Privacy notice.
Version: 29 September 2026. This notice applies to pledges for the Those Who Served open letter.
Who is responsible?
Joshua Byron, Oliver Parsons and John Wood jointly operate Those Who Served and determine how the signatory register is used. Contact all three through hello@thosewhoserved.uk. Joshua Byron is the initial contact for privacy requests. You can exercise your rights against any of the organisers.
What we collect and why
For everyone: name, email address, signing category, consent record, the letter version supported and confirmation dates. For veterans: date of birth, regiment or service and service number. The veteran details record your service declaration and support duplicate controls; they do not independently verify service. Dates of birth are not currently used to verify identity. Any future verification process will be explained separately before it starts.
We use a keyed, non-readable representation of your email and service number for duplicate controls. Brief security records and hashed IP-based rate limits protect the service. Our infrastructure providers also process technical information such as IP addresses to deliver and secure their services.
Your consent
Signing can reveal political opinions. We rely on your consent under UK GDPR Article 6(1)(a) and explicit consent under Article 9(2)(a) for the signatory register. Participation is optional. Withdrawal does not affect the lawfulness of earlier processing. We rely on legitimate interests in protecting the service for proportionate security and abuse-prevention processing.
Who can see the information?
The three organisers can access the private register using the designated administrator account. Names and personal details are not published. Only the letter and aggregate totals are intended to be given to Members of Parliament. We do not sell the register, automatically share it on social media or subscribe you to campaign marketing.
Supabase provides database and authentication services; Vercel hosts the website and server; Resend delivers confirmation emails; Cloudflare Turnstile checks for automated abuse. Resend receives your email address and private confirmation and withdrawal links, but not your name, date of birth, regiment or service number. Share buttons contact a social platform only when you choose to use them.
Provider locations and international-transfer arrangements must be finalised before public signing opens.
Providers may process support, security or delivery information outside the selected hosting region. The organisers must ensure appropriate contractual and international-transfer safeguards apply. Contact us for details of the safeguards and providers.
How long we keep it
Unconfirmed requests expire after 48 hours. Confirmed pledges expire after 12 months, or are removed sooner when you withdraw. An automated daily cleanup deletes expired records. Withdrawal reference IDs, without names or contact details, are retained for 30 days to prevent withdrawn pledges being reinstated during recovery. Access audit records are retained for up to 90 days and rate-limit records for up to 32 days. Our supplementary encrypted backups, if enabled, are retained for no more than 7 days. Provider operational records follow their applicable retention settings and contracts.
Withdraw or correct your details
Use the private withdrawal link in your confirmation email to delete your pledge from the active register. Keep that email secure. For corrections, you can withdraw and submit again. If you lose the link, email hello@thosewhoserved.uk from the address you used; we will check the request before acting. You can request access, correction, erasure, restriction and portability where applicable, or complain to the UK Information Commissioner’s Office at ico.org.uk.
Security and essential technology
We restrict database access, encrypt identifying details and require administrator multi-factor authentication. No system eliminates all security risk. Essential authentication and anti-abuse technology is used to provide this service. We do not include advertising pixels or behavioural analytics.