Privacy Policy

Draft for owner and legal review. This page describes, in plain English, how this site is intended to handle personal data. It is not final legal advice and has not been approved for publication. See Imprint and the review status at the foot of this page.

Who this policy is for

This policy covers visitors to andrewwilson.xyz and anyone who contacts Andrew Wilson, Conservative Councillor for Crowborough South East on Wealden District Council, through this site. Andrew acts in two distinct capacities that this site keeps separate: as an elected councillor handling resident casework, and as a Conservative Party campaigner. The legal basis for handling your data differs between the two — see "Casework versus campaign contact" below.

Andrew Wilson is the data controller for the general contact, casework, resident feedback, and evidence data this site collects — he is the person who receives it and decides how it is used. Owner/legal review needed: whether Andrew is the sole controller for campaign-related data specifically, or joint with the Conservative Party, is not yet confirmed — see "Casework versus campaign contact" below.

How forms on this site work

Current status: one or more forms on this site are connected to a real backend and will send your data to Andrew (council casework) or his campaign team (campaign sign-up), as described below. Each form still checks, at the point you would submit it, whether its specific route has been connected. If a route has not been connected, that form does not appear — you'll see a short message and an email address instead, and no data is collected for it.

What data may be collected, and why

The site is built around five response routes, each collecting only what it needs:

• Raise an issue (/casework) — purpose: council casework. Name, email, phone (optional), postcode (optional), issue type (optional), and your description of the issue. Used to log and follow up on casework within Wealden District Council's remit — for example planning, waste and environmental health, licensing, housing-related council matters, and community safety. Where an issue actually sits with another public body (for example, county-managed roads and highways, which are East Sussex County Council's responsibility, not Wealden's), Andrew may be able to signpost it, but submitting this form is not confirmation that the matter is within Wealden District Council's powers.
• Tell me what you think — purpose: resident feedback. Name and email, and your comment on a specific article. Read privately by Andrew; not published as a public comment.
• Share evidence — purpose: evidence submission. Name (optional), email, and written detail or links. No file uploads are accepted at this stage. Leaving your name out does not make a submission fully anonymous — your email address is still collected so Andrew can follow up if needed.
• Contact (/contact) — purpose: general contact. Name, email, phone (optional), and your message.
• Campaign sign-up (/campaign) — purpose: campaign contact. Name, email, postcode (optional), and how you'd like to help. This is Conservative Party campaign contact, not council casework — see below.

Every form also has a hidden anti-spam field (a "honeypot") that real visitors never see or fill in, and — once configured — a Cloudflare Turnstile check to reduce automated spam submissions. Neither is used to identify or track you personally. Each submission also records which of the five purposes above it was collected under, and the version of this policy and of the form's consent wording in force at the time — this is bookkeeping to keep future use limited to what you were told, not a way of identifying or tracking you beyond what you have already provided.

Optional "Get updates" sign-up

Raise an issue, tell me what you think, share evidence, and contact each also carry a separate, optional "Get updates" checkbox, unticked by default. This is entirely separate from the specific matter you're submitting:

• Ticking it signs you up to broader updates from Andrew — local issues, campaigns, events, ways to help, and election-period messages — in addition to your specific submission being handled as described above.
• Leaving it unticked does not affect how your casework, contact, feedback, or evidence submission is handled in any way.
• Submitting one of these four forms without ticking it does not sign you up to updates or campaign contact of any kind.

If you tick the box (or sign up directly via Get updates), your details are added to a separate updates/campaign contact record, kept apart from your casework/contact/evidence/feedback submission — see "Casework versus campaign contact" below for how that separation works and what remains unresolved (in particular, the withdrawal process).

How this data may be used later

Each purpose above has a limited, specific future use. In every case, campaign contact is never inferred from any of the other four purposes, and submitting any of the other four forms does not add you to campaign contact of any kind.

• General contact: used to respond to your specific enquiry.
• Council casework: used to manage and follow up the specific issue you raised.
• Resident feedback: considered, and followed up if Andrew chooses to — never published.
• Evidence submission: assessed and followed up on the substance of what you sent.
• Campaign contact: ongoing campaign-related contact (for example, canvassing coordination or updates) with you specifically, because you asked for it — never shared with council officers or council systems.
• Optional updates opt-in: the same ongoing contact as "Campaign contact" above — local issues, campaigns, events, ways to help, election-period messages — but arising from the separate opt-in checkbox on a casework-flow form, rather than direct sign-up. Never inferred from ticking a casework form's own required consent checkbox; only ticking the separate updates checkbox creates this record.

Casework versus campaign contact

This is a structural, not just cosmetic, separation. Raise an issue, tell me what you think, share evidence, and contact all route to Andrew's council casework records. Campaign sign-up, and the separate updates opt-in on any of those four forms, both route to a completely separate updates/campaign contact record. The two are never merged, and the site's code enforces this at the point a form is submitted, not just in how it is labelled — a casework submission where the updates box is left unticked writes only to the casework record, never to the updates/campaign one. The likely legal basis differs too: casework handling generally relies on Andrew's public task as an elected councillor, while updates/campaign contact relies on your consent. Owner/legal review needed: confirmation of whether Andrew is the sole data controller for each, or joint with the Conservative Party for campaign-related data specifically.

Because campaign sign-up (and the updates opt-in, which creates the same kind of record) is political campaigning contact, it may also engage the Privacy and Electronic Communications Regulations (PECR) alongside UK GDPR — the rules that specifically govern electronic marketing. Owner/legal review needed: the exact PECR analysis has not been finalised. What is already true today: both the campaign sign-up consent checkbox and the updates opt-in checkbox are unticked by default, state plainly that agreeing means ongoing contact — local issues, campaigns, events, ways to help, and election-period messages — and state that you can unsubscribe or object at any time. A specific, published withdrawal process (for example, a dedicated unsubscribe route) will be put in place before any ongoing updates/campaign contact programme genuinely begins — none exists yet because no such programme has started.

Email contact

Until a form is connected, or if you choose to email directly, messages go to Andrew's published contact address. Ordinary email handling terms apply — the same care described in this policy is intended to extend to messages sent this way, though email itself sits outside this site's own systems.

Who processes this data on Andrew's behalf

• Google (Sheets, Apps Script, Gmail). Form submissions are written to Google Sheets — casework and campaign data in two completely separate spreadsheets — using Google Apps Script to receive and validate each submission. A notification email for each new submission is sent via Gmail.
• Cloudflare (Turnstile). Used on connected forms to reduce spam submissions — see "Cookies and Cloudflare Turnstile" below.
• Google Analytics 4 — only if you actively accept analytics cookies. See "Analytics" below.
• Hosting provider. To be confirmed. This site is intended to run on Plesk hosting; the specific hosting provider has not yet been finalised or named in this policy. Once it is, this section will name it and describe its standard access logging.

Owner/legal review needed: whether each of the above is formally a data processor (requiring a processor agreement) or an independent third party, and whether any international data transfer (Google's and Cloudflare's infrastructure is not exclusively UK-based) has an adequate safeguard in place, has not yet been confirmed.

Keeping your data secure

Submissions are stored in Google Sheets that Andrew can access through his own Google account. Owner/legal review needed: exactly who else, if anyone, has access to those Sheets is not yet confirmed here. No additional encryption beyond what Google and Cloudflare provide as standard is layered on top by this site.

Children and sensitive information

This site is not directed at children. None of its forms have a field designed to collect special-category data (for example, health, religion, ethnicity, or political opinion as a targeted question) or voting intention. Free-text fields — particularly "Share evidence" — are not designed to collect this either, but since you write them yourself, they could incidentally include such detail if you choose to include it. If you do, it is handled with the same care as the rest of your submission, not treated any differently.

Analytics

Draft, pending owner/legal review. This site can use Google Analytics 4 to understand overall visitor numbers and which pages are read — but only if you actively agree via the banner shown on first visit. It does not run by default, no analytics cookie is set until you accept, and declining is exactly as easy as accepting. No Google Tag Manager, advertising, remarketing, or cross-site tracking is used. Full detail, including how to change your choice, is in the Cookie Policy.

Cookies and Cloudflare Turnstile

See the Cookie Policy for full detail. In short: this site's own code does not set cookies to operate normally. On forms connected to a real backend, Cloudflare Turnstile is used to reduce spam and may set a short-lived verification cookie or token as part of that check — this is a security measure, not a tracking or advertising cookie.

Search

The search on this site (Pagefind) runs entirely in your browser against a static index built when the site is published. Your search terms are not sent to Andrew, to a third party, or logged anywhere.

External links

This site links to external sources — Wealden District Council, East Sussex County Council, press coverage, and evidence documents — to support the factual claims made in council diary posts and casework updates. Those sites have their own privacy practices, which this policy does not cover.

Data sharing

Placeholder — owner/legal review needed. Whether, and under what circumstances, casework data may be shared with East Sussex County Council, Wealden District Council, or a caseworker assisting Andrew, has not yet been confirmed in writing. Campaign contact data is not shared with council officers or council systems. Public comments from the previous WordPress site are not collected, published, or otherwise used by this site.

Data retention

Decisions required, not yet made: how long casework data, campaign contact data, and evidence submissions are each kept, and who can access them, is not yet decided. Until a retention period is set and published here, no retention period should be assumed.

Your rights

Under UK data protection law you generally have the right to ask for access to, correction of, or erasure of your personal data, and to object to how it is used — including an absolute right to object to your data being used for direct marketing (such as campaign contact) at any time, for any reason, with no need to justify it. Placeholder — final wording and exercise process to be confirmed. Exactly how to exercise these rights for this site specifically — who to contact, and what response time to expect — will be confirmed here before launch.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent regulator for data protection, if you're unhappy with how your data has been handled — at ico.org.uk/make-a-complaint or by phone on 0303 123 1113.

Contact details

Placeholder — final contact details pending owner confirmation. A named point of contact for privacy queries will be added here before launch.

Review status

Version 2026-07-30. This draft has not yet been reviewed or approved for publication. Outstanding points include: the lawful basis for each type of contact, how long different types of data are kept, whether updates/campaign contact is controlled solely by Andrew or jointly with the Conservative Party, the process for withdrawing from updates/campaign contact, and the wording of the site's separate imprint notice. Do not treat any wording on this page as final.