1. Introduction
Reform UK Party Ltd ("Reform UK", "we", "our", or "us") is a registered political party and the primary Data Controller for personal data processed at a national level, including membership administration, national campaigning, fundraising, volunteer coordination, and compliance with electoral law.
In some circumstances, local parties, branches, candidates, elected representatives, or affiliated campaign groups may act as separate and independent Data Controllers where they determine the purposes and means of processing. In such cases, those entities are responsible for their own compliance obligations.
We process personal data to support democratic engagement and the functioning of a political party within the United Kingdom.
We are committed to processing personal data in accordance with:
- UK GDPR (Articles 5, 6, 9, 12-14, 21, 24, 30, 32, 35)
- Data Protection Act 2018 (including s.8(e) and Schedule 1)
- Data Use and Access Act 2025 (including ss.13-15 – fairness and transparency in automated decision-making and profiling)
- Privacy and Electronic Communications Regulations 2003 (PECR)
- Representation of the People Act 1983
- Political Parties, Elections and Referendums Act 2000 (PPERA)
- Equality Act 2010
- Human Rights Act 1998
- ICO guidance, including Democracy Disrupted (2018)
1A. Data Controller Responsibilities and Subject Access Requests
Reform UK Party Ltd acts as the central coordination point for data protection compliance and Subject Access Requests ("SARs") relating to personal data processed within national systems.
Where a request relates to data held by local or affiliated controllers, we may coordinate or redirect the request to ensure a lawful and timely response in accordance with Articles 12-15 UK GDPR.
1B. Use of Reform Pro
Reform UK operates a campaigning and engagement platform known as Reform Pro.
This includes processing of electoral register data and profiling for democratic engagement purposes. A separate Reform Pro Privacy Notice applies and should be read alongside this notice.
2. How We Collect Personal Data
We collect personal data directly and indirectly through:
- membership applications
- volunteer registrations
- campaign and petition sign-ups
- donations and fundraising
- event attendance
- website forms and subscriptions
- correspondence
- social media engagement
- the Electoral Register (as permitted under the Representation of the People Act 1983)
- publicly available sources
- permitted third-party data providers
Where personal data is obtained indirectly, we provide transparency in accordance with Articles 12-14 UK GDPR.
2A. Prize Draws, Competitions and Promotions
Where you choose to enter a prize draw, competition or promotional campaign operated by or on behalf of Reform UK Party Ltd, we will process your personal data for the purposes of administering that promotion and supporting lawful democratic engagement activities.
Data processed
This may include:
- your name;
- contact details (email, telephone, postal address);
- eligibility information; and
- political opinion data (special category data) where this forms part of the entry requirements (for example, voting intention or political preferences).
Lawful basis
Processing is carried out under:
- Article 6(1)(b) UK GDPR (performance of a contract);
- Article 6(1)(f) UK GDPR (legitimate interests – administration of promotions, fraud prevention, and campaign engagement);
Where special category data is processed:
- Article 9(2)(g) UK GDPR (substantial public interest); and
- Schedule 1, Part 2, paragraph 22 Data Protection Act 2018 (democratic engagement).
This processing is supported by Reform UK's Appropriate Policy Document (APD), which sets out the safeguards applied when processing special category data.
Use of data
Where political opinion data is collected via competitions or promotions, it may be used to:
- administer the promotion;
- verify eligibility and prevent fraud;
- contact participants and winners;
- understand engagement and supporter sentiment;
- inform campaign messaging and political engagement strategy;
- segment audiences for democratic engagement purposes.
Safeguards
We apply appropriate safeguards in accordance with Article 9 and Schedule 1 DPA 2018, including:
- strict data minimisation;
- role-based access controls;
- defined retention limits;
- secure processing measures;
- transparency at the point of collection.
Participation in a promotion is voluntary. Where provision of political opinion data is required to enter, this will be clearly explained at the point of collection, including the purpose and legal basis for processing.
3. Types of Personal Data We Process
We may process:
- name, address, email, telephone number
- date of birth (for eligibility checks)
- electoral registration information
- membership and payment details
- donation details and permissibility records (PPERA compliance)
- IP address, device identifiers, and cookie data
- campaign interests and preferences
- volunteer information
- political opinions you provide (including where required for competitions, campaigns, or engagement activities)
- profiling data for democratic engagement (see Section 5)
Special Category Data
In certain circumstances, including participation in competitions, campaigns, or engagement activities, provision of political opinion data may be required.
Where this applies:
- this will be clearly explained at the point of collection;
- processing will be carried out under Article 9 UK GDPR and Schedule 1 DPA 2018;
- processing will be limited to what is necessary for the stated purpose;
- appropriate safeguards will be applied in accordance with our Appropriate Policy Document.
We do not collect special category data beyond what is necessary for these specified purposes.
4. Our Lawful Bases
We rely on the following lawful bases:
5. Profiling and Automated Decision-Making
We conduct limited profiling to:
- identify areas of political interest;
- tailor campaign messaging;
- manage volunteer engagement;
- understand supporter demographics.
This processing is conducted under:
- Data Protection Act 2018 (s.8(e) – democratic engagement);
- Data Use and Access Act 2025 (ss.13-15).
We apply additional safeguards including:
- DPIAs for political profiling;
- transparency of logic involved;
- fairness and non-discrimination controls.
6. Who We Share Data With
We may share personal data with:
- the Electoral Commission (for compliance with PPERA);
- payment providers;
- CRM and communication platforms;
- accredited political data processors;
- volunteer management systems;
- law enforcement or regulators where required.
We may use third-party service providers to support membership events, conference registrations, ticketing and attendee management, including Livebuzz and Eventbrite.
All third parties are subject to UK GDPR-compliant contractual safeguards (Article 28).
7. International Transfers
Where personal data is transferred outside the UK, we ensure appropriate safeguards, including:
- adequacy regulations;
- UK International Data Transfer Agreements (IDTA);
- Standard Contractual Clauses (SCCs);
- transfer risk assessments where required.
8. Retention
We retain personal data only for as long as necessary:
- Membership records: duration of membership + 2 years
- Donation records: 6 years (statutory requirement)
- Campaign data: up to 48 months unless you object or opt out
- Electoral register data: as prescribed by law
Data is securely deleted or anonymised once no longer required.
9. Your Rights
You have the right to:
- access your personal data;
- request rectification;
- request erasure;
- restrict processing;
- data portability;
- object to processing (including profiling and political messaging);
- withdraw consent where applicable.
To exercise your rights, contact: dpo@reformparty.uk
10. Data Security
We implement appropriate technical and organisational measures, including:
- multi-factor authentication;
- encryption;
- role-based access controls;
- secure processing environments;
- regular security testing;
- data minimisation and retention controls.
11. Contact
Data Protection Officer
Reform UK Party Ltd
Millbank Tower, 21-24 Millbank, London SW1P 4QP
Email: dpo@reformparty.uk
12. How to Complain
If you have concerns about how we process your personal data, please contact us in the first instance.
If you remain dissatisfied, you may lodge a complaint with:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
Website: www.ico.org.uk
This is provided in accordance with Articles 13(2)(d), 14(2)(e), and 77 UK GDPR.