Reform UK
HOME POLICIES MEMBERSHIP GET INVOLVED EVENTS DONATE MEMBER PORTAL Join Reform UK
Legal

PRIVACY NOTICE

How Reform UK collects, uses and protects your personal information.

Last Updated: 1st March 2026

Data Controller: Reform UK Party Ltd, Electoral Commission Registration Number PP7931, Company No. 16260766
Registered Office: Millbank Tower, 21-24 Millbank, London SW1P 4QP
ICO Registration Number: ZB934331

1. Introduction

Reform UK Party Ltd ("Reform UK", "we", "our", or "us") is a registered political party and the primary Data Controller for personal data processed at a national level, including membership administration, national campaigning, fundraising, volunteer coordination, and compliance with electoral law.

In some circumstances, local parties, branches, candidates, elected representatives, or affiliated campaign groups may act as separate and independent Data Controllers in respect of personal data they collect and process locally, where they determine the purposes and means of that processing.

Where this occurs, those entities are responsible for complying with applicable data protection legislation, including responding to individual rights requests. Reform UK Party Ltd may coordinate or support compliance activity to ensure consistency and legal compliance across the organisation.

We process personal data to support democratic engagement, membership administration, campaigning, fundraising, volunteering, and compliance with electoral law.

We are committed to processing personal data in accordance with:

  • UK GDPR (Articles 5, 6, 7, 12-14, 21, 24, 30, 32, 35)
  • Data Protection Act 2018 (including s. 8(e) processing for democratic engagement)
  • Data Use and Access Act 2025 (ss.13-15 - digital fairness, transparency, profiling safeguards)
  • PECR 2003 (Reg. 6 - electronic communications and cookies)
  • Representation of the People Act 1983
  • Political Parties, Elections and Referendums Act 2000 (PPERA)
  • Equality Act 2010
  • Human Rights Act 1998 (Articles 8 and 14)
  • ICO Guidance including Democracy Disrupted (2018)

1A. Data Controller Responsibilities and Subject Access Requests

Reform UK Party Ltd acts as the central coordination point for data protection compliance and Subject Access Requests ("SARs") relating to personal data processed within national systems, platforms, and records.

Where a SAR relates to personal data held by a local party, branch, candidate, or elected representative acting as an independent Data Controller, the request may be forwarded to the relevant entity or handled collaboratively to ensure the request is responded to lawfully, fairly, and within statutory timescales.

Individuals may submit SARs to Reform UK Party Ltd in all cases. Reform UK will ensure that the request is appropriately assessed and directed to the correct controller(s) where necessary.

1B. Use of Reform Pro

Reform UK Party Ltd operates a digital campaigning and engagement platform known as Reform Pro.

Reform Pro involves specific processing activities, including the use of electoral register data and profiling for democratic engagement. These activities are explained in detail in the Reform Pro Privacy Notice, which applies in addition to this Privacy Notice.

Individuals whose personal data is processed through Reform Pro should read both notices to fully understand how their personal data is used.

2. How We Collect Personal Data

We collect personal data directly and indirectly through:

  • Membership applications
  • Volunteer registrations
  • Campaign sign-ups
  • Donations and fundraising
  • Event attendance
  • Website forms and newsletter subscriptions
  • Correspondence with us
  • Social media engagement
  • Electoral Register (as permitted by RPA 1983)
  • Publicly available sources (Companies House, local authorities)
  • Permitted third-party data providers (in accordance with Articles 14 UK GDPR)

Where we obtain personal data indirectly, we provide transparency in accordance with Articles 12-14 UK GDPR and DUAA 2025.

2A. Prize Draws, Competitions and Promotions

Where you choose to enter a prize draw, competition or promotional campaign operated by or on behalf of Reform UK Party Ltd, we will process your personal data for the purposes of administering that promotion.

This may include:

  • verifying eligibility and preventing fraudulent or duplicate entries;
  • contacting you in relation to your entry;
  • selecting and notifying winners;
  • arranging delivery or fulfilment of prizes; and
  • complying with applicable legal and regulatory obligations.

Lawful basis

Processing is carried out:

  • under Article 6(1)(b) UK GDPR (performance of a contract or steps taken at your request prior to entering into a contract), where processing is necessary to administer the promotion;

and/or

  • under Article 6(1)(f) UK GDPR (legitimate interests), namely the fair and efficient operation of promotions, fraud prevention, and campaign engagement.

Where you are asked to opt-in to receive marketing communications, this will be processed separately under consent (Article 6(1)(a) UK GDPR and PECR 2003).

Entry into a promotion is not conditional on providing marketing consent.

Data collected

We may collect:

  • your name;
  • contact details (such as email address, telephone number, and/or postal address); and
  • any additional information required to administer the specific promotion.

Data sharing

We may share your data with trusted third parties where necessary to administer the promotion (for example, delivery providers or prize fulfilment partners).

All such processing is subject to appropriate contractual safeguards in accordance with Article 28 UK GDPR.

Publicity

Where required for transparency, fairness, or by law (including applicable advertising and consumer protection requirements), we may publish or make available limited winner information (such as name and general location).

You have the right to object to such publication, and we will consider any such request in line with applicable legal obligations.

Retention

Personal data collected for a promotion will be retained only for as long as necessary to administer the promotion and comply with legal obligations (including audit, fraud prevention, and regulatory requirements), after which it will be securely deleted or anonymised in accordance with our retention policies.

3. Types of Personal Data We Process

  • Name, address, email, telephone number
  • Date of birth (for eligibility checks)
  • Electoral registration information
  • Membership and payment details
  • Donation details and permissibility records (PPERA obligation)
  • IP address, device identifiers, cookie data
  • Campaign interests and preferences
  • Volunteer information
  • Political opinions you choose to share with us
  • Profiling data for the purposes of democratic engagement (see section 7)

We do not collect special category data unless you voluntarily provide it.

4. Our Lawful Bases

We rely on the following lawful bases:

Purpose Lawful Basis
Membership administration Contract (Art. 6(1)(b))
Donations & PPERA compliance Legal obligation (Art. 6(1)(c))
Campaigning & democratic engagement Public interest / DPA 2018 s.8(e)
Email marketing (non-political) Consent (Art. 6(1)(a))
Political messaging Legitimate interests / democratic engagement
Profiling for political messaging Public interest + DUAA 2025 safeguards
Website analytics Consent (PECR Reg.6) for non-essential cookies

5. Profiling and Automated Decision Making

We conduct limited profiling to:

  • Identify areas of political interest
  • Tailor campaign messaging
  • Manage volunteer engagement
  • Understand supporter demographics

This processing is conducted under DPA 2018 s.8(e) (democratic engagement) and DUAA 2025 ss.13-15, requiring:

  • Explanations of the logic involved
  • Impact assessments (DPIA) for political profiling
  • Additional fairness & transparency measures

6. Who We Share Data With

We may share personal data with:

  • Electoral Commission (PPERA compliance)
  • Payment providers (donation processing)
  • Email and CRM providers (e.g., Intercom)
  • Accredited political data processors
  • Third-party volunteer management platforms
  • Law enforcement where required

All third parties are subject to UK GDPR-compliant contractual controls.

7. International Transfers

Some of our suppliers, including CRM or analytics platforms, may store data in the EEA or outside the UK. Where transfers occur, we ensure:

  • Adequacy regulations, or
  • UK Addendum to SCCs, or
  • ICO-approved International Data Transfer Agreement (IDTA)

Transfer risk assessments are completed where required.

8. Retention

We retain data only for as long as necessary:

  • Membership records: duration of membership + 2 years
  • Donation and financial records: 6 years (statutory)
  • Campaigning data: up to 48 months unless you opt out
  • Electoral register data: as prescribed by law
  • Website analytics: per cookie expiry schedule

9. Your Rights

You have the rights to:

  • Access your data
  • Rectification
  • Erasure
  • Restriction
  • Portability
  • Object (including to profiling or political messaging)
  • Withdraw consent

You can exercise your rights via: [email protected]

10. Data Security

We implement:

  • MFA and encryption
  • Role-based access controls
  • Secure political profiling safeguards
  • Regular penetration testing
  • Data minimisation and retention controls

11. Contact

Data Protection Officer
Reform UK Party Ltd
Millbank Tower, 21-24 Millbank, London SW1P 4QP
Email: [email protected]

12. How to Complain

If you have any concerns about how Reform UK Party Ltd processes your personal data, you can contact us at:

Email: [email protected]
Address: Reform UK Party Ltd, Millbank Tower, 21-24 Millbank, London SW1P 4QP.

If you remain dissatisfied, you have the right to lodge a complaint with the UK supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
Website: www.ico.org.uk/make-a-complaint

This escalation process is provided in accordance with Articles 13(2)(d), 14(2)(e) and 77 UK GDPR.