Data protection

Data Protection & Public DPIA Summary

This page explains how Who You With? is designed to collect only what is needed, protect sensitive political answers, and publish anonymous aggregate results rather than personal political profiles.

It is a public summary of the privacy-by-design approach used on the site. It is not legal advice and does not replace a full internal compliance record.

Minimal data No full name, phone number, full address, membership number or photo ID is requested.

Aggregate public results Public pages show grouped totals and percentages, not individual political records.

Postcode lookup only The postcode is used to match areas. The matched areas are stored; the postcode is not stored with the entry.

User control Verified users can update, refresh or delete their current entry.

Processing purpose

Why the service needs to process data at all.

Who You With? allows verified users to record a current political preference and helps publish anonymous aggregate results by party, movement type and voting area.

The aim is not to build a named voter database. The aim is to show grouped political preference data by area once enough entries exist to show the result responsibly.

Who You With? may also process voluntary donation records to support the running and promotion of the service. Donation records are separate from political tracker entries.

Main privacy risks considered

The design starts from the position that political answers need stronger protection.

Political opinions are sensitive Political preference and party membership answers require extra care because they can reveal sensitive views.

Small local samples can be risky Very small ward or movement totals could increase identification risk if shown too early.

Email verification is still account control Email is needed to reduce abuse and let users return, but it must be kept separate from political entries.

Area matching can add sensitivity Postcode-derived areas become more sensitive when combined with political answers.

Anti-abuse checks are needed The tracker needs controls against bots and repeat fake entries without collecting unnecessary personal information.

Funding records must not identify political choices Donation and payment records need to be kept away from political answers so project support cannot become a donor-to-vote profile.

Safeguards used

The system is built to separate identity, area lookup and public political results wherever practical.

Public display controls

Public results are aggregate only.
Small local results and small movement rows are hidden until display thresholds are met.
Party logos are served from local uploaded files to avoid third-party image tracking.
The admin dashboard is designed around aggregate statistics rather than individual voter records.

Data minimisation

No full name, phone number, full address, membership number or photo ID is requested.
Postcodes are used for lookup only. The matched voting areas are stored; the postcode itself is discarded and not stored with the entry.
Technical anti-abuse signals are hashed and kept separate from the political entry where practical.
Remember-this-device is opt-in rather than pre-selected.

Email and entry separation

Email addresses used for account lookup are stored as keyed hashes, not plain text.
If reminder emails are switched on, the contact email is stored separately as an encrypted value and used only for expiry reminders.
The bridge between email verification and the anonymous entry is encrypted.
Users verify by email and can update, refresh or delete their current entry.

Donation separation

Donation records are stored separately from political tracker entries.
Donation records do not include party choice, political answers, postcode, ward, constituency or tracker entry ID.
Public donation transparency shows aggregate money totals only.
Donor names, donor email addresses and payment references are not published.

Consent and retention

Explicit consent is requested before political-answer processing.
Entries count in public results for 24 months from the latest save or update.
After that, entries become dormant, stop counting publicly, and may remain recoverable for a further 12 months.
Entries are deleted from the live system after 36 months unless refreshed.
Optional reminder emails are off by default and are used only for expiry reminders if enabled.

Anonymisation position

Public output and underlying service records are treated differently.

Public results are anonymous and aggregate.

The public site shows grouped totals and percentages. It does not show a person’s email address, postcode or individual political answer.

The underlying service records are still treated as personal data because an email-verified account system exists. The database is designed to avoid a plain person-to-vote link: the email verification record is separate from the political entry, and the bridge between them is encrypted.

This means the public result is anonymous by design, while the live system is still handled carefully as a service processing sensitive political-answer data.

Retention and cleanup

Entries should not count forever unless the user comes back and refreshes them.

Active for 24 months Individual tracker entries count from the most recent submission or update.

Dormant for 12 months Older entries stop counting publicly but may remain recoverable so the same verified user can refresh them.

Deleted after 36 months If not refreshed, the entry is deleted from the live system.

Older entries are excluded from live results, unlock thresholds, maps and public percentages.

Reminder emails are only sent where a user opts in. They are used before the active counting period ends and do not include political answers, postcode or voting-area details.

Aggregate snapshots may be retained where they are non-identifying and meet the tracker’s public threshold rules.

Donation records are separate from tracker entries and may be retained where needed for payment reconciliation, fraud prevention, accounting, legal obligations and transparent aggregate funding reporting.

Donations and funding transparency

How project support is handled without linking it to political answers.

Funding transparency is aggregate only.

The Donate page may show completed donation totals for the past 90 days, past 365 days and all time. It does not publish donor names, donor emails, payment references or political preferences.

Donations may support hosting, security, development, data maintenance, postcode and area matching, public awareness, and advertising the Who You With? tools and service.

Donations are not used to support, oppose, promote or campaign against any political party, candidate or election outcome. They do not affect results, party listings, rankings, area visibility, editorial wording or how entries are counted.

Payments are processed through SumUp Hosted Checkout. Payment-provider records are handled separately from tracker-entry records.

ICO registration

A transparency step for the project’s data-controller obligations.

ICO registration number ZC136486

Who You With? is registered with the UK Information Commissioner’s Office for data protection purposes.

ICO registration is not an endorsement of the site or its results. It is a transparency step showing that the project has taken its data-controller obligations seriously.

User rights handling

Users should be able to control their own entry without exposing their political answer to others.

Logged-in users can delete their own entry using the Delete my entry page.

Requests for access, correction, deletion or withdrawal of consent can also be sent to contact@whoyouwith.org.uk. Requests should be handled without publishing or revealing the user’s political answers to others.

A minimal deletion log may be kept for up to 12 months containing only a hashed email address, deletion method and deletion time. It does not include political answers, postcode or area records.

Last updated: 6 May 2026.