Privacy Policy

1. Who we are

This privacy policy describes how Forge ("we", "our", "us") collects and uses personal data when you visit ForgeBritain.org.uk or interact with our online services. The data controller for the purposes of UK GDPR is Forge Movement, founded by Dr Robert King and registered c/o ForgeBritain.org.uk.

Once we are formally registered with the Electoral Commission, our registered address and party identifier will be added here.

2. What information we collect

We collect personal data only when you give it to us by submitting a form on this website. Specifically:

Candidate applications

• Full name
• Email address
• Constituency name
• Years of experience outside professional politics
• Free-text statement of motivation
• Status of local Forge Club support

Forge Club registration

• Club name
• Postcode or location
• Meeting type
• Number of founding members
• Coordinator's email address

Volunteer signup

• Name
• Email address
• Postcode
• Description of skills offered (free-text)

Discussion hub

If and when the discussion hub is fully active, you will create an account and any data you supply (display name, email, post content) will also be subject to this policy. The forms above are the only data collection we currently operate.

What we don't collect

We do not collect special category data (such as health, sexual orientation, religion, political opinions beyond the fact you contacted us). We do not require you to disclose these things on any form. Please do not include them in free-text fields. If you do include them, we will treat them as ordinary data submitted to us and process accordingly. But we will never request such data.

3. How we use your information

We use your personal data only for the purposes for which you provided it:

• Candidate applications: to assess your application and contact you about candidate selection processes.
• Forge Club registration: to register your club, connect you with regional coordinators, and provide club support materials.
• Volunteer signup: to match you with volunteer roles and contact you about specific opportunities.

Our lawful basis for processing under UK GDPR is your consent (Article 6(1)(a)), the act of submitting a form. You can withdraw consent at any time (see Section 8).

For Forge Movement's electoral activities, we may also rely on legitimate interests (Article 6(1)(f)) for keeping you informed about the movement once you have engaged with us, balanced against your rights and freedoms. You can opt out at any time.

4. Who we share your information with

We share data only with the small number of providers necessary to operate this website and the Forge organisation:

• Formspree (formspree.io): the service that processes form submissions and delivers them to our inbox. Formspree is GDPR-compliant. Their privacy policy: formspree.io/legal/privacy-policy.
• Our hosting provider: the company that hosts ForgeBritain.org.uk. Server access logs (IP addresses, browser type, page visited) are kept by the hosting provider for technical and security purposes. We do not actively use these logs.
• Forge volunteers and staff: when relevant to your enquiry. For example, if you register a Forge Club in Manchester, your contact details will be shared with the Northern Forge regional coordinator. Volunteers and staff are bound by data confidentiality obligations.

We do not sell your data. We do not share it with advertisers, data brokers, or political consultancies. We do not use it for targeted advertising.

5. Cookies and tracking

This website does not currently use tracking cookies. We do not run analytics tools that profile individual visitors. If we add Google Analytics, Plausible, or a similar tool in future, we will update this policy and add a cookie notice.

The website does load fonts from Google Fonts (a free typography service from Google). Google receives the IP address of your browser when you load the page in order to deliver the fonts. This is standard for most modern websites. If this concerns you, browser extensions like uBlock Origin can block external font loading.

6. How long we keep your data

We retain personal data only as long as necessary for the purpose for which it was collected:

• Candidate applications: 24 months after the most recent contact, or until you ask us to delete them, whichever is sooner. Successful candidates' data is retained for the duration of their candidacy plus statutory retention requirements under electoral law.
• Forge Club registrations: for as long as the club is active, plus 12 months after dissolution.
• Volunteer signups: 24 months after most recent contact, or until you ask us to delete them.
• Form submissions in Formspree: Formspree retains submission data per its own retention policy. We export and delete submissions from Formspree on a quarterly basis.

7. International transfers

Some of our service providers (notably Formspree) may store data on servers in the United States. We rely on the UK's adequacy regulations and Standard Contractual Clauses for these transfers, where applicable. Formspree is a US-based company.

8. Your rights

Under UK GDPR you have the following rights, free of charge, in most circumstances:

• Right of access: you can ask us what personal data we hold about you and receive a copy.
• Right to rectification: you can ask us to correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): you can ask us to delete your data.
• Right to restriction: you can ask us to stop processing your data while we resolve a dispute about it.
• Right to data portability: you can ask us to send your data to another organisation in a machine-readable format.
• Right to object: you can object to processing based on legitimate interests.
• Right to withdraw consent: if our processing relies on consent, you can withdraw it at any time.

To exercise any of these rights, email robert@forgebritain.org.uk. We will respond within 30 days.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator for data protection: ico.org.uk · 0303 123 1113.

9. Security

We use industry-standard measures to protect your data, including:

• HTTPS encryption on all pages of this website
• Form submissions transmitted to Formspree over encrypted connections
• Access to personal data limited to people who need it for their role
• Regular review of access permissions and deletion of data no longer needed

No system is perfectly secure. If a data breach affects you, we will notify you and the ICO within 72 hours of becoming aware, as required by UK GDPR.

10. Children

This website is not directed at children under 16. We do not knowingly collect personal data from children. If you are under 16, please ask a parent or guardian before submitting any forms. If we learn that we have inadvertently collected data from a child under 16, we will delete it.

11. Changes to this policy

We may update this privacy policy from time to time. The "Last updated" date at the top of this page reflects the most recent change. Substantive changes (such as new categories of data collected, or new sharing arrangements) will be highlighted clearly, and where we have your contact details, we will email you.