Privacy-policy

Effective Date: 1st September 2025
Last Updated: 1st September 2025

At Mainstream Labour Ltd (Company number 16632688), (“Mainstream”, “we”, “us”, or “our”), we are committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use and protect any personal data we collect from you in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who are we?

Mainstream is the data controller responsible for your personal data submitted through this website and other means detailed below unless otherwise stated. If you have any questions about this policy, you can contact us at:

Email: info@mainstreamlabour.org

Address: 7 Cecil Road, London, United Kingdom, N10 2BU

2. What data do we collect?

The vast majority of the personal data we control relates to our members and supporters. A ‘member’ is anyone currently paying a subscription to Mainstream. A ‘supporter’ does not pay a subscription but either actively participates in Mainstream activities or else is signed up to our mailing list.

Below is a list of personal data we may collect during your time as a member or supporter. Not all categories will be relevant to you. There may also be times when you have volunteered this information and when you have the opportunity to opt-out of providing certain pieces of information.

Title, first name, last name, email address, postcode, home address, telephone number(s), date of birth.
Membership of a trade union, socialist society or any other Labour-aligned groups.
Whether you have a disability or any access requirements, specifically if you are a volunteer or participant in our activities.
Any roles and responsibilities you have as a Labour member or Mainstream member, any Labour / Mainstream groups you attend, your attendance and behaviour (how you voted, etc.) at any associated events.
Any communications we have with you which may be over email, SMS, telephone, instant messaging services or face to face.
Political affiliations and political opinions you have expressed at Mainstream meetings or events.
Publicly available information on websites including Companies House, electoral registers, news and broadcast media or historical publications.
Bank details including account holder name, sort code, account number, subscription amount, donation amounts and financial activity related to Mainstream.
Any personal data you volunteer in any free text fields in any paper-based or digital surveys, questionnaires or forms that are captured by Mainstream personnel.
Further information about yourself, your family and your circumstances you disclose in conversation and/or communications with/for Mainstream.
Details of any suspensions/expulsions from any political party or from Mainstream, any safeguarding issues, details of any complaints or concerns you have made or that are against you, details of complaint resolution including any sanctions, and information on any criminal activity.
Reasons why you discontinued your membership and all related information. [NOTE: we retain most ex-member personal data in order to maintain relationships with our networks and allies, and because we have a legitimate interest to keep a record of who has been a member of our organisation. From time to time we may contact ex-members to invite them to rejoin. As an ex-member you are free to opt-out of any contact from us at any time].
Aggregated data, and pseudonymous and anonymous data we have created from your personal data but we are unable to use to directly identify you.

We primarily collect data in two ways:

a. Anonymous Analytics Data

We use Plausible Analytics to understand how our website is used. This tool is fully compliant with GDPR and:

Does not use cookies
Does not track personal data
Only collects aggregate, anonymised usage statistics (e.g. page views, referral sources, device types)

More info: Plausible’s Data Policy.

b. Personal Data via Embedded Forms

We embed forms from Action Network and NationBuilder into our website and sometimes use these forms to register attendance at events or survey the views of members and supporters. These services may collect the following information when you fill out a form:

Full name
Email address
Phone number (optional)
Postcode or address
Any additional details you provide in form fields

These platforms are operated by third parties and act as data processors. Your data is securely stored and processed according to their own privacy policies:

We may also collect your data in other ways, including:

From yourself via email, telephone or face to face communications we have with you (direct data collection).
From yourself when you have interacted with Mainstream on the doorstep, during phone-banking, at an event, online, or other (direct data collection).
From other Mainstream members or supporters who know you or have information about you (indirect data collection).

3. Special Category Data

Mainstream may need to process more sensitive types of personal data known as special category data under the UK GDPR. This includes data revealing political opinions, trade union membership, health, sexual orientation, religious or philosophical beliefs, and racial or ethnic origin. For more on what counts as special category data, see the Information Commissioner’s Office website here.

If you become a member of Mainstream, your membership may indicate your political opinion and therefore qualify as special category data. We rely on your explicit consent to process your data, including communicating with you and managing your membership.

If you sign up as a volunteer and we record special category data—such as disability, sexual orientation, or political opinions—for the purpose of assigning you suitable tasks or supporting your role, we process this data under Art. 9(2)(d): as part of our legitimate activities as a not-for-profit with a political aim, and only in relation to members, former members, or others in regular contact with us.

4. How do we use your data?

We rely on a variety of lawful bases to process your personal data depending on the data subject and nature of the processing. Here are a list of processing activities we undertake for each of the lawful bases stipulated in the GDPR:

Necessary for the performance of a contract:

If you become a member: to process your membership application and manage your membership including processing subscriptions, donations and expenses.
If you are a member: to communicate with you on constitutional and administrative matters e.g. regarding subscriptions, voting rights and processes in internal elections, disciplinary matters, organisational changes, etc. [NOTE: we will continue such communications with you even if you unsubscribe from our mailing list].
If you are a member: to handle complaints made by you or against you, to conduct an investigation, gather evidence and make disciplinary decisions and apply sanctions; if appropriate, to liaise with the police, health service providers, charities or regulatory bodies on such matters.
If you are one of Mainstream’s elected representatives or candidates in internal elections: to process your applications, communicate with you throughout the election, and publicise information about you or your candidacy / elected position.
If you are a service provider: to instruct you, process your financial information, pay your invoices and discharge contractual obligations we owe to you.

Consent:

If you are a member: to communicate to you, whether by email, SMS, instant messaging service or phone, information relating to our campaigns, news, events, fundraising and how to get involved.
If you are a supporter who has signed up to our mailing list: to communicate with you via email regarding our campaigns, news, events, fundraising and how to get involved.
If you are a member or a supporter: to share your contact details and membership information with your local Mainstream group so they can communicate with you on local activities and news [NOTE: local groups have tiered secure access based on the branch’s proven record of activity and on condition of their data protection administrator completing GDPR training].

Legitimate interest:

If you have signed up as a volunteer: to communicate with you during campaigns in which you’re helping out. We will often supplement your data with internal notes on your activities, experience, bio, views, etc. if it’s necessary to achieve our legitimate purposes and to ensure we give you work and opportunities that are relevant and meaningful.
If you are a member or supporter: to help ensure our communications are relevant and meaningful, we may supplement the information you provide us with internal notes, tags, lists, filters, or classifications—such as whether you’ve attended an event, opened our recent emails, or engaged with particular campaigns. We do this to understand levels of engagement, segment our audience, and improve how we inform supporters about news, events and ways to get involved. This profiling does not involve automated decision-making that has legal or similarly significant effects.
If you are a member or supporter: to telephone you in order to develop relationships with you, build networks, and inform you of our activities and ways you can get involved.
If you are a member or supporter: to use the personal data you provide for internal research, statistical analysis, and reporting. This helps us understand our membership, improve our activities, and make informed decisions. We only use this information in aggregate or non-intrusive ways and never use it to make decisions about individuals.
If you are an ex-member: we retain at least some of your data (including name, contact details and level of involvement) to maintain relationships with allies and networks and because we have a legitimate interest to know who has been in our organisation. [NOTE: we will never send you unsolicited direct marketing by electronic communications on the basis of legitimate interests, but only on your consent].
If you are an influencer, pundit, trade union official, leading campaigner or high profile individual: to collect your contact information and information on your views, activities and behaviour where it is publicly available or revealed in our own interactions with you or your networks and to use that information to contact you on matters relevant to Mainstream’s purposes.
If you are an activist who shares our values and aims: to collect your contact information and information on your views, activities and behaviour, usually directly from you but also sometimes where it is publicly available or revealed in our own interactions with you or your networks, and to use that information to contact you on organisational matters.
If you are a Labour councillor, local candidate, Labour MP or parliamentary candidate who we deem are sympathetic to Mainstream’s mission: to collect your contact information and information on your views, activities and behaviour where it is publicly available or revealed in our own interactions with you or your networks, and to use that information to contact you on matters relevant to Mainstream’s purposes including to support your electoral campaigns.
If you are a journalist: to collect your contact information and information on your journalistic activities for the purpose of briefing you.

Vital interest:

To handle serious complaints made by you or against you on matters which might endanger life or health, to conduct an investigation, gather evidence and make disciplinary decisions and apply sanctions; if appropriate, to liaise with the police, health service providers, charities or regulatory bodies on such matters.
To support members and supporters who are at risk of mental or physical harm in the context of Mainstream activities.

Legal obligation:

If you have made financial contributions to Mainstream: we will retain your financial information for 7 years as per HMRC guidance after which time we will securely destroy your financial information.
To respond to subject access requests or any other exercise of a data subject’s right under the GDPR.
To communicate with regulators (incl. the Information Commissioner’s Office and Electoral Commission) and discharge our compliance duties under relevant legislation.
To communicate with the police or other authorities in criminal matters.
To conduct litigation and legal negotiations.

5. How do we keep your data secure?

We take appropriate technical and organisational measures to protect your data from loss, misuse, unauthorised access, or disclosure. These include protecting your information using firewalls, anti-malware, password protection and, where appropriate, encryption.

We use Stripe in order to process financial transactions. This service may process your financial details. Stripes uses advanced encryption technology in order to protect transactions and your data.

We train our staff and volunteers to understand data protection and to keep your data secure. We ensure that all individuals who have access to your data sign data protection agreements, which detail their duties to keep your data secure and not to disclose it to anyone else without our authorisation.

6. Who has access to your data?

We only provide your data to other people for the purposes above as follows:

a. To our own staff, volunteers and contractors (including data processing companies) who are under a legal duty to keep it confidential.

b. To HM Revenue and Customs, the Electoral Commission or similar organisations, where we are required by law to do so.

We may use your data in connection with an activity arranged by an organisation working in partnership with us (for example, organising a conference) but we will not share your data with them.

In addition to Action Network and NationBuilder, mentioned in 2.b. of this Privacy Policy, we use Stripe, for processing financial transactions such as those required to initiate membership of Mainstream, and Google Workspace, as our file management system. More information on how Stripe and Google process your personal data and your data protection rights, including your right to object, is available here and here.

We do not sell or share your data.

7. International Transfers

We may need to transfer your data to jurisdictions outside the UK. Such platforms we use that may store data on servers outside the UK include:

Google (Google Workspace)
Nationbuilder
Action Network
Meta

When this happens, they are required to provide adequate safeguards under UK data protection law, such as standard contractual clauses or UK adequacy regulations.

8. For how long will we keep your personal data?

We retain your data only as long as we deem it necessary, relevant and adequate in relation to the purpose of its collection. The retention period will vary depending on the nature of the data and the context.

If you have signed up to our mailing list as a member or supporter, we will retain the contact data you have provided us until you tell us to delete it and we will continue to mail you our events, news and ways to get involved until you tell us not to.

If you are a member who cancels your membership, we will retain at least some of your data (including name, contact details and level of involvement) until you tell us to delete it. We retain the data of ex-members in order to maintain political relationships with our allies and networks and we may contact ex-members in the future to invite them to rejoin. We also retain ex-members’ data on the basis of keeping people safe from any harm, and our legitimate interest in knowing who has or has not been a member in the past when there may be future safeguarding or legal concerns or requests for member information.

If you submit an erasure request, we will delete your data from any and all locations we hold your personal data as soon as is reasonably practicable, although we will retain your information if:

It has been, or is being used within a complaints, disputes or grievance process and we may need to evidence this in the future to defend legal claims.
We need to keep it to comply with a legal obligation.
There is information associated with your data which is of a safeguarding concern to yourself or others.
Erasing will mean we lose our logs of when you made any data protection rights requests.
Erasing will mean we are unable to understand if you have been a member in the past.

9. What are your privacy rights?

Under the GDPR you have the following rights regarding your personal data:

Right to be informed – You have the right to be told how we use your personal data. This privacy notice is part of fulfilling that right.
Right of access – You can request a copy of the personal data we hold about you.
Right to rectification – You can ask us to correct or complete inaccurate or incomplete data.
Right to erasure – In certain circumstances, you can ask us to delete your personal data. This is also known as the “right to be forgotten”.
Right to restrict processing – You can request that we limit how we use your data in certain circumstances.
Right to data portability – You have the right to receive your data in a commonly used, machine-readable format, and to ask that we transfer it to another organisation.
Right to object – You can object to our use of your data where we rely on legitimate interests or carry out direct marketing.
Rights in relation to automated decision making and profiling – You have rights where automated processing significantly affects you, though we do not typically engage in such processing.

To exercise any of these rights, or if you have questions about how we process your personal data, please contact us at: info@mainstreamlabour.org.

‍If you are not satisfied with how we respond, you also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at www.ico.org.uk.

10. Changes to this Policy

We may update this Privacy Policy from time to time. When we do, we’ll revise the “Last Updated” date at the top of this page. We encourage you to review this policy periodically.