Action on Antisemitism

Your data rights

Last updated: 1 May 2026

Under the UK GDPR and the Data Protection Act 2018 you have eight enumerated rights when an organisation handles your personal data. This page explains how to exercise each of those rights against Action on Antisemitism.

1. Right to be informed

What we collect, why, and on what legal basis is set out in our Privacy Policy. The short version: we collect what's needed to send your email, prove the campaign reached its target, and let you log in if you've signed up.

One important non-collection: when you email an MP or councillor through the platform we ask for your full postal address (so the office can verify constituency), but that address goes straight from your browser into the email body — we never write it to our database, never log it, and never retain it anywhere on our servers. There's nothing to subject- access or erase, because there's nothing to find.

2. Right of access (subject access request)

You can ask us for a copy of every piece of personal data we hold about you. If you're signed in, the fastest route is /me/data.json — a one-click JSON download of your account, sessions, memberships, and tickets. For anything not covered there (events tied to a campaign you used as an anonymous supporter, tracked-BCC records), email contact@actiononantisemitism.org. We respond within 30 days, free of charge.

3. Right to rectification

Correct your name, email, or two-factor enrolment any time at /me. To correct anything else, email us.

4. Right to erasure ("right to be forgotten")

Delete your account at any time at /me — this removes your user row, sessions, MFA secret, and recovery codes. Some campaign-event rows (postcode lookups, tracked sends) are retained because they're aggregated platform records and don't reference your account. To request deletion of records tied to your hashed IP, email us with the campaign and approximate date.

5. Right to restrict processing

You can ask us to stop processing your data while a complaint is open, while accuracy is being verified, or where you've objected. Email us at contact@actiononantisemitism.org describing what you'd like restricted and why.

6. Right to data portability

The /me/data.json download is provided in machine-readable JSON specifically so you can take it to another service. We can also export aggregated campaign records as CSV from the admin pages on request.

7. Right to object

You can object to processing based on legitimate interests (engagement metrics, basic anti-abuse). Email us — we'll review whether our interest still outweighs your objection given your specific circumstances.

8. Rights related to automated decision-making

We don't make automated decisions about you that have a legal or similarly significant effect. AI features (subject suggestions, content-safety flags) are advisory only — a human can always override them, and they don't decide whether your campaign runs.

How to make a request

  1. Email contact@actiononantisemitism.org with the subject Data request: <type> (e.g. Data request: erasure).
  2. Include enough information for us to find you in our records — the email address you signed up with, the campaign you used as a supporter, or both.
  3. We'll respond within 30 calendar days. We may ask for ID if the request is unusually broad and we can't otherwise verify it's coming from you.
  4. If we don't respond, or you're unhappy with our response, you can complain to the Information Commissioner's Office, the UK's data-protection regulator.

Data Protection Officer

We don't formally appoint a DPO under Article 37 — we're below the thresholds. The same address (contact@actiononantisemitism.org) reaches the data-controller equivalent for any of the requests above.

Retention

We keep platform records for 5 years from the date of creation (events, audit log, mail log, replies, support tickets after closure). Operational data with no after-the-fact value is purged sooner: live sessions are dropped 30 days past expiry, login-attempt counters after 30 days. Individual orgs can ask for a shorter retention window via the platform admin — they cannot extend it beyond the 5-year policy.

Account records (your user row, MFA secret, recovery codes, avatar) are retained until you delete the account at /me. Subscription records are kept until you unsubscribe; once unsubscribed, the row is retained as a suppression list entry to honour the unsubscribe.

Sub-processors

We use a small set of vendors to deliver the platform. They process personal data on our instructions only. Current list: