Winning With Williams — home

Privacy policy

This explains what personal data Winning With Williams collects through this website, its forms and campaign services, including information received via third parties and donations, and what we do with it.

Last updated:

1. Who we are

This website is promoted by Mathew Wilkinson on behalf of Adam Williams, of High Wycombe ("we", "us", "our"). It represents Adam Williams’s individual campaign for leader of the Social Democratic Party, rather than an official party website.

For the purposes of UK data protection law, the data controller named in this notice is Keenan Clough, acting in his campaign capacity as Rules and Compliance Officer.

Keenan coordinates the campaign’s data-protection arrangements, including maintaining this notice, overseeing donor-check records and access permissions, organising responses to privacy enquiries and rights requests, coordinating retention and deletion, and working with the website and service administrators on privacy settings and any data incidents. He is the campaign’s main privacy contact.

Authorised campaign volunteers may handle information under the controller’s instructions where necessary for their roles. If you have questions about this policy or how your data is handled, contact us at winningwithwilliams2026@gmail.com.

2. The data we collect

We collect personal data in a few different ways:

Data you give us directly. This includes information you provide when signing up to our mailing list, contacting us, volunteering, requesting donation access or making a donation.

Data collected through Google Analytics. The site uses Google Analytics in Google’s consent mode. If you accept analytics cookies, Google sets cookies on your device and receives website usage information such as pages viewed, how you arrived at the site, approximate location, and device and browser information. Until you accept, and if you decline, no analytics cookies are set and nothing is stored on your device, but Google may still receive a minimal cookie-free signal that a page was viewed (the page address, browser type and approximate location). See section 8. We do not send form contents, donor details, membership numbers or email addresses to Google Analytics.

Technical information. Our hosting and security services process technical request information, which may include IP addresses, request times, requested pages and browser information, to deliver the website and protect it against misuse. We limit any campaign-accessible logs to what is necessary for those purposes. Retention follows the criteria in section 7.

Data received through services or from other sources. Mailchimp handles mailing-list signups and subscriptions; Google Forms handles donation-access requests; Donorbox and PayPal provide relevant donor and transaction information. An authorised party contact may confirm whether a prospective donor is a member in good standing. We record relevant check outcomes and their date and source.

If you interact with our social media pages on Facebook, Instagram, X or YouTube, those platforms may make limited interaction information available to us under their own privacy policies. We are responsible for our use of information received. Providers’ own notices explain their separate processing; this does not remove our responsibility for the services we configure or instruct.

3. Why we process your data, and our legal basis for doing so

We use information only for the relevant purposes described below.

Sending campaign updates. We send news, event information and ways to help to people who choose to subscribe. Our basis is consent under UK GDPR Article 6(1)(a). Where the subscription reveals political opinions, we rely on explicit consent under Article 9(2)(a). You can withdraw consent at any time by unsubscribing or contacting us. Separately, we use consent for optional subscriber-level click tracking, as explained in section 8.

Administering donation requests and campaign finances. We use relevant information to confirm eligibility, communicate about requests, match payments, reconcile records and apply the internal election rules. Our Article 6 basis is legitimate interests in administering a lawful campaign and preventing unauthorised contributions. You can object to processing based on legitimate interests.

Statutory donation checks and reporting. Where processing is necessary to fulfil obligations under the Political Parties, Elections and Referendums Act 2000 (PPERA), our Article 6 basis is legal obligation. Internal party rules are additional requirements, not themselves statutory obligations.

Political information in donor records. Membership and donation information can reveal political opinions. For voluntary donation-access requests and membership verification, we obtain explicit consent under Article 9(2)(a), including consent for the necessary confirmation with an authorised party contact and the relevant election-rule disclosures described in section 5. Refusing this verification means we cannot approve donation access, but does not require you to subscribe to emails.

For processing necessary to perform statutory political-finance functions under PPERA Schedule 7, we rely on Article 6(1)(c) and, where its requirements are satisfied, Article 9(2)(g), together with Data Protection Act 2018 section 10(3) and Schedule 1 Part 2 paragraph 6. This condition requires necessity for a statutory function and reasons of substantial public interest. Our use is limited to required checks, records and disclosures supporting lawful and transparent political finance, with the safeguards and appropriate policy document required by Schedule 1 Part 4. Internal party rules alone do not provide this statutory condition. Where necessary for establishing, exercising or defending legal claims, Article 9(2)(f) may apply.

Responding to enquiries and organising volunteering. Our Article 6 basis is legitimate interests under Article 6(1)(f) in responding to people who contact us and organising assistance they offer. If we need to process political opinions or other special-category information for these purposes, we obtain explicit consent under Article 9(2)(a). Please do not include unnecessary sensitive information in your message. Contacting us or volunteering does not automatically add you to the mailing list.

Understanding website usage. For analytics cookies we rely on your consent under Article 6(1)(a), alongside the Privacy and Electronic Communications Regulations 2003 (PECR), which require your permission before non-essential cookies are set. Where consented analytics processing reveals political opinions, we rely on explicit consent under Article 9(2)(a). The minimal cookie-free signal described in section 8, which Google may receive if you have not accepted or have declined analytics cookies, is processed on the basis of our legitimate interests under Article 6(1)(f) in counting visits to the site in aggregate. You can object to this processing by contacting us. We do not use browsing data to build individual political-opinion profiles or to infer anyone’s political opinions.

Website operation and security. We rely on legitimate interests for technical processing necessary to provide the site and protect it against misuse, subject to an assessment of the information collected and the relevant safeguards.

Separate choices. Requesting donation access, donating, contacting us or volunteering does not automatically subscribe you to campaign emails. Administrative messages about a request or payment are separate from promotional updates. Refusing marketing consent does not affect your ability to request donation access.

4. Third-party data processors and who we share data with

We use a small number of providers to operate campaign services. Their roles depend on the service: some process data under our instructions, while others also act as independent controllers for their own legal or operational purposes.

We limit access within the campaign to authorised people who need the information for their work. We share only information relevant to each recipient’s purpose. The providers’ notices are available here: Mailchimp / Intuit, Google, including Forms, Sheets and Analytics, Donorbox, PayPal and Cloudflare.

Share buttons. The social-platform “Share this page” buttons are ordinary links. We do not load Facebook, X, WhatsApp or LinkedIn scripts for these buttons. Clicking a platform link sends the shared page information to that service, whose own privacy policy then applies. Native sharing and copying a link use your browser or device’s sharing functions. These sharing controls are separate from any embedded media or other services described in this policy.

We do not sell your personal data to anyone, for any purpose.

5. Donations

Requesting access. The election annex permits donations only from party members in good standing, regardless of amount. A prospective donor supplies information through our request form. An authorised party contact confirms membership eligibility, and we send the donation link after the necessary checks. We then match any payment to the verified donor. Additional checks may be necessary if details differ or circumstances change.

We ask for the intended amount so we can identify additional checks and reporting requirements. It is not a commitment or a payment. Without the information necessary to complete eligibility checks, we cannot approve donation access.

Statutory and internal rules. Donations for Adam’s leadership campaign are subject to the PPERA rules for an individual regulated donee, rather than the rules for a candidate at a public election. The party’s election annex adds restrictions, including membership eligibility and the recording of all donations.

What we collect and why. We retain relevant donor details, membership confirmation, transaction information, donation amount and dates, and any necessary statutory eligibility evidence. The information supports verification, reconciliation, refunds, campaign records and required reporting. Payment providers handle payment credentials; we do not store full card numbers.

Notification and disclosure. Under the annex, party members who donate are treated as campaign-team members and must be notified to the Returning Officer. Required donation information is included in the campaign return. Where Electoral Commission reporting is required, reportable donor information may become public through the Commission’s statutory publication arrangements. We do not publish donors’ contact details on our website merely because they donate.

Unexpected or refused payments. A donation link could be forwarded or a payment could fail to match an approved donor. We may need to investigate, request information or return the payment. We retain the information necessary to document the outcome and meet applicable requirements.

Retention and consent. We retain donation records while completing verification, reconciliation, refunds and the required returns to the Returning Officer and, where applicable, the Electoral Commission, and while resolving any related queries, complaints or legal matters. The annex also covers relevant receipts during the calendar month following the Election Period. We then securely delete records no longer required, retaining only information necessary for any continuing legal obligation or specific unresolved matter. Records are reviewed at campaign closure and again after those matters are completed; website shutdown alone does not trigger deletion of required financial evidence.

Withdrawing consent stops future processing that depends on that consent. It does not undo previous lawful processing. Financial records may be retained independently where an applicable legal obligation and special-category condition require or permit it, as explained in section 3. Information retained for those purposes is not used for campaign marketing.

6. International data transfers

Some campaign services use servers or support teams outside the UK, including in the United States, the European Economic Area and other countries where their providers or subprocessors operate. This is an international data transfer: information may be stored, accessed or processed abroad even when you use a UK website.

UK GDPR Articles 44–49 require a lawful transfer arrangement for restricted transfers. Depending on the recipient and service, this may be UK adequacy regulations, including the UK Extension to the EU–US Data Privacy Framework for covered certified recipients, or approved contractual safeguards such as the UK International Data Transfer Agreement or the UK Addendum to EU Standard Contractual Clauses.

These are the providers’ published arrangements; the mechanism applicable to a particular transfer depends on the service, recipient and contract. We assess the arrangements applicable to the campaign’s use before making a restricted transfer. You can contact us for information about the applicable safeguards and how to obtain a copy. Provider notices are linked in section 4.

7. How long we keep your data

We keep campaign operational information only for this campaign. At official campaign closure, when the campaign website is taken down, we stop further collection and initiate deletion of mailing-list data, subscriber engagement records, campaign Analytics data, closed enquiries, volunteer records and unsuccessful or incomplete donation-access requests from systems and copies under our control.

We stop campaigning and promotional communications at the deadline specified by the election rules, even if formal campaign closure or website removal happens later. We do not transfer the mailing list to another campaign or to the party, or use it for unrelated activity, without a separate lawful arrangement and any necessary consent.

Donation, transaction and verification records follow the separate criteria in section 5. Minimal consent evidence, suppression records or incident information may be kept where necessary for a specific continuing compliance obligation or dispute; they are not used for further campaigning and are deleted when that need ends.

Technical logs accessible to the campaign are kept only as necessary for website operation, security and resolving incidents, and are included in the closure review. We request or initiate deletion through the provider’s available controls. Deletion jobs and backups may take time to expire under provider schedules; retained backup information is not used for renewed campaigning. Providers acting independently, including payment services, may retain their own records under their legal obligations and privacy notices.

Taking down the website does not itself delete information from Mailchimp, Google or payment services; those systems and any campaign exports are included in our closure process.

8. Cookies and similar technologies

This site uses Google Analytics to help us understand how the site is used, including pages viewed, referral information, device and browser type, and approximate location. Google processes that information and may process it outside the UK, as described in section 6.

We ask you to accept or reject optional analytics cookies through the cookie banner. Rejecting them does not prevent you from using the website. You can change your choice through “Cookie preferences” in the footer. Our Cookies page provides the itemised cookie information.

How consent works for analytics. Google Analytics loads in a mode where analytics storage is denied by default, so no analytics cookies are set until you accept. Accepting tells Google that analytics storage is permitted. Rejecting, or withdrawing a previous acceptance, tells Google it is denied and deletes any Google Analytics cookies already on your device. Because of how Google’s consent settings work, Google may still receive the minimal cookie-free signal described in section 2 when you have not accepted or have declined. It is not tied to any identifier on your device, and we only see it as part of aggregate statistics. Necessary hosting and security processing is separate, as described in sections 2 and 3.

Remembering your choice. We store your cookie preference in your browser’s local storage to remember your decision. This is separate from analytics cookies and is not used by us for behavioural tracking. The current configuration renews the choice after approximately six months.

Forms and external services. Opening an external form or payment page may involve that provider’s own cookies or similar technologies. Any embedded services must also be covered by our actual consent arrangements where required.

Email click tracking. We use Mailchimp click tracking, with your separate consent, to understand which links in campaign emails are used and improve the relevance and usefulness of our emails. Mailchimp adds tracking information to links and reports engagement, which can be linked to an individual subscriber, including which link was clicked and when. It is therefore not solely anonymous or aggregate data. Where clicks reveal political opinions, we rely on explicit consent under Article 9(2)(a), alongside consent under Article 6(1)(a) and any applicable PECR requirements. You can decline tracking and still receive untracked campaign updates, or withdraw tracking consent by contacting us. This does not subscribe you to a different campaign or authorise unrelated profiling.

9. Your rights

Depending on the circumstances and lawful basis, you may have rights to access your information, correct inaccuracies, request deletion, restrict processing and receive certain information in a portable format.

You can object to processing based on legitimate interests. You can object to direct marketing at any time, and we will stop processing your information for that purpose.

Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect processing carried out lawfully before withdrawal. Some rights are subject to exceptions, including where statutory records must be retained. We will explain any limitation applicable to your request.

To exercise your rights, contact winningwithwilliams2026@gmail.com. We may need proportionate information to confirm your identity. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint.

10. Children

This website, mailing list and donation-access process are not directed at children under 16. SDP membership requires a person to be at least 16, and campaign donations are restricted to eligible party members in good standing. Eligible members aged 16 or 17 may interact with the campaign; we recognise that they remain children for data-protection purposes and use clear explanations and proportionate information requests. Payment providers’ own age and account restrictions also apply. If we learn that someone under 16 has submitted information through a campaign form, we will remove it unless limited retention is necessary to resolve the matter or meet a legal requirement. Please contact us if you believe a child under 16 has supplied information.

11. Keeping your data secure

We take appropriate technical and organisational measures to protect information, including restricting access to authorised campaign personnel and using secure account-management practices. Payment credentials are handled by the payment provider rather than stored by the campaign.

Please avoid including unnecessary sensitive information in free-text fields. If further verification evidence is necessary, we will explain what is needed and the appropriate way to provide it.

12. Changes to this policy

We may update this policy as campaign services or processing arrangements change. We will update the date above. Where necessary, we will notify affected people or obtain fresh consent before using information for a new purpose.

13. Contact us

Keenan Clough
Rules and Compliance Officer and campaign privacy contact

Mathew Wilkinson
Website promoter on behalf of Adam Williams

Both can be contacted through the campaign email: winningwithwilliams2026@gmail.com. Please mark privacy enquiries “Privacy — for Keenan Clough”.

A campaign correspondence address will be added when arranged. In the meantime, please use the email above.