Privacy policy

1. Who are we and what do we do?

We are Organic Campaigns Ltd – a company registered in England & Wales, number 08026033. We primarily provide online campaigning software for use by other organisations – campaigning groups, charities and companies. They set up and run their own campaigns using our software. We do not determine what campaigns our customers run, the messages they promote or who they are sent to. If you have questions about these matters, please contact the organisation who created the campaign. In this document we refer to them as ‘campaign owners’.

Where you are taking part in a campaigning action, the information you provide to Organic Campaigns Ltd is not for our own use, but is being processed by us on behalf of the campaign owner. In these circumstances, the campaign owner will act as the data controller and will have their own privacy policy which will also determine how your data is handled when it reaches them. You should take careful note of their policy as it may have a more significant impact on the handling of your data than this policy.

Our main software product is called iParl, but we also develop other systems which may use personal data.

2. What information do we process?

We collect, store and process, and in some cases use, the following kinds of personal information:
• details that you explicitly enter as part of a campaigning action (name, address, email address etc.) and information derived from this, such as your constituency
• information about your visit to our site/services and the computer you are using, such as your IP address
• any other information that you choose to send us via email or otherwise regarding support, sales or other business activities.

The types of personal data being processed include the names, postal addresses, email addresses, telephone numbers and other contact details of both our customers and those who take campaigning actions hosted by us. The content of messages sent via our software are recorded by us and therefore the political views, racial, ethnic or religious affiliation, trade union membership, information about sexual life or sexual orientation or other special categories of data may be inferred due to your decision to take part in a specific campaigning action or may have been stated explicitly by yourself. The Internet Protocol address of visitors to our software will be processed as will data inferred from postcodes entered into our software, such as their longitude/latitude and the political boundaries under which you fall.

We also collect data on our customers in relation to sales, billing, account administration and related business process.

We may use, or permit selected third parties to use, cookies which may record your personal data. These enable us to track and analyse website traffic and visitor trends, improve your browsing experience and to personalise and enhance the content we display.

Our services are not directed at children under the age of sixteen. In the event that we learn that we have collected personal data from a child under age sixteen without parental consent, we will delete that information as quickly as possible.

3. What do we do with your data?

Delivering messages to campaigning targets. We will attempt to deliver your message to the recipient referenced as part of the campaigning action. Correctly sent replies will go straight to you, but we will also attempt to forward on to you any reply that is incorrectly sent to us. After doing so we will delete it.

Publishing petitions signatures and similar purposes. If you have signed a petition, your signature may be published by the campaign owner or submitted to the target of the petition.

Providing data to the campaign owner. The originator of the campaign may download data submitted when people take the campaign action, plus data derived from this information. How they subsequently deal with this data will be covered in their privacy policy, which you are encouraged to read.

Providing iParl. We will also use your data to ensure the effective running of the software, investigate and fix problems, or to improve and develop the features of our products.

Running Organic Campaigns Ltd. We may also use personal data to run Organic Campaigns Ltd, and to improve our business, products or customer service.

We may use your personal data to comply with any legal obligations to which we are subject.

4. Who do we share your information with?

The main transfer of information is to the campaign owner – the originators of the campaign in which you may have participated. Each organisation will have its own policy in relation to how they handle the data from this point on.

We may compiled aggregate information on the usage of our services for technical, business and marketing purposes – for instance the total volume of messages sent. This will never include your personal data.

The information you enter with the explicit agreement of it being made public (such as petition signatures, comments etc.) will be made publicly available to the whole internet community.

We will not sell or otherwise provide data entered to take part in a campaigning action for use by any organisation other than the campaign owner and the recipients of your message (other that which is required for the operation of the software / campaigning action)

We may share your personal data with third parties if we are under a duty to disclose or share your personal data in order to comply with any legal obligation; to cooperate with law enforcement officials in the investigation of unlawful activities; or in order to enforce or apply any contract with you; or to protect our rights, property, or safety of our employees, customers, or others. This includes measures to investigate abusive messages sent via our software or other anti-social use of the platform.

We also utilise a number of carefully selected third parties to help provide our services to you. Examples of these functions include email delivery and data analysis. In choosing to work with any such third parties, we will always ensure that the security policies and confidentiality arrangements of those third parties adhere to the same requirements we ourselves impose and expect, as a minimum. No ownership rights to the data will be transferred to any third party.

Whilst Organic Campaign Ltd is based within the UK, various processes may result in data being transferred to, and stored at, a destination outside the European Economic Area (“EEA”). It may also be processed by staff operating outside the EEA who work for one of our suppliers. By submitting your data, you agree to this transfer, storing or processing. We will take all reasonable steps necessary to ensure that your data is treated securely and in accordance with this privacy policy. In all cases where a transfer from the EEA takes place, we ensure a similar degree of protection is afforded to the data as would be the case were it to have remained within the EEA. We will do this by only permitting data to be stored in selected countries or by using specific contractual clauses approved by the European Commission to give an equivalent level of protection to personal data.

We engage a number of companies to act as subprocessors. We use a commercially reasonable selection process by which we evaluate the security, privacy and confidentiality practices of proposed subprocessors that will or may have access to, or process, personal data. Appropriate contractual safeguards will be put in place to ensure the correct handling of your data.

Current subprocessors are as follows:

• Messages sent using iParl are processed and delivered using SendGrid, a US-headquartered email service provider.

• Hosting services are provided by Heroku, a US-headquartered company which is part of the Salesforce Group. It is an ISO 27001, 27017 and 27018 certified hosting provider. The Heroku servers used by Organic Campaigns are located within the European Economic Area.

• Hosting services are also provided by the UK-based Netscan Group. It is an ISO 27001 certified hosting provider.

• Database services are provided by Jaws DB, LLC, a US-headquartered corporation. The database servers used by Organic Campaigns are located within the European Economic Area.

• Backup services are provided by autobus.io. The backup servers used by Organic Campaigns are located within the European Economic Area.

• Postcode lookup services are provided by the UK-based IDDQD Limited and in some instances, by the UK-based Commercial Evaluations Ltd.

• IP address lookups are provided by Proinity LLC, trading as KeyCDN, who are located within Switzerland.

• Geolocation and mapping services are provided by Google – https://policies.google.com/privacy?hl=en-GB

• If you send us email or submit a form via our marketing website, your data may be processed via Google Mail – https://policies.google.com/privacy?hl=en-GB and/or handled via a website hosted by Bluehost – https://www.bluehost.com/terms/privacy-policy

• We use the following server-monitoring technologies: New Relic, from New Relic Inc. – Privacy Policy. Librato and PaperTrail, both from SolarWinds Worldwide, LLC – Privacy Policy.

• Organisations who create actions using our software (our customers) may themselves use a wide range of data processors, including those that create cookies or gather web analytics data. For information on these, please see the privacy policy of the organisation whose action you are interested in.

5. How long do we store your data for?

We only store your data for as long as necessary for the purposes of processing set out in this policy – primarily to allow campaign owners to download a complete set of those who have taken action over the course of the campaign and to be able to accurately analyse who has taken part in the action. Your data may be retained in our live system for up to 12 months after which time it is annonymised.

To ensure the integrity of our systems and your data, we utilise various technologies to regularly take backups. Data remains archived within these backups and may be retained for up to 24 months after its creation.

6. What are your rights?

Access to your personal data: You can ask us to confirm if we are processing your personal data and you may request a copy of your personal data by contacting us using the details below.

Right to change or withdraw your consent: Where you have given us consent to make use of your personal data for any of the purposes outlined in this policy, you may withdraw that consent by contacting us using the details below.

Right to Rectification: You may ask us to update out of date or inaccurate information we hold about you. To do so, please contact us using the details below.

Right to Erasure: In certain circumstances you may ask us to erase your Personal Data. If you would like us to erase the personal data we hold about you, please get in touch, specifying how you believe we have come to hold such data. Your data will promptly be deleted from our live system but we may not remove information from our backup systems until its scheduled deletion.

Right to Data Portability: In certain circumstances you may ask us to provide you with the personal data that we hold about you in a structured, commonly used, machine readable form, or ask for us to send such personal data to another data controller.

Right to object: In certain circumstances you may object to our processing of your personal data. Please get in touch.

Right to restrict processing: You can ask us to restrict the processing of personal data we hold about you in certain circumstances. Please get in touch.

Make a complaint: You may make a complaint about our data processing activities to a supervisory authority. In the UK this is the Information Commissioner’s Office (ICO). Further details can be found on their website at https://ico.org.uk.

Getting in touch: To make enquiries and/or to exercise any of your rights in this privacy policy please contact us via info@organiccampaigns.com

7. Security and data storage

We take security and privacy seriously. We will endeavour to take all reasonable steps to keep your personal data secure once it has been transferred to our systems. We adopt appropriate data collection, storage and processing practices and security measures to protect against unauthorised access, alteration, disclosure or destruction

Please note that the internet is not a secure medium and although we will do our best to protect your data, we cannot guarantee the security of any data.

8. Changes to this privacy policy

This policy was last updated on 11th January 2021. We may modify or update this Privacy Policy from time to time to reflect the changes in our business and practices, and so you should review this page periodically. Any new version will be posted at organiccampaigns.com/privacy. Whatever changes are made, we will never deviate from our overall philosophy of maintaining your privacy to the utmost degree.

9. Getting in touch

If you have any queries relating to this Privacy Policy or our use of your personal data, please contact us via info@organiccampaigns.com or via Organic Campaigns Ltd., 64 Nile Street, Hoxton, London, N1 7SR.