This Data Protection Policy applies to the VAT's The Problem campaign (the "Campaign"), a joint initiative of hospitality trade associations and other organisations (together, the "Campaign Partners"). This website is operated exclusively for the purposes of the Campaign by UKHospitality on behalf of the Campaign Partners. This Policy sets out how we collect, use, store, share, and protect personal data gathered in connection with the Campaign, and the rights of individuals whose data we hold.

All Campaign Partners including UKHospitality as operators of this website are committed to complying with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and all other applicable data protection legislation.

UKHospitality acts as the primary Data Controller on behalf of the Campaign Partners. Co-organising trade associations act as joint or independent Controllers in respect of data collected or processed by them.

Queries should be directed to: info@vatstheproblem.co.uk

• Full name

• Email address

• Organisation / employer name

• Information voluntarily provided in free-text fields

We do not knowingly collect sensitive (special category) personal data.

• To register and manage campaign supporters and signatories

• To send Campaign updates, news, and calls to action

• To report supporter numbers to government or media (aggregated/anonymised unless explicit consent is given for named attribution)

• To comply with legal or regulatory obligations

• Between Campaign Partners, subject to a data-sharing agreement

• With third-party service providers (email platforms, CRMs) acting as Data Processors under written contracts

• With government, regulators, or media in aggregated/anonymised form only, unless consent is given

• Where required by law

We do not sell personal data. We do not share it with commercial third parties for their own marketing. Data will only be used for the purpose of the Vat’s The Problem campaign.

• Active supporter data: retained for the Campaign duration plus up to 12 months

• Where individuals opt in to ongoing comms from a Campaign Partner, that partner's own retention policy applies

• Legal compliance data: retained as required by law

Appropriate technical and organisational measures protect data against unauthorised access or disclosure. In the event of a reportable breach, the ICO will be notified within 72 hours.

Under UK GDPR, individuals have the right to access, rectify, erase, restrict, port, or object to processing of their data, and to withdraw consent at any time.

To exercise these rights contact: info@vatstheproblem.co.uk. We will respond within one calendar month. You may also complain to the ICO at www.ico.org.uk.

Where data is transferred outside the UK or EEA, appropriate safeguards (e.g. IDTA or adequacy decisions) will be in place before transfer.

This policy may be updated. The current version will be available at vatstheproblem.co.uk. Material changes will be notified to active supporters.