This document is a draft under review and not yet finalised. It may change before Plant-Based Universities campaigns launch publicly.

Plant-Based Universities: Privacy Policy

Last updated: 5 July 2026

This policy explains how Plant-Based Universities ("we", "us") collects and uses your personal data when you sign a petition, RSVP to an event, or contact us through act.plantbasedunis.org and related Plant-Based Universities sites.

1. Who we are

Plant-Based Universities is a student-led campaign network operating across UK and European universities. [Legal status / registered address to be confirmed.] For any privacy question, contact us at [privacy@plantbasedunis.org].

2. What we collect

When you sign a petition or RSVP to an event we collect:

your first and last name
your email address
optionally: phone number, postcode, and your role at the university (e.g. student, staff)
technical data automatically logged when you submit the form: IP address, browser/user-agent, timestamp, and the campaign you signed
your consent record (the version of this policy you agreed to, and when)

If you fill in our "Start a campaign" contact form we additionally collect your university name and any message you send us.

3. Why we process it and on what legal basis

To record your signature on a petition and display an anonymised signature count: legitimate interests and your explicit consent.
To send you a confirmation email and, where you've opted in, occasional campaign updates: your consent (UK GDPR Article 6(1)(a)).
To deliver the petition to the named decision-maker on your behalf: legitimate interests and your explicit consent.
To operate, secure, and improve our website: legitimate interests.
To respond to enquiries from the "Start a campaign" form: legitimate interests.

4. Who we share it with

We use the following processors:

NationBuilder: the CRM and email platform that stores signatures and sends confirmation and campaign emails on our behalf.
Railway: hosting provider for our websites and database.
[Email delivery / analytics providers: list once finalised.]

We do not sell your data and we do not share it with universities, third-party campaigners, or advertisers. Your name may appear on the public petition page as a signer unless you ask us to anonymise it.

5. International transfers

Some of the processors above operate in countries outside the UK/EEA, including the United States. Where this is the case we rely on the UK International Data Transfer Addendum and EU Standard Contractual Clauses to keep your data protected.

6. How long we keep it

We keep signature data for the duration of the campaign and for up to [24 months] afterwards so we can report impact and contact past supporters about follow-up campaigns. We delete or anonymise it earlier on request.

7. Your rights

Under UK and EU GDPR you have the right to access, correct, delete, or export your data, to withdraw consent, and to object to processing. Email [privacy@plantbasedunis.org] to exercise any of these rights. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local EU data protection authority.

8. Cookies

We use only the cookies strictly necessary to operate the website and remember your session. We do not use advertising cookies.

9. Changes

We may update this policy. Where changes are significant we will note them on the page and, where appropriate, ask you to re-confirm consent before your next action.