People vs Big Tech is an open movement of civil society organisations and concerned citizens working together to challenge the power and abuses of Big Tech.

This Privacy Policy (“Policy”) addresses the data processing we undertake in connection with the People vs Big Tech website (the “Website”) and The People newsletter, including relevant petitions and campaign actions (the “Newsletter”) and in certain other limited and declared circumstances (e.g. collaborations with partners).

This Policy does not address other personal data processing operations which may arise during limited and declared circumstances. Additional policies and procedures addressing these processes are or will be put in place and we will provide relevant information to data subjects at the point of data collection, or subsequently, as required by law.

This Policy is subject to regular review. Subsequent updates and amendments will be documented below and communicated to data subjects where necessary.

Controllers

In relation to the Website, the joint controller is People vs Big Tech. 

In relation to the Newsletter, The Citizens is the controller. For more information on how The Citizens processes your personal data, see their Privacy Policy.

The Citizens is a member organisation of People vs Big Tech, with whom People vs Big Tech collaborates to create and distribute the Newsletter. The Citizens conduct research, create content and make day to day decisions in order to run the Newsletter and related social media content. The Citizens manage the Newsletter mailing list and reviews audience engagement data to inform and support communication strategy decision making. Both organisations contribute to decision making about the purposes and means of data processing in relation to the Newsletter.

Contact

Any questions regarding this Policy or other data protection issues related to People vs. Big Tech should be submitted to:
[email protected] 

Guiding principles

People vs Big Tech is committed to challenging the power and abuses of Big Tech together with you. We are guided by the principles outlined in the People’s Declaration and held accountable by a network of groups around the world striving to increase public and political support for Big Tech accountability.

All internet usage generates additional “metadata” that may be collected and retained by internet service providers. This data may be accessed by law enforcement and intelligence agencies, who may extrapolate upon it to build up detailed “pictures” of specific individuals and communities. Individuals concerned about this kind of surveillance are encouraged to take measures to protect their privacy, for example by using the Tor browser or a VPN.

What we process, why and the legal basis 

Subscription to the Newsletter

If you choose to sign up to receive the Newsletter, we will collect the personal data you provide – your name, country, and email address – in order to send you the Newsletter via email. The legal basis for this processing is your consent, which you may withdraw at any time by unsubscribing to the Newsletter or contacting us at [email protected].

Website data

The personal data that we collect from Website visitors is limited to the browser software and operating system that the computer uses, and only in specific situations where we detect suspicious activity; Website visitors’ IP address; general location information; and the Internet address (URL) of the outside website from which the visitor came. The legal basis for this processing is contractual necessity because we need to process certain personal data in order to provide you with the service you have requested (i.e., the Website). Where we do not need to collect certain personal data to provide you with the service you have requested, the legal basis for this processing is legitimate interests because we have a legitimate interest in providing you with a stable, reliable and good quality service.

If you choose to fill out the contact form, we will collect the personal data you provide – your name, organisation, country, and email address – in order to direct your request to our website managers so we can respond to your inquiry. The legal basis for this processing is your consent, which you gave once sending this information to us. You may withdraw this consent at any time, by emailing [email protected].

If you choose to sign the People’s Declaration, we will collect the information you provide – your name, country, and email address – in order possibly in the future to count your signature on our website. The legal basis for this processing is your consent, which you may withdraw at any time by emailing [email protected].

Compliance with law

We may use your personal information to comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas, investigations or requests from government authorities, and to protect our, your or others’ rights, privacy, safety or property (including by making and defending legal claims).

Data retention

Subscription to the Newsletter

If you subscribe to the Newsletter, we retain your name and email address in our data archive. If you would like your personal data to be permanently removed from this archive, please email [email protected].

Contact form

If you send us an email via the contact form, our team will receive your name, email address and message. It will be kept securely in our systems for a limited time. If you would like your personal data to be permanently removed from this archive, please email [email protected].

Sign up to the People’s Declaration

If you sign the People’s Declaration, our team will receive your name, email address. It will be kept securely in our systems. If you would like your personal data to be permanently removed from this archive, please email [email protected].

Sensitive data

We do not collect or process any sensitive data, or “special category data” as defined in UK and EU data protection laws.

Tracking and cookies

Our Website uses cookies and other technical measures to monitor and protect against malicious traffic. We do not use cookies to collect analytical data about users, but do monitor page views, and country, device type and source of traffic in order to understand how people find and engage with the Website. We do not use any tracking or non-essential cookies.

We have limited the cookies deployed to the following:

• Strictly necessary Cloudflare cookies to protect the Website against DDoS attacks
• Strictly necessary application cookies to protect the Website against attempts to inject malicious code into registration forms

Information security

We take appropriate technical and organisational measures designed to ensure that personal data is processed securely and treated in accordance with this Policy. The technical and organisational measures to prevent unauthorised access to personal data include limiting staff and processor access to personal data in accordance with specific job responsibilities or contractual obligations, the encryption of data where possible, the institution of security protocols and staff training.

Although we do our best to protect personal data, information transmitted over the internet remains vulnerable to interception – for this reason, the transmission of any personal data to our Website or via email to us is therefore at the data subjects’ own risk.

Data sharing and processors

Processors

We engage third-party service providers to perform certain data processing tasks that enable us to run the Website and mailing list, these include:

• Cloudflare
• Imagify
• Wordfence
• Vimeo
• Ghost

These third parties are engaged on terms that ensure the confidentiality of data and compliance with applicable data protection laws.

Data sharing

Other than our processors referenced above or as otherwise required or permitted by applicable law, no personal data will be shared with any parties outside of People vs Big Tech and The Citizens.

International transfers of data

Where we transfer your data outside of the European Union or the European Economic Area, we will ensure that your data is appropriately protected by requiring the recipient to respect and uphold your rights as a data subject under all applicable laws and by making the transfer subject to an international transfer safeguard, for example, the Standard Contractual Clauses issued by the European Commission.

External websites

The Website includes links to external websites, or other external resources and social media platforms that may process your data or use cookies. You can find out more about these services and the way they process data through their respective websites and privacy policies. Please note we cannot control the way those external websites collect and retain your personal data, so you use those external services at your own risk.

Your rights

Individuals whose personal data is processed in accordance with this Policy may have the following data privacy rights available:

• The right to be informed as to whether we hold personal data about them;
• The right of access to that personal data;
• The right to have inaccurate personal data corrected;
• The right to have their personal data deleted;
• The right to opt-out of particular data processing operations;
• The right to receive their personal data in a form that makes it “portable”;
• The right to object to data processing;
• The right to receive an explanation about any automated decision making and/or profiling, and to challenge those decisions where appropriate.

To make a data privacy request or complaint related to the processing of your personal data under this Policy, contact [email protected].

You also have the right to bring concerns to your national data protection regulator if you feel that your personal data has been unlawfully processed. In the European Economic Area, data subjects may also be entitled to lodge complaints in regard to data processing or the handling of subject access requests with data protection supervisory authority in their country of residence. Relevant supervisory authority names and contact details are listed here. In the UK, the data protection regulator is the Information Commissioner’s Office: https://ico.org.uk/make-a-complaint/

Changes and revisions

If we make changes to this Policy, the date and nature of the change will be listed below. Should a change to the Policy result in a material impact on the handling of any personal data, we will contact the impacted data subjects to inform them directly. 

LAST UPDATED: [3 May 2025]