Data Protection and Privacy Policy

This document outlines how Jackson Ng processes and manages personal data and:

• Identifies the data controller.
• Explains the lawful basis for processing personal data.
• Outlines the personal data held and processed.
• Outlines the scope of the special category personal data held and processed.
• Outlines the process of Subject Access Requests.

1. Data Controller

The Data Controller is Jackson Ng.

2. Contact

If you have any questions about this policy or for more information about how we use your data or would like to exercise any of your rights contact Jackson Ng at jackson@jacksonng.com.

3. Lawful basis for processing

All processing is carried out by consent or either under the legitimate interest of Jackson Ng, or public interest. These cover processing to conduct casework, campaigning and communication. Where processed under the lawful basis of a task carried out in the public interest, it is to support or promote democratic engagement. This includes fundraising activity in order to support democratic engagement.

4. Data sources

Data held is that provided by you when you contact us and correspondence with third parties in response to cases taken up on your behalf. We may also hold data that you provide when we contact you – for instance, if we ask you to participate in a survey or petition. If you do not wish for us to contact you by telephone please do not provide this information. The Register of Electors that councils provide to authorised persons under the Representation of the People Act is also used for electoral purposes.

5. Data Security

Personal data is stored electronically and securely. We ensure that our service providers comply with the same high standard that we do. This website stores no personal data itself: messages and sign-ups sent through its forms are passed by our form provider directly to Jackson Ng.

6. Special category data

Special category data will be processed under the lawful basis indicated in section 3, as is permitted in clauses 22, 23 and 24 of schedule 1 of the Data Protection Act, covering political parties and elected representatives.

7. Transferring your data outside of the European Economic Area

The EU GDPR adequacy decision means that data can continue to flow between the UK and the European Economic Area (EEA). Some service providers are located outside of the EEA and therefore it may be necessary to transfer your personal data outside of the EEA. Where the transfer of your data outside of the EEA takes place we will make sure that it is protected in the same way as if the data was inside the EEA, and it only occurs with your consent.

We will use one of the following safeguards to ensure this:

• Where the European Commission has issued an adequacy decision determining that a non-EEA country or organisation ensures an adequate level of data protection.
• A contract is put in place with the recipient of the data obliging them to protect the data to the same standards as the EEA.

Legally it is not permitted to transfer certain types of data, such as Electoral Register Data, outside of the EEA, and we honour that obligation.

8. Data retention policy

Personal data will be held for no longer than necessary. Some types of data may be held for longer than others. Typically the maximum retention is two election cycles. Review of the data held will occur in each election cycle to determine whether it should be maintained or put beyond use. We also comply with the ICO's expectation guidelines relating to petitions.

9. Subject Access Requests

We will request verification of the identity of any individual making a request, ask for further clarification and details if needed and respond within one calendar month once we have confirmed it is a legitimate request. In accordance with ICO guidelines, we keep a log of Subject Access Requests that contains details of the request, including that which can identify you personally, indefinitely.

Data subjects have the right to the following:

• To be told whether any personal data is being processed
• To be given a description of the personal data, the reasons it is being processed and whether it will be given to another organisations or people.
• To be given a copy of the information comprising the data, and given details of the source of the data where this is available.

10. Will we share your data with anyone else?

If you have contacted us about a personal or policy issue, your data may be passed on to a third-party in the course of dealing with your enquiry, such as local authorities, government agencies, public bodies, health trusts, regulators, and so on. Any third parties that we may share your data with are obliged to keep your details securely, and to use them only for the basis upon which they were originally intended.

We may need to share your data with a third party, such as the police, if required to do so by law.

Unless otherwise specified, data may also be shared with entities of Political Party associations, federations, branches, groups and affiliates in order to assist you or maintain contact with you in support of democratic engagement.

Casework and other submissions from the Contact form are sent directly to their destination and are not retained on the website. Your name and contact details are only added to the email updates list if you ask to join it.

Your personal data is only used as outlined here and within your reasonable expectations based on the nature of the communication, and recognising the need of politically related engagement in wider support of democratic engagement.

11. Data Rights

At any point you have the following rights:

• Right of access – you have the right to request a copy of the information held about you.
• Right of rectification – you have a right to correct data held about you that is inaccurate or incomplete.
• Right to be forgotten – in certain circumstances you can ask for the data held about you to be erased from our records.
• Right to object – you have the right to object to certain types of processing, such as direct marketing.
• Right to object to automated processing, including profiling – you also have the right not to be subject to the legal effects of automated processing or profiling.
• Right to judicial review: if our office refuses your request under rights of access, we will provide you with a reason why. You have the right to complain.

12. Making a complaint

If you have any concerns about how we collect, use or protect your personal information, we encourage you to contact us in the first instance so that we have an opportunity to investigate and resolve the matter.

Complaints about our handling of personal data should be made to Jackson Ng using the contact details provided on this website. We will:

• acknowledge receipt of your complaint within 30 days;
• make appropriate enquiries to investigate the issues you have raised;
• keep you informed of the progress of our investigation where appropriate; and
• provide you with the outcome of your complaint without undue delay.

If you remain dissatisfied after we have considered your complaint, or if you believe we have not handled your personal data in accordance with applicable data protection law, you have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent authority responsible for upholding information rights.

The ICO's contact details are:

• Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF
• Telephone: 0303 123 1113
• Website: https://ico.org.uk/make-a-complaint/

Please note that proof of identity is required should you choose to exercise any of the above rights in relation to personal data.

We retain the right to update this policy at any time. If there are changes that significantly impact your rights, we will contact you in advance.

Cookies

This website sets no cookies of its own and uses no analytics, advertising or tracking. Its fonts and videos are served from this website, not from third parties.

Facebook posts are shown only if you choose to show them. That choice is stored on your device so you are not asked again, and you can withdraw it at any time with the “Stop showing them” button. Once you choose to show them, Facebook may set its own cookies under its own policy. Links to X and Instagram are ordinary links and load nothing until you click them.