Privacy Policy

Last updated: 30 July 2026

This policy explains how we collect, use, share and protect personal data collected through buybackbrixton.org (the "Site"), including via the mailing list sign-up form. It has been written to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who is responsible for your data

The Buy Back Brixton campaign is run in partnership by:

  • The Advocacy Academy ("TAA"), a registered charity (Charity No. 1161785), of Unit 1, 2 Beehive Place, London, UK; and
  • Brixton Traders Community Association ("BTCA"), of Impact Brixton, 17a Electric Lane at Impact Brixton, SW9 8LA, Brixton, London, UK.

TAA and BTCA act as joint controllers of the personal data collected through the Site's mailing list sign-up form, within the meaning of Article 26 UK GDPR. This means both organisations jointly decide the purposes and means of processing your data, and both are responsible for complying with this policy.

A summary of the arrangement between TAA and BTCA as joint controllers is available on request from the contact below. TAA is the designated first point of contact for data subjects wishing to exercise their rights (see Section 8).

Shape History Ltd acts as a data processor, providing communications support to the campaign under instruction from TAA. Impact Brixton (site build and hosting) also acts as a data processor, handling data only as instructed and for as long as needed to provide the website and hosting service. Neither Shape History nor Impact Brixton use your data for their own purposes.

2. What personal data we collect

When you sign up to the mailing list on the Site, we collect:

  • Your name
  • Your email address
  • How you identify in relation to the campaign (trader, local resident, supporter or other)

If you donate via our GoFundMe page, your donation is processed directly by GoFundMe, which acts as an independent data controller for that transaction. See Section 9.

The Site sets no cookies and runs no analytics, so we do not collect technical data about your visit. See our Cookie Policy.

3. Why we use your data and our lawful basis

We only use the data you provide through the sign-up form for the purposes you have actively and separately consented to when signing up. We rely on consent (Article 6(1)(a) UK GDPR) as our lawful basis, which you may withdraw at any time.

The sign-up form asks for consent to each of the following separately. You can choose one, both, or neither:

  • Campaign updates: news, milestones and ways to get involved with the Buy Back Brixton campaign specifically.
  • The Advocacy Academy newsletter: broader news about TAA's wider work and future campaigns, beyond Buy Back Brixton, sent by TAA on an ongoing basis (including after this campaign concludes).

We will not use your data for any purpose you have not consented to, and we will not combine, sell or pass on your data to any third party for their own marketing purposes.

4. Your consent and choices

Consent is collected via unticked checkboxes on the sign-up form. Nothing is assumed or pre-selected. You must actively opt in to each use of your data described in Section 3.

You can withdraw consent at any time by using the unsubscribe link in any email you receive, or by contacting us using the details in Section 8. Withdrawing consent will not affect the lawfulness of processing carried out before you withdrew it.

5. Who we share your data with

Your sign-up data is shared only with:

  • The Advocacy Academy and BTCA, as joint controllers, for the purposes described in Section 3;
  • Impact Brixton, as the developer and host of the Site, solely to operate and maintain the sign-up form and underlying database;
  • Shape History Ltd, as communications support to TAA, solely to help manage and send campaign communications.

We do not sell your data, and we do not share it with any other third party without telling you, unless required to by law.

6. International data transfers

Where any of the processors listed in Section 5 store or process data outside the UK or European Economic Area (for example, if our email platform's servers are located in the US), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or the UK International Data Transfer Addendum, and that the recipient provides an adequate level of data protection.

7. How long we keep your data

We keep sign-up data for as long as you remain subscribed and actively engaged, and for no longer than 24 months after your last interaction with our emails, after which inactive contacts are deleted or anonymised, unless you have asked us to keep you updated for a specific ongoing purpose (e.g. TAA's longer-term work). If you unsubscribe, we will delete your data within 30 days, save for a minimal record needed to ensure we do not contact you again by mistake.

8. Your rights

Under UK GDPR, you have the right to:

  • Access the personal data we hold about you
  • Have inaccurate data corrected
  • Have your data erased ("right to be forgotten")
  • Restrict or object to how we use your data
  • Receive your data in a portable format
  • Withdraw consent at any time

To exercise any of these rights, contact us at hello@theadvocacyacademy.com. As joint controllers, TAA and BTCA will cooperate to respond to your request within one month.

If you are unhappy with how we have handled your data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

9. Donations via GoFundMe

Donations made through our GoFundMe page are processed by GoFundMe, which is an independent data controller for that data. Your donation and any related personal data (e.g. payment details) are governed by GoFundMe's own privacy policy, available at gofundme.com/privacy. We only receive the information GoFundMe chooses to share with campaign organisers (typically your name, donation amount and any public comment) and do not receive your payment details.

10. Cookies

The Site sets no cookies. Full detail is in our Cookie Policy.

11. How we protect your data

We use appropriate technical and organisational measures to protect your data against unauthorised access, loss or misuse, including restricting access to sign-up data to those who need it to run the campaign.

12. Children

The Site and mailing list are not directed at children, and we do not knowingly collect data from anyone under 13. If you believe a child has provided us with personal data, please contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top shows when it was last revised. Material changes affecting how we use your data will be communicated to existing subscribers.

14. Contact us

For any questions about this policy or how your data is used, contact: