Privacy policy

This policy explains what personal data Stop Urban Sprawl (stopurbansprawl.uk) collects, why we collect it, who else sees it, and what you can ask us to do about it. It applies to this website, to signing our petition, and to answers on the Stop Urban Sprawl survey.

Last updated: 5 November 2026.

Who is responsible

Stop Urban Sprawl is a campaign about housing and infrastructure in the East of England. We are the data controller for the personal data described here. For anything to do with your data — questions, copies, corrections, deletion — email corrections@stopurbansprawl.uk. A postal address for data protection correspondence is available on request.

What we collect

When you sign the petition:

• Your name
• Your email address
• Your postcode, if you choose to give it
• Whether you agreed to be emailed, and when
• Whether you asked for your name to be shown publicly
• The page you signed from, and the district it relates to
• Which campaign link or ad brought you here, from tags on the URL (for example utm_content). We do not keep Meta's click ID (fbclid) in our records

When you answer the survey:

• Your name and email address
• Your answers, including free-text reasons
• The district the page was showing, and a channel tag if the link had one
• Whether you chose to show your name or stay anonymous
• Whether you asked us to email you about the campaign. We store your postcode only if you did

If you use the postcode lookup on the home page, your postcode is sent to postcodes.io to find your local district. We don't keep that lookup. We never ask for payment details or identity documents, and we don't make any automated decisions about you.

What we do with it

• Record your signature and count signatures by area
• Email you about development in your area and the campaign's work, including a link to the survey after you sign, from hello@stopurbansprawl.uk — you can unsubscribe from any email
• Publish your name and district on the petition page, if you ticked that box
• Publish survey answers — with your name, or as anonymous — and may quote them in planning submissions and the press. Campaign emails from the survey are a separate opt-in; we are not sending those emails yet
• Measure whether our advertising works, including sending Meta a conversion event when you sign

We do not sell your details, and we do not share the email list with other organisations for their marketing.

What we publish

Once twenty people have signed, the petition page shows a public list of signatories. You appear on it only if you ticked "Show my name and area" — otherwise you are listed as "anonymous". The list shows a name and a district or county. It never shows your email address or your postcode. We still count a signature if the name looks fake, abusive, or impersonates someone, but we do not put that row on the public list. Ask us and we will remove or anonymise your entry.

Survey answers are shown on the survey page once enough approved responses have come in. You choose a name or anonymous when you submit. We check answers before they are counted or shown; spam, abuse and other people's personal data are held out. Disagreement with the campaign is not a reason to hold an answer. Ask us and we will remove or anonymise your entry.

Cookies

We ask before setting any advertising cookie. If you choose "Reject", the Meta pixel is never loaded and no Meta cookie is set. The sus-signed and sus-surveyed cookies are not advertising cookies: they are set when you sign or answer the survey, so this browser can remember that without storing your email. You can change your mind at any time: Cookie settings.

Analytics and advertising

We use PostHog, hosted in the EU, to see how people use the site and the petition form, including which link or ad brought them here. Its events never include your name, email or postcode. When you type an email into the petition form we check it against our own petition and survey lists, on our server, so we can tell you if you have already signed. PostHog is told only that a returning signer was recognised, and whether they had answered the survey, not the address itself. Until you choose in the cookie banner, and if you reject, it stores nothing on your device and counts visits using a one-way scrambled value that PostHog works out on its servers, without keeping your IP address. If you accept, it sets the cookie above. We also run our own analytics, Glass, on our Cloudflare account (no third party sees it). It works the same way: nothing is stored on your device until you accept, and visits are counted with a scrambled value that changes daily. If you accept, it keeps a random id in your browser's local storage. Unless you reject, it also records visits (what was clicked and shown, with everything you type hidden) so we can find and fix problems; before you choose, that recording stores nothing on your device either. On some pages we test two versions of the page to see which leads to more signatures. Which version you see is picked from a one-way scrambled value of your IP address, browser and the date; we do not store that value or send it anywhere.

When you sign the petition, we send Meta a conversion event (their Conversions API) so we can tell which ads led to signatures. That includes a one-way scrambled (hashed) version of your email address, your IP address, your browser's user agent, and, if you arrived from a Meta ad, the click ID from the URL. Meta uses that data for its own purposes as well as ours, under its own terms. The Meta pixel and its cookies (_fbp, _fbc) are separate: they load only if you accept advertising cookies. If you reject, those cookies are not set; the conversion event on signup is still sent.

Our lawful bases

• Consent — emailing you, publishing your name and area, and analytics and advertising cookies. You can withdraw any of these at any time.
• Legitimate interests — keeping an accurate record of who signed so the petition means something, keeping the list secure, cookieless page analytics (PostHog and Glass, before you choose or if you reject cookies), recording visits with Glass before you choose so we can fix problems, and sending Meta a conversion event when you sign so we can see which ads work. You can object to these.

Who else sees it

We keep the number of hands on your data small:

• Google — signatures are stored in a private Google Sheet, reached only by a restricted service account
• Cloudflare: hosts the site, and caches signature counts and the public name list so pages load quickly
• PostHog: product analytics, on its EU servers, as described above
• Meta — a conversion event when you sign, as described above. Pixel cookies only if you accept
• postcodes.io — receives a postcode you type into the lookup tool, to return a district
• OpenStreetMap— serves the map tiles on the home page, so your browser's IP address reaches its servers

Some of these companies process data outside the UK, including in the United States. Where they do, the transfer relies on UK adequacy regulations or on standard contractual clauses with the UK addendum.

How long we keep it

• Petition signatures and survey answers: while the campaign is running and for two years after our last contact with you, so we can show the record is real
• If you unsubscribe or ask for deletion: we remove your details and keep only the minimum needed to make sure we don't email you again
• Cached counts and name lists: rebuilt from the main list and expire within a day
• Data held by Meta, Cloudflare and PostHog: kept under their own retention periods

Your rights

You can ask us to:

• Tell you what personal data we hold about you, and give you a copy
• Correct anything inaccurate
• Delete your details, or stop emailing you
• Remove or anonymise your name on the public petition list
• Restrict what we do with your data, or object to it
• Send your data to you or someone else in a portable format
• Withdraw consent at any time — that doesn't undo what we did while it was in force, and it costs you nothing

Email corrections@stopurbansprawl.uk and say what you need. We answer within one month. If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office.

Children

This site is aimed at adults taking part in a public campaign. We do not knowingly collect personal data from children.

Changes

We update this page when the campaign or our tools change. The "Last updated" date at the top changes with it.

Who we are · Petition