This document is a draft under review and not yet finalised. It may change before Plant-Based Universities campaigns launch publicly.

Plant-Based Universities: Privacy Policy

Last updated: 28 September 2026

This policy explains how Plant-Based Universities ("we", "us") collects and uses your personal data when you sign a petition, RSVP to an event, or contact us through act.plantbasedunis.org and related Plant-Based Universities sites.

1. Who we are

Plant-Based Universities is a student-led campaign network operating across UK and European universities. [Legal status / registered address to be confirmed.] For any privacy question, contact us at [privacy@plantbasedunis.org].

2. What we collect

When you sign a petition or RSVP to an event we collect:

your first and last name
your email address
optionally: phone number, postcode, and your role at the university (e.g. student, staff)
technical data automatically logged when you submit the form: IP address, browser/user-agent, timestamp, and the campaign you signed
your consent record (the version of this policy you agreed to, and when)

If you fill in our "Start a campaign" contact form we additionally collect your university name and any message you send us.

Separately, we collect basic usage statistics from everyone who visits the site, whether or not you fill in a form: the pages you look at, the site or search engine you arrived from, your approximate location, and your device and browser type. Matomo runs on our own servers without analytics cookies and is not linked to your signature or contact details.

PostHog analytics

We use PostHog to understand how our websites and signed-in tools are used and to improve our campaigns. It measures page visits, clicks, campaign sources, browser and device information, and approximate location derived from your IP address. PostHog starts only after you make a choice in the cookie banner:

Accept cookies: PostHog uses first-party cookies and local storage to recognise your browser and measure sessions and return visits. In our signed-in tools, activity is also linked to your account ID, name, email address, university and country.
Reject cookies: PostHog continues with cookieless analytics. It estimates daily visitors using a rotating hash of your IP address and browser information, without storing an analytics visitor ID on your device or linking activity to your account. Rejecting cookies does not stop this cookieless measurement.

Public-site analytics is not linked to your petition signature or contact details. We do not send PostHog public form contents, phone numbers or other contact details beyond the signed-in account information described above. We do not record sessions. Your cookie choice applies even if your browser sends Do Not Track. You can change your choice using Analytics preferences at the bottom of each site. Choosing Reject cookies after accepting clears the stored analytics identity and switches to cookieless measurement. Browser storage still remembers your choice.

3. Why we process it and on what legal basis

To record your signature on a petition and display an anonymised signature count: legitimate interests and your explicit consent.
To send you a confirmation email and, where you've opted in, occasional campaign updates: your consent (UK GDPR Article 6(1)(a)).
To deliver the petition to the named decision-maker on your behalf: legitimate interests and your explicit consent.
To operate, secure, and improve our website: legitimate interests.
To respond to enquiries from the "Start a campaign" form: legitimate interests.

4. Who we share it with

We use the following processors:

NationBuilder: the CRM and email platform that stores signatures and sends confirmation and campaign emails on our behalf.
Railway: hosting provider for our websites and database.
Matomo: the analytics software that produces the usage statistics above. We host it ourselves on the Railway infrastructure already listed.
PostHog: hosted usage analytics for page visits and clicks, using cookieless tracking if you reject analytics cookies. Public-site activity is not linked to your signature or account. In our signed-in tools, users who accept analytics cookies have activity linked to their account ID, name, email address, university and country. We do not send phone numbers, other contact details or public form contents, and do not record sessions.
[Email delivery provider: list once finalised.]

We do not sell your data and we do not share it with universities, third-party campaigners, or advertisers. Your name may appear on the public petition page as a signer unless you ask us to anonymise it.

5. International transfers

Some of the processors above operate in countries outside the UK/EEA, including the United States. Where this is the case we rely on the UK International Data Transfer Addendum and EU Standard Contractual Clauses to keep your data protected.

6. How long we keep it

We keep signature data for the duration of the campaign and for up to [24 months] afterwards so we can report impact and contact past supporters about follow-up campaigns. We delete or anonymise it earlier on request.

7. Your rights

Under UK and EU GDPR you have the right to access, correct, delete, or export your data, to withdraw consent, and to object to processing. Email [privacy@plantbasedunis.org] to exercise any of these rights. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local EU data protection authority.

8. Cookies

We use cookies needed to operate the website and remember your session, and browser storage to remember your analytics preference. We do not use advertising cookies. PostHog starts only after you choose Accept cookies or Reject cookies. Accept enables first-party cookies and local storage to recognise return visits and sessions. Its visitor cookie expires after one year. Your cookie choice is remembered in local storage; you can change it through Analytics preferences at the bottom of the site. Rejecting clears the stored analytics identity and switches PostHog to cookieless analytics without account identification. Browser storage still remembers your cookie choice.

9. Changes

We may update this policy. Where changes are significant we will note them on the page and, where appropriate, ask you to re-confirm consent before your next action.