neither identifies you.

Where your information is stored

• Form submissions are stored in a database run by Neon in London, in the United Kingdom.
• The emails we send you, and the notifications that reach the campaign inbox, are delivered by Resend, whose servers are in the United States. Only your name, email address and message pass through it, for as long as it takes to deliver. Resend is certified under the UK Extension to the EU-US Data Privacy Framework, and its data processing agreement includes the UK Addendum to the standard contractual clauses.
• The campaign inbox, info@sdpthatcan.com, is a Zoho Mail account.
• The site itself is hosted by Vercel, so a form submission passes through Vercel's servers on its way to the database.
• Calendly, Zoom and WhatsApp hold what you give them under their own notices, linked above.

We do not sell your details, use them for advertising, or pass them to anyone else.

How long we keep it

• Form submissions are deleted automatically 60 days after you send them. A job runs every night to remove anything past its date.
• Emails in the campaign inbox are deleted [when the leadership election result is declared].
• The WhatsApp announcement group is closed and deleted [when the election result is declared].
• Questions answered on the Updates page stay published, without your name, as part of the campaign record.
• Calendly bookings, Zoom registrations and any surgery recordings are kept [until the election result is declared], then deleted.

Your rights

Under UK data protection law you can ask us to:

• tell you what we hold about you, and give you a copy
• correct anything that is wrong
• delete it
• stop using it, or restrict how we use it
• withdraw your consent, which does not affect anything done before you withdrew it

Email info@sdpthatcan.com, or reply to any message we have sent you. We will answer within a month, usually much sooner. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113, though we would rather hear from you first.

Changes to this notice

If we change how the site handles your information, we will update this page and the date at the top. The forms, the WhatsApp group and this notice are for the leadership campaign only, and will be closed once voting opens on 16 November 2026.