Privacy notice
Draft: for legal review before public launch. Last updated 16 July 2026.
Our data promise, up front
Everything you give us on this site is used to run this campaign, and nothing else. We will never use your details for marketing or remarketing, and there is deliberately no way to opt in to marketing anywhere on this site. Your details are never shared with or sold to anyone. All campaign data is deleted within 30 days of the campaign ending. If you found this site through your local vape shop, nothing changes between you and them: they stay your shop, and we keep nothing.
Who we are
This campaign site is run by Riot Labs Ltd ("Riot"), a British e-liquid manufacturer. Data controller: Riot Labs Ltd, Milton Keynes. Contact: davidd@bemoreriot.com.
What we collect and why
When you use this site we collect: your name, email address, town, postcode, the constituency and MP matched to it, whether you took part as a consumer or business, the optional details you chose to add (for example time smoke-free, or your shop's name), and your consent. We use this solely to generate your letter and suggested consultation answers, to run this campaign (including updating you about it), and to compile anonymous, aggregate figures such as letters per constituency and the Relapse Register count.
What we will never do
We will not email you about Riot products, offers or news. We will not add you to any marketing list. We will not build advertising audiences from this data or use it for remarketing on any platform. We will not pass your details to any other company, including any retailer. The one thing we may send you is campaign updates, and every one of those includes a way to stop them.
Legal basis
Consent (UK GDPR Art. 6(1)(a)). You can withdraw it at any time by emailing us and we'll delete your record straight away.
What we publish
If you joined the Relapse Register, we publish your first name and town only, and only after moderation. Nothing else about you is made public.
Retention and deletion
All campaign data is deleted within 30 days of the campaign ending. The campaign ends when the Government's consultation process that this site responds to concludes (including any directly connected follow-up consultation we campaign on). The only things kept after deletion are aggregate, anonymous figures, such as how many letters were sent per constituency, which contain nothing about you personally.
Your rights
You have the usual UK GDPR rights: access, correction, deletion, restriction, portability and complaint to the ICO (ico.org.uk).
Third parties
Postcode-to-constituency lookup uses postcodes.io and the UK Parliament Members API; your postcode is sent to those services to perform the lookup. Data is hosted on our infrastructure provider (Vercel/Upstash) in line with their security terms. Your letter to your MP is sent by you, from your own email account; we send nothing to your MP on your behalf.
