Privacy Notice and Data Retention Policy

This website hosts an independent petition concerning human rights, the rule of law, due process, democratic participation and public security in Bangladesh, as set out in the petition addressed to the Prime Minister of the United Kingdom.

This Privacy Notice explains what personal data is collected through the petition website, why it is collected, the legal basis on which it is processed, how it may be used, how long it is retained, who may have access to it, and the rights available to you.

Who is responsible for your data

The data controller for this petition is Sonjoy Kumar Roy.

The data controller is responsible for personal data collected through this website in connection with petition signatures, petition administration, optional future contact and privacy requests.

For any privacy enquiry, request or withdrawal of consent, please contact:

• Email: barristersonjoy@googlemail.com

What we collect

When you sign the petition, the form collects:

• First name — required
• Last name — required
• Professional designation — required
• Email address — required
• Phone number — optional

If you leave the phone-number field blank, no phone number is collected through that field.

The website also records certain information automatically when a submission is made:

• the date and time of submission;
• the IP address associated with the submission;
• the browser user-agent string;
• confirmation that the required declarations were ticked;
• the version of the relevant consent or declaration wording presented when the submission was made; and
• where applicable, a record of whether you separately opted in to future contact.

IP-address and browser information is used for security, integrity, duplicate-detection and automated-submission checks.

The petition form does not ask for your postal address, postcode, constituency, date of birth or a free-text personal message.

Why we process your information

Information submitted through the petition form is processed for purposes including:

• recording and administering support for this petition;
• maintaining an accurate petition register;
• checking for duplicate, automated, fraudulent or suspicious submissions;
• protecting the integrity and security of the petition;
• maintaining appropriate records showing how and when a submission was made;
• presenting or evidencing genuine support for the petition;
• responding to data-protection requests; and
• where you separately opt in, using your email address for optional future contact as explained below.

We do not sell petition data or use personal information for commercial advertising.

Our legal basis

Signing this petition may reveal information about your political opinions or views on matters of public interest.

Political opinions are classed as special-category personal data under Article 9 of the UK GDPR and receive additional protection.

For the processing required to record and administer a petition signature, we rely on:

Article 6(1)(a) UK GDPR — consent

This applies to the processing of ordinary personal data supplied in connection with the petition, including your name, professional designation, email address and, where provided, phone number.

Article 9(2)(a) UK GDPR — explicit consent

This applies where your support for the petition reveals information about your political opinions.

Consent is given through the declaration presented when you submit the petition form.

Signing the petition is voluntary. You are not under any statutory or contractual obligation to sign it.

You may withdraw your consent by contacting the organiser using the details provided in this notice. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Purpose limitation

Information collected for your petition submission is used only for the purposes described in this notice.

Your petition information will not be sold, used for commercial advertising, or disclosed for unrelated purposes.

Your email address will not be used to send you information about future petitions or campaigns unless you separately choose to receive such communications through the optional future-contact consent on the petition form.

Where you give that optional consent, the additional use of your email address is governed by the section below.

Optional future contact

The petition form contains a separate, optional and unticked checkbox allowing you to choose whether you would like to receive updates about this petition and future related petitions or campaigns by email.

This optional consent is separate from the consent required to sign the petition.

You do not have to give future-contact consent in order to sign the petition, and leaving the optional checkbox unticked will not affect your submission.

If — and only if — you tick the optional future-contact checkbox, your email address may be retained and used to:

• send you relevant updates about this petition;
• inform you about future petitions related to the same or closely connected subject matter; and
• provide information about related campaigns concerning human rights, the rule of law, due process, fair trials, democratic participation, public security and related public-interest matters concerning Bangladesh.

For this optional processing, we rely on your consent under Article 6(1)(a) of the UK GDPR.

Where an email constitutes direct marketing for the purposes of the Privacy and Electronic Communications Regulations 2003 (PECR), it will be sent only on the basis of the optional consent you have given for email communications.

We record:

• whether you opted in;
• the date and time you gave that consent; and
• the wording or version of the consent presented to you at the time.

This future-contact consent is maintained separately from the consent associated with your petition submission so that it can be withdrawn independently.

If you do not tick the optional checkbox, your email address will not be used to send you future petition or campaign communications.

You may withdraw future-contact consent at any time by emailing barristersonjoy@googlemail.com.

Withdrawal of future-contact consent will not remove your existing support for this petition.

Withdrawal does not affect the lawfulness of communications or other processing carried out before your consent was withdrawn.

How submissions are checked

There is currently no email-verification step requiring you to click a confirmation link.

The website therefore does not claim that submission of an email address by itself proves that the person submitting the form controls that email account.

Submissions may be automatically checked for:

• duplicate email addresses or submissions;
• repeated or unusually frequent submissions;
• patterns associated with automated submissions; and
• other indicators relevant to the security and integrity of the petition.

A submission that is flagged may be held for administrative review.

Only accepted submissions are included in the petition's accepted-support total.

Restricted access and security

Personal petition records are not publicly accessible through the website.

Administrative access is restricted to authorised persons and protected by appropriate technical and organisational controls.

Measures used to protect the information may include:

• authentication and access controls;
• password hashing;
• rate limiting;
• restrictions on administrative roles and permissions;
• logging of administrative activity;
• protections against unauthorised access to administrative pages;
• restrictions on browser and search-engine caching of administrative areas; and
• confidential handling of exported petition records.

No internet-connected system can guarantee absolute security. Appropriate technical and organisational measures are nevertheless used to reduce the risk of unauthorised access, alteration, disclosure, loss or misuse.

Public display and disclosure

Personal contact details are not displayed publicly on the petition website.

The public petition page displays the total number of accepted submissions but does not publicly display individual supporters':

• email addresses;
• phone numbers;
• IP addresses;
• browser information; or
• administrative review information.

Where the petition is formally presented, information reasonably necessary to evidence genuine support may be provided to the intended recipient.

This may include supporters' names and professional designations.

Email addresses, phone numbers, IP addresses and browser user-agent information are not included in the petition presented to recipients.

Information may also be disclosed where disclosure is required by law or is necessary to respond to a lawful request from a competent authority.

Service providers and international processing

The website may use service providers where reasonably necessary to host, operate, secure or maintain the website and, where future-contact consent has been given, to deliver permitted email communications.

Service providers acting on our behalf may process only the information necessary to provide the relevant service and are expected to handle personal information in accordance with applicable data-protection requirements.

Where personal data is transferred outside the United Kingdom, any such transfer must be made in accordance with the applicable UK GDPR rules governing international transfers and using an appropriate lawful safeguard where required.

We do not sell petition data to third parties.

Retention

Personal information is retained only for as long as reasonably necessary for the purposes described in this notice.

Retention periods are applied as follows:

IP address and browser user-agent

These are removed from the petition record 90 days after submission.

They are retained for this limited period to support duplicate detection, integrity checks and website security.

Removal of this information does not remove the underlying petition submission.

Petition submission

The petition submission record, including your name, professional designation, email address, optional phone number and submission date, is deleted 24 months after submission.

Future-contact consent

Where you have opted in to future contact, the associated future-contact record is removed as soon as reasonably practicable after you withdraw that consent.

In any event, under the current retention policy it will not be retained beyond the deletion of the associated petition record at the end of the 24-month retention period.

Earlier deletion

Where you validly request deletion before these periods expire, the request will be considered and acted upon in accordance with applicable data-protection law.

A limited record may be retained where reasonably necessary and lawful for security, fraud prevention, duplicate prevention, accountability or compliance with a legal obligation.

Server and security logs

Technical server or security logs may temporarily contain information such as an IP address independently of the petition database.

These logs are used for website security and are retained only for an appropriate limited period.

Withdrawal of consent and deletion

You may request withdrawal of consent or deletion of your personal information by contacting barristersonjoy@googlemail.com.

Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

If you withdraw only your optional future-contact consent, your petition submission is not automatically removed.

If you request deletion of your petition submission, the associated future-contact record will also be removed.

We may retain a minimal record where this is reasonably necessary and lawful to ensure that a deleted or withdrawn submission is not accidentally restored, repeatedly re-entered or otherwise used in a way that undermines the integrity of the petition.

Cookies and similar technologies

This website does not use advertising, behavioural-tracking, analytics or third-party profiling cookies.

It uses only limited cookies or similar technologies required for the operation, security and basic functionality of the website.

These may include:

Session cookie

Used to maintain the session required for the petition form and related website functionality.

CSRF protection

Used to protect forms against cross-site request forgery and unauthorised form submissions.

Cookie-notice preference

Used to remember that you have dismissed or acknowledged the site's cookie notice so that it does not need to be repeatedly displayed.

These technologies are not used to profile visitors or to deliver targeted advertising.

You can remove or block cookies through your browser settings, although blocking cookies required for security or form operation may prevent the petition form from working correctly.

Automated checks and decision-making

The website uses automated technical checks to help identify duplicate, repeated or potentially automated petition submissions.

These checks are used to protect the integrity of the petition.

The website does not use automated profiling or automated decision-making that produces legal effects or similarly significant effects concerning an individual.

A submission may be held for administrative review where automated integrity checks identify something unusual.

Your rights

Under UK data-protection law, depending on the circumstances, you may have rights including:

• the right to be informed about how your personal information is used;
• the right to request access to personal information held about you;
• the right to have inaccurate or incomplete information corrected;
• the right to request erasure of your personal information;
• the right to request restriction of processing;
• the right to object to certain processing;
• the right to data portability where applicable; and
• the right to withdraw consent at any time where processing is based on consent.

You also have the right to object at any time to the use of your personal information for direct marketing.

To exercise a data-protection right or withdraw consent, contact barristersonjoy@googlemail.com.

We will normally respond to a valid request within one month.

That period may be extended where permitted by law, for example where a request is particularly complex or multiple requests have been made. If an extension is necessary, you will be informed in accordance with the applicable legal requirements.

There is normally no charge for exercising your data-protection rights, although the law permits a reasonable fee or refusal in certain limited circumstances, such as where a request is manifestly unfounded or excessive.

Complaints

If you have concerns about how your personal information has been handled, you may contact the organiser at barristersonjoy@googlemail.com.

You also have the right to complain to the Information Commissioner's Office (ICO), the United Kingdom's data-protection supervisory authority.

Further information and the ICO's complaint process are available at ico.org.uk/make-a-complaint, or by telephone on 0303 123 1113.

You do not have to contact the organiser before making a complaint to the ICO.

Changes to this notice

This Privacy Notice may be updated if the petition process, website functionality, data-processing activities or applicable legal requirements change.

Where a change materially affects processing for which your consent is required, existing consent will not automatically be treated as covering a materially different purpose.

The date at the top of this page will be updated whenever this notice changes.

The current version published on this page is the applicable version.