Our Website Privacy Policy

1. Data we collect & process
2. Lawful bases for processing
3. Where we get information from
4. How we store information, and for how long
5. Who we share your data with

1. Website Security Data
   We collect or use the following personal information from Security Sensitive Traffic (accessing administrative or backend areas of the site including the login page, or users identified as a potential malicious threat) for Website Security and Threat Prevention:
   • Visitor IP Address
   • Visitor Proxy IP Address
   • URL accessed
   • Complete HTTP header
   • HTTP request body
   • Names of uploaded files if malware is detected within them
   • Country of user
   • Device of user
   • Website Admin Email Addresses
   • Find more information on the WordFence privacy policy page.
2. Google Analytics Data
   We collect or use the following personal information for Analytics and Web Statistics, when opted-in through accepting our Cookies:
   • User data: information about the user’s device, browser, and operating system, to understand our audience’s technical demographics.
   • Session data: such as session duration, pages visited, and the sequence of pages viewed.
   • Traffic source data: how visitors have arrived at our site.
   • Event data on specific actions or events triggered by users, such as page views, button clicks, product views, file downloads, and custom events as defined by the site owner.
   • Online identifiers, including cookie identifiers, internet protocol addresses (redacted and gives a city-based approximation) and device identifiers; client identifiers
   • We do not make, and do not allow our Google Analytics settings to make, any attempt to find out the identities of those visiting our website. By default, we do not share your data with other Google services.
3. Cookies:
   • Our website, or third-party providers embedded onto our website (e.g. Google Maps) may utilise cookies to collect or store information on your device, in order to provide website functions, for statistics or marketing and tracking purposes.
   • You can access the full list of Cookies currently used on our site at www.davidsmithnorth.co.uk/cookies
   • Optional cookies are enabled/disabled by expressing your preferences when initially visiting the site. Your preferences are retained for 365 days, but may be changed sooner using the Data Preference menu, or by visiting our Cookies Page.
4. Email List for Constituency News and Events: For those who opted to complete the ‘Join my Newsletter’ form, or by contacting me you are giving me the consent to sent you further emails about Constituency news and events. You can opt out of this at any time by requesting not the be included in future correspondence. We collect or use the following personal information for Maintaining our Email List and providing Newsletters & Constituency Updates:
   • First Name
   • Surname
   • Email Address
   • Your consent to process the data
   • Logged-in user ID (if logged in with an account on the website)
   • You can unsubscribe from email updates at any time by using the unsubscribe link within our emails, or by contacting us.
5. Emails: For users who contact David via email, we collect or use the following personal information for responding to your query and providing any ongoing support:
   • First Name
   • Surname
   • Email Address
   • Home Address
   • Phone Number (if provided)
   • The nature of your query (if provided)
   • The content of your message or query
   • Your consent to process the data
   • I would like to send you information about constituency news and events, by contacting me you are giving me the consent to sent you further emails about Constituency news and events. You can opt out of this at any time by requesting not the be included in future correspondence.
6. Backend Functions
   Our site is hosted by a trusted web host provider, and data is stored securely on Web Servers located within the United Kingdom. Some server access data may be logged by our provider on our server for security, legal compliance, and web hosting purposes. We collect the following data:
   • Server Request Access Logs
     • IP Address
     • Server Request (GET/POST etc.)
     • Device of Requestee
     • Country of Requestee
   • These data are generally only stored for those who make specific requests to the server (e.g. site admins, bots, etc.)
7. User Login & Profile Information
   We collect infomation about registered users to the website (this is currently limited to site admins). This includes:
   • Profile Picture (if uploaded)
   • Email Address
   • Password (encrypted & secured)
   • Name / Profile Name
   • IP Address for Password Resets
   • Website Bio (if provided)
   • Website Link (if provided)

• Links to Third-Party Sites: we link to some external sites outwith our jurisdiction, which may process your data on our behalf. This includes the following pages:
  • UK Parliament Webpage: David’s Parlimentary page displays his voting record, contributions to the house, and more. View Parliament’s privacy policy here.
• Embedded or linked content from other websites:
  • Articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites, when enabled, behaves in the exact same way as if the visitor has visited the other website.
  • These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website, and if you agreed to accept the relevant cookies when initially visiting our site.
  • When clicking on links external to the website, your data will no longer be subject to our privacy policy; instead that of the site you have visited.

1. Website Security Data
   Our lawful bases for collecting and processing website security data are:
   • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
     • collecting data in the interests of data and website security and cybercrime prevention, protecting the website from malicious interference and hacking attempts, protecting user data.
2. Google Analytics Data
   Our lawful bases for collecting and processing Google Analytics data are:
   • Your Consent (for Statistics Cookies) – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
   • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
     • collecting non-sensitive or identifiable website usage data (e.g. number of pageviews) to provide insights and improve website user experience.
3. Cookies
   Our lawful bases for using cookies on our site and your device are:
   • Legitimate interests (for Functional Cookies) – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
     • Functional Cookies are required by websites to support core functions. Without these cookies, the website would not work or perform correctly.
   • Your Consent (on our Cookies Banner, for Optional Cookies) – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
4. Email Newsletter Subscription
   Our lawful bases for collecting, processing and sharing your Email Subscription data within the Office of David Smith MP are:
   • Your Consent (when completing our mailing list form) – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
5. Emails
   Our lawful bases for collecting, processing and sharing your emailed information within the Office of David Smith MP are:
   • Your Consent (when sending the email to us) – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
6. Backend Functions
   Our lawful bases for collecting and processing server backend functions are:
   • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
     • collecting data in the interests of data and website security and cybercrime prevention, protecting the website from malicious interference and hacking attempts, protecting user data.
7. User Login & Profile Information
   Our lawful bases for collecting and processing registered user details (currently limited to site admins) are:
   • Your Consent (when registering an account with us) – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

• Directly from you;
• Anyone who submits data on your behalf;
• From your browser through our cookies;
• From tags in URLs, such as referrer tags.

1. Website Security Data
   • Stored only for access to administrative or secure pages on the site, or for users with suspicious activity on our main pages (Security Sensitive Traffic);
   • Stored securely on our web server hosted in the United Kingdom by Hostinger;
   • Stored only for 30 days before being deleted.
2. Google Analytics Data
   • Stored securely in the Google Cloud or on our server. (We hold Data Processing Agreements with all third-party data processors).
   • The maximum time data is stored is 2 months, before being deleted.
3. Cookies
   • Cookies are stored securely on your browser or device, for seamless user experiences, integrations, statistics, and marketing.
   • We will never set marketing cookies on your device, but some third-party apps embedded onto our site (e.g. Google Maps) may do this.
   • The duration of cookies being set is outlined in our cookie policy.
   • Your cookie preferences are saved for 365 days, after which you will be asked to indicate these again. You can update your preferences at any time by clicking on the banner, or visiting our cookies page.
4. Email Newsletter Subscription
   • This data is sent and stored securely with our trusted email provider – the privacy policy for this resource can be found here.
   • Your details will remain on our contact database until you unsubscribe (using the link in emails, or by contacting us), or until removed if you do not respond to our periodic re-confirmation emails.
5. Emailed Messages
   • This data is stored securely on the Parliamentary Email host, accessible by David Smith MP and authorised Office Staff members.
   • We will retain your information for as long as necessary to respond to your query, and any longer as required to comply with our legal obligations.
   • We may subscribe you to our emailing list, you have the right to opt-out from this or unsubscribe at any time.
6. Backend Functions
   • This data is stored securely on our web server located within the United Kingdom.
   • This data is retained for 7 days.
7. User Login & Profile Information
   • This data is stored securely on our web server located within the United Kingdom.
   • This data is retained for as long as the account is held on the website.
   • Accounts inactive for over 365 days will be listed for deletion.

1. WordFence Security Network
   Website security functions. We share limited security information (such as the IP Address and HTTP Request Header) with WordFence for threat detection and cybersecurity. WordPress Performance and feedback information may also be sent to the WordFence network. We hold a Data Processing Agreement (DPA) for this information.
   • Subprocessors: Amazon Web Services Inc, Twilio, Freshworks, Mode Analytics, Google LLC.
2. Google Analytics
   Google Analytics securely stores our sites’ analytics data. A data protection agreement is in place for any data transferred. Google may securely store or transfer data to a sub-processor as listed below.
   • Link: How Google uses your data
   • Link: Google Sub-Processors
   • You can prevent your data from being used by Google Analytics by using the Google Opt-out Browser Add-on, available at this link. 
3. Action Network (Email Newsletter)
   Action Network (operating as Action Squared, Inc.) securely stores your email address and name, in order to contact you with constituency news and events, if subscribed. We hold a data processing agreement with Action Network.
4. Password Reset
   If you request a password reset, your IP address will be included in the email.

1. UK Parliament
   If contacting us by email, information may be securely stored in servers managed by the UK Parliament.

• Relevant regulatory authorities (to comply with legal obligations or reporting requirements, as necessary);
• Organisations we’re legally obliged to share personal information with (e.g. the Police or Courts, on presentation of a valid warrant).