Privacy Notice and Data Retention Policy

This website hosts a petition concerning human rights, the rule of law, due process, democratic participation and public security in Bangladesh, as set out in the letter addressed to the Prime Minister of the United Kingdom.

This notice explains what personal data the petition website collects, why, on what legal basis, how long it is kept and what rights you have. It reflects exactly what the website does — nothing described here is aspirational.

Who is responsible for your data

The data controller for this petition is British-Bangladeshi Barristers, Solicitors and Advocates, who is responsible for personal data collected through this website in connection with petition signatures, related administration and any privacy requests.

No Data Protection Officer is appointed, as one is not required for processing of this scale and nature. All enquiries and data requests go to:

• Email: contact@ukpetition.com

What we collect

The signature form asks for four pieces of information, all of them required:

• Full name
• Designation — Barrister, Solicitor or Advocate
• Phone number
• Email address

The website also records, automatically and without asking:

• Date and time the signature was submitted
• Your IP address and browser user-agent string, used only to detect duplicate and automated submissions
• A record that you ticked the declaration on the form

That is the complete list. We do not collect your postal address, postcode, constituency, country of residence, date of birth, or any free-text message, and the form does not ask for them.

Our legal basis

Signing this petition expresses a view on a political and public-interest matter. Information revealing political opinions is special category data under Article 9 of the UK GDPR and attracts additional protection. We therefore rely on two bases together:

• Article 6(1)(a) — your consent, for the ordinary processing of your name, designation, phone number and email address.
• Article 9(2)(a) — your explicit consent, for the political opinion that signing necessarily reveals.

Consent is given by ticking the declaration on the signature form. It is entirely voluntary. There is no statutory or contractual requirement to sign, and the only consequence of not providing these details is that your name cannot be added to the petition.

You can withdraw your consent at any time by emailing contact@ukpetition.com. Withdrawing is as easy as giving consent: we remove your signature on request, without asking for a reason. Withdrawal does not affect the lawfulness of processing carried out before you withdrew.

What we use it for

• Counting signatures and displaying the running total on the petition page
• Preventing duplicate signatures — one signature per email address
• Detecting and blocking automated or fraudulent submissions
• Contacting you about this petition if we need to verify or correct your entry, or if you contact us
• Presenting the petition and its signatories to UK decision-makers

We do not send newsletters or campaign updates, and there is no marketing mailing list. The website has no facility to send bulk email at all. Your details are never sold, rented or used for any unrelated purpose.

What is published, and what is shared

The petition page displays only the total number of signatures. No name, designation, phone number, email address or location is shown publicly anywhere on this website at any point.

The purpose of a petition is to demonstrate who supports it. When the petition is presented to UK decision-makers, public authorities or elected representatives, the submission may include signatories’ names and designations. Your phone number, email address, IP address and browser information are never included in that submission and are not disclosed to recipients.

The only other party with access to the data is the website hosting provider, which processes it solely to run and protect the site under a contract that restricts it to that purpose. Personal data is held on servers in the United Kingdom or the European Economic Area, and is not transferred outside them.

We may disclose data where we are legally required to do so, for example in response to a valid court order.

How long we keep it

These periods are enforced automatically by a scheduled task that runs daily, not by anyone remembering to do it:

• IP address and user-agent: erased from your record 90 days after you sign. They exist only to spot duplicate and automated submissions, which is a short-lived need. The signature itself is unaffected.
• The signature record — your name, designation, phone number, email address and the date you signed: deleted in full 24 months after you sign.
• Earlier on request: a deletion request is acted on when we receive it, well inside the periods above.

Server logs used for security may retain an IP address for a short period independently of the above; these are not linked to your signature.

How it is protected

Signature data is held in a database that is not publicly accessible. Access is restricted to authenticated administrators, and every administrative page is behind a login protected by password hashing and rate limiting. The signature form is protected against cross-site request forgery, automated submission and flooding. Administrative pages are excluded from search engines and set to not be cached or stored by browsers or proxies.

Cookies and similar technologies

This site uses only what it needs in order to work. There are no advertising, analytics, tracking or third-party profiling cookies, and nothing about your visit is shared with advertisers.

• Session cookie — keeps your form session valid while you complete the signature form.
• CSRF token cookie — protects the form against cross-site request forgery.
• Cookie notice preference — a small flag stored in your browser recording that you dismissed the cookie banner, so it is not shown repeatedly.

All three are strictly necessary to provide a service you have requested, and are therefore exempt from the consent requirement under the Privacy and Electronic Communications Regulations 2003. That is why you are shown a notice rather than asked to opt in: there is nothing optional to opt in to. You can block or clear them in your browser settings, though the signature form will then be unable to submit.

Automated decision-making

There is no automated decision-making or profiling that produces legal or similarly significant effects. The automated checks on the form decide only whether a submission looks like a bot; a rejected submission can simply be retried, and no decision is made about you as a person.

Your rights

Under the UK GDPR and the Data Protection Act 2018 you have the right to:

• Be informed about how your data is used — this notice
• Request access to the personal data we hold about you
• Have inaccurate data corrected
• Have your data erased
• Restrict or object to our processing
• Receive your data in a portable format
• Withdraw your consent at any time

To exercise any of these, email contact@ukpetition.com. We will respond within one month. There is no charge.

If you are unhappy with how your data has been handled you can complain to the Information Commissioner’s Office, the UK supervisory authority, at ico.org.uk/make-a-complaint or on 0303 123 1113. You can complain to the ICO without contacting us first.

Changes to this notice

If the petition process, the form or our data handling changes, this notice is updated at the same time and the date at the top changes with it. The current version is always the one on this page.