Privacy Policy — Keystone

Who we are

Keystone is a political organisation based in the United Kingdom, operating at keystoneuk.org. We are in the process of formal registration as a political party with the Electoral Commission.

For the purposes of UK data protection law, the data controller is:

Keystone

Email: privacy@keystoneuk.org

[ Postal address to be added upon party registration ]

We take your privacy seriously. This policy explains what personal data we collect, why we collect it, how we use it, and what rights you have over it. It applies to all data collected via keystoneuk.org.

What data we collect and why

At this stage — our holding page — we collect only one category of personal data:

Email address — collected when you sign up to be notified about Keystone's launch. You provide this voluntarily by completing the signup form.

We also collect the following automatically when you visit our site:

Technical data — IP address, browser type, and pages visited, collected by our hosting provider (Netlify) for security and performance purposes. We do not use this data for marketing.

We do not use cookies for tracking or advertising. No profiling. No third-party analytics at this stage.

Our lawful basis for processing

Under the UK General Data Protection Regulation (UK GDPR), we must have a lawful basis for processing your personal data.

For email signups: our lawful basis is consent. You gave explicit consent by completing the signup form and ticking the opt-in checkbox. You may withdraw this consent at any time (see Your Rights below).

For technical/server data: our lawful basis is legitimate interests — specifically, maintaining the security and performance of our website.

How we use your email address

We will use your email address solely to:

Notify you when Keystone officially launches
Send you updates about Keystone's policy platform, campaign activity, and events — but only if you consented to receive these

We will never:

Sell your data to any third party
Share your data with other political parties or campaigning organisations
Use your data for automated profiling or decision-making
Send you commercial marketing unrelated to Keystone

Who processes your data

We use the following third-party services to operate this website and manage our contact list. Each is a data processor acting on our behalf under a Data Processing Agreement:

Brevo (formerly Sendinblue) — email marketing platform. Your email address and signup date are stored on Brevo's servers. Brevo is EU-based and GDPR compliant. Their privacy policy is available at brevo.com/en/legal/privacypolicy.

Netlify — website hosting. Netlify processes basic server logs (IP address, browser type) as part of hosting this site. Their privacy policy is available at netlify.com/privacy.

Google reCAPTCHA — spam prevention on our signup form. reCAPTCHA collects hardware and software information to verify you are not a bot. This data is sent to Google and is subject to Google's Privacy Policy.

We do not use any other third-party services on this site at this stage.

Political data

UK GDPR treats data about political opinions as a special category requiring additional protection. By signing up to receive updates from a political organisation, we may infer a degree of political interest on your part.

We process this data on the basis of your explicit consent, given via the opt-in checkbox on our signup form. We will not share this data with any third party, and we will not process it for any purpose beyond communicating with you about Keystone.

How long we keep your data

Email address: We retain this for as long as you remain subscribed. If you unsubscribe, your data is deleted from our active list within 30 days. You can also request immediate deletion at any time (see Your Rights below).
Server logs: Retained by Netlify for up to 30 days for security purposes, then automatically deleted.

Your rights

Under UK GDPR, you have the following rights regarding your personal data:

Right to access — you can request a copy of the personal data we hold about you
Right to rectification — you can ask us to correct inaccurate data
Right to erasure — you can ask us to delete your data at any time
Right to withdraw consent — you can unsubscribe at any time using the link in any email we send you, or by emailing us directly
Right to object — you can object to us processing your data
Right to data portability — you can request your data in a portable format

To exercise any of these rights, contact us at privacy@keystoneuk.org. We will respond within 30 days.

Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the UK's supervisory authority:

Information Commissioner's Office (ICO)

Website: ico.org.uk

Helpline: 0303 123 1113

We would, however, appreciate the opportunity to address your concerns directly before you contact the ICO.

Changes to this policy

As Keystone grows — launching a full website, registering as a party, collecting additional data — this policy will be updated to reflect those changes. The version number and last updated date at the top of this page will always reflect the current version. We will notify subscribers of any material changes by email.