Privacy Policy

UKVIA is the data controller responsible for the personal data collected through the Campaign. Our details are:

• Registered name: UK Vaping Industry Association
• Privacy contact email: info@ukvia.co.uk

If you have any questions about this policy or about how we handle your personal data, please get in touch using the details above.

When you sign the Enough is Enough petition or pledge, or otherwise get in touch about the Campaign, we may collect:

• Your name
• Your email address

We may also automatically collect limited technical information when you visit the Campaign website, such as your IP address, browser type and device information, for security and analytics purposes. This is covered by our separate Cookie Policy, not this document.

We collect personal data directly from you, when you voluntarily provide it by completing the petition or pledge form on the Campaign website, or by contacting us directly (for example, by email) about the Campaign.

We use the personal data you give us to:

• Record and verify your support for the Enough is Enough petition or pledge, and maintain an accurate list of signatories
• Keep you updated on the progress of the Campaign, if you have opted in to receive updates
• Compile aggregate, anonymised statistics about the level of public support for the Campaign (for example, the total number of signatories), which we may reference publicly or in discussions with policymakers — this does not involve sharing your individual personal data
• Respond to any questions or correspondence you send us about the Campaign

Our legal basis for processing your data in this way is your consent (Article 6(1)(a) UK GDPR), which you give when you submit your details to us. You can withdraw your consent at any time — see “Your rights” below.

We do not sell, rent or share your personal data with third parties. Your data is collected, stored and processed in-house by UKVIA, and access is limited to authorised UKVIA staff who need it to administer the Campaign.

The only exception is where we are required to disclose personal data to comply with the law, a court order, or a valid request from a public authority or regulator.

We keep your personal data for as long as you continue to support the Campaign. If you ask us to remove your support, unsubscribe from updates, or withdraw your consent, we will delete or anonymise your personal data within a reasonable period (normally no later than 30 days), except where we are required to retain certain information for legal, regulatory or accounting purposes.

Under UK GDPR, you have the right to:

• Ask us what personal data we hold about you, and receive a copy of it (right of access)
• Ask us to correct any inaccurate or incomplete data (right to rectification)
• Ask us to delete your personal data (right to erasure)
• Ask us to restrict how we use your data, or object to us using it (rights to restriction and objection)
• Ask us to provide your data in a portable format (right to data portability)
• Withdraw your consent at any time, without affecting the lawfulness of processing before you withdrew it
• Complain to the Information Commissioner's Office (ICO) if you believe we have not handled your data properly

To exercise any of these rights, please contact us using the details in Section 1. If you remain unhappy with our response, you can contact the ICO at ico.org.uk or on 0303 123 1113.

We use appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse or alteration, including access controls, secure storage and encryption of data in transit.

The Campaign is aimed at adults and is not directed at children. We do not knowingly collect personal data from anyone under the age of 18. If you believe a child has provided us with personal data, please contact us so we can remove it.

We may update this policy from time to time, for example to reflect changes in the law or in how the Campaign operates. The most recent version will always be available on the Campaign website, with the date of the last update shown below.

If you have any questions about this privacy policy, or wish to exercise any of your rights, please contact us at the details set out in Section 1 above.