From 0c3694382eb9800193894b1f742125bb04291870 Mon Sep 17 00:00:00 2001
From: Pete Herlihy <peter.herlihy@digital.cabinet-office.gov.uk>
Date: Wed, 23 May 2018 14:33:29 +0100
Subject: [PATCH 1/8] Excluding the privacy page from the navigation stuff

---
 app/navigation.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/app/navigation.py b/app/navigation.py
index 8d15a63da..d724d2bfa 100644
--- a/app/navigation.py
+++ b/app/navigation.py
@@ -170,6 +170,7 @@ class HeaderNavigation(Navigation):
         'old_using_notify',
         'organisation_dashboard',
         'organisation_settings',
+        'privacy',
         'public_agreement',
         'public_download_agreement',
         'received_text_messages_callback',
@@ -418,6 +419,7 @@ class MainNavigation(Navigation):
         'organisations',
         'platform_admin',
         'pricing',
+        'privacy',
         'public_agreement',
         'public_download_agreement',
         'redact_template',
@@ -585,6 +587,7 @@ class OrgNavigation(Navigation):
         'organisations',
         'platform_admin',
         'pricing',
+        'privacy',
         'public_agreement',
         'public_download_agreement',
         'received_text_messages_callback',

From 53a1b05aaf76c9a225c76d468af40f3078fc55fb Mon Sep 17 00:00:00 2001
From: Pete Herlihy <peter.herlihy@digital.cabinet-office.gov.uk>
Date: Wed, 23 May 2018 14:35:26 +0100
Subject: [PATCH 2/8] Adding the privacy page to the routes

---
 app/main/views/index.py | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/app/main/views/index.py b/app/main/views/index.py
index 6e7bc1c6f..77ba91b94 100644
--- a/app/main/views/index.py
+++ b/app/main/views/index.py
@@ -37,6 +37,11 @@ def cookies():
     return render_template('views/cookies.html')
 
 
+@main.route('/privacy')
+def privacy():
+    return render_template('views/privacy.html')
+
+
 @main.route('/trial-mode')
 def trial_mode():
     return redirect(url_for('.using_notify') + '#trial-mode', 301)

From aa8992c7b90387923ef0b2d899ffff874feaa97b Mon Sep 17 00:00:00 2001
From: Pete Herlihy <peter.herlihy@digital.cabinet-office.gov.uk>
Date: Wed, 23 May 2018 14:36:36 +0100
Subject: [PATCH 3/8] Testing that the privacy page exists

---
 tests/app/main/views/test_index.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/app/main/views/test_index.py b/tests/app/main/views/test_index.py
index be6348ac3..17f5ad7c7 100644
--- a/tests/app/main/views/test_index.py
+++ b/tests/app/main/views/test_index.py
@@ -41,7 +41,7 @@ def test_logged_in_user_redirects_to_choose_account(
 
 
 @pytest.mark.parametrize('view', [
-    'cookies', 'using_notify', 'pricing', 'terms', 'integration_testing', 'roadmap',
+    'cookies', 'privacy', 'using_notify', 'pricing', 'terms', 'integration_testing', 'roadmap',
     'features', 'callbacks', 'documentation', 'security'
 ])
 def test_static_pages(

From a32399369079d0b41709591eaf07209eac8fd2b6 Mon Sep 17 00:00:00 2001
From: Pete Herlihy <peter.herlihy@digital.cabinet-office.gov.uk>
Date: Wed, 23 May 2018 14:41:19 +0100
Subject: [PATCH 4/8] Adding link to the privacy page in the footer

---
 app/templates/admin_template.html | 1 +
 1 file changed, 1 insertion(+)

diff --git a/app/templates/admin_template.html b/app/templates/admin_template.html
index d8c1c8ca7..ae715f45f 100644
--- a/app/templates/admin_template.html
+++ b/app/templates/admin_template.html
@@ -109,6 +109,7 @@
 {% block footer_support_links %}
   <nav class="footer-nav">
     Built by the <a href="https://www.gov.uk/government/organisations/government-digital-service">Government Digital Service</a>
+    <a href="{{ url_for("main.privacy") }}">Privacy</a>    
     <a href="{{ url_for("main.cookies") }}">Cookies</a>
     {% if current_service.research_mode %}
     <span id="research-mode" class="research-mode">research mode</span>

From bb025fb0ec55502641fd5f78c2993692e610ca50 Mon Sep 17 00:00:00 2001
From: Pete Herlihy <peter.herlihy@digital.cabinet-office.gov.uk>
Date: Wed, 23 May 2018 15:04:10 +0100
Subject: [PATCH 5/8] Added privacy page

---
 app/templates/views/privacy.html | 113 +++++++++++++++++++++++++++++++
 1 file changed, 113 insertions(+)
 create mode 100644 app/templates/views/privacy.html

diff --git a/app/templates/views/privacy.html b/app/templates/views/privacy.html
new file mode 100644
index 000000000..9e8fbd1f3
--- /dev/null
+++ b/app/templates/views/privacy.html
@@ -0,0 +1,113 @@
+{% extends "withoutnav_template.html" %}
+
+{% block per_page_title %}
+  Privacy
+{% endblock %}
+
+{% block maincolumn_content %}
+
+<div class="grid-row">
+  <div class="column-two-thirds">
+    <h1 class="heading-large">Privacy notice</h1>
+    
+    <p>Date last modified: 23 May 2018</p>
+
+    <h2>Who we are</h2>
+    
+    <p>GOV.UK Notify is provided by the Government Digital Service (GDS) which is part of the Cabinet Office. Our job is the digital transformation of government.</p>
+
+    <p>We are a centre of excellence in digital, technology and data, collaborating with departments to help them with their own transformation. We work with them to build platforms, standards and digital services.</p>
+
+    <p>GOV.UK Notify is a service that lets public service teams in the UK send emails, text messages, and letters to users of their service.</p>
+
+    <p>Organisations sending notifications using GOV.UK Notify are the data controller and Cabinet Office is the data processor.</p>
+
+    <p>For the credentials used to access GOV.UK Notify, Cabinet Office is both the data controller and data processor.</p>
+
+    <p>For more information see the Information Commissioner’s Office (ICO) <a href="https://ico.org.uk/esdwebpages/search">Data Protection Public Register</a>. The Cabinet Office registration number is: Z7414053</p>
+
+    <h2>What data we need</h2>
+    
+    <p>The personal data we collect from public sector employees that create a GOV.UK Notify account will include:</p>
+
+    <ul>
+        <li>Your name</li>
+        <li>Your email address</li>
+        <li>Your mobile phone number</li>
+        <li>The IP address you use to access GOV.UK Notify</li>
+    </ul>
+
+    <p>The legal basis for processing this data is public task – allowing you to access GOV.UK Notify to send notifications to users of your public service.</p>
+
+    <h2>Why we need your data</h2>
+    <p>We require your personal data to ensure only legitimate users of GOV.UK Notify can use it to send notifications.</p>
+
+    <h2>What we do with your data</h2>
+    <p>We use your data to check that you are allowed to access GOV.UK Notify and to record your activity when using it.</p>
+
+    <p>We will not:</p>
+
+    <ul>
+        <li>sell or rent your data to third parties</li>
+        <li>share your data with third parties for marketing purposes</li>
+    </ul>
+
+    <p>We will share your data if we are required to do so by law – for example, by court order, or to prevent fraud or other crime.</p>
+
+    <h2>How long we keep your data</h2>
+    <p>We will retain your personal data for as long as you have a GOV.UK Notify account.</p>
+
+    <h2>Where your data might go</h2>
+    <p>Our IT infrastructure and technology has been validated from inception to delivery with supporting contracts to ensure compliance with all data sharing activities.</p>
+
+    <p>Your personal data will not be transferred outside of the European Economic Area (EEA) throughout the course of its processing at GDS or any third party suppliers.</p>
+
+    <h2>How we protect your data and keep it secure</h2>
+    <p>We are committed to doing all that we can to keep your data secure. To prevent unauthorised access or disclosure we have put in place technical and organisational procedures to secure the data we collect about you – for example, we protect your data using varying levels of encryption. We also make sure that any third parties that we deal with have an obligation to keep all personal data they process on our behalf secure.</p>
+
+    <h2>Children’s privacy protection</h2>
+    <p>We understand the importance of protecting children’s privacy online. Our services are not designed for, or intentionally targeted at, children 13 years of age or younger. It is not our policy to intentionally collect or maintain data about anyone under the age of 13.</p>
+
+    <h2>What are your rights</h2>
+    
+    <p>You have the right to: 
+
+    <ul>
+        <li>request information about how your personal data are processed and to request a copy of that personal data</li>
+        <li>request that any inaccuracies in your personal data are rectified without delay</li>
+        <li>request that any incomplete personal data are completed, including by means of a supplementary statement</li>
+        <li>request that your personal data are erased if there is no longer a justification for them to be processed</li>
+        <li>request that the processing of your personal data is restricted in certain circumstances – for example, where accuracy is contested</li>
+        <li>request a copy of any personal data you have provided, and for this to be provided in a structured, commonly used and machine-readable format</li>
+    </ul>
+
+    <h2>Changes to this notice</h2>
+
+    <p>We may modify or amend this privacy notice at our discretion at any time. When we make changes to this notice, we will amend the last modified date at the top of this page. Any modification or amendment to this privacy notice will be applied to you and your data as of that revision date. We encourage you to periodically review this privacy notice to be informed about how we are protecting your data.</p>
+
+    <h2>How to contact us</h2>
+
+    <p>If you have any questions about anything in this document or if you consider that your personal data has been misused or mishandled you can contact the Data Protection Officer (DPO) at: DPO@cabinetoffice.gov.uk</p>
+
+    <p>Or by post at:</p>
+
+    Data Protection Officer
+    Cabinet Office
+    70 Whitehall
+    London SW1A 2AS
+
+    <p>You may also make a complaint to the Information Commissioner, who is an independent regulator. The Information Commissioner can be contacted at: casework@ico.org.uk or on 0303 123 1113.</p>
+
+    <p>Or by post at:</p>
+
+    Information Commissioner’s Office
+    Wycliffe House
+    Water Lane
+    Wilmslow
+    Cheshire SK9 5AF
+
+
+  </div>
+</div>
+
+{% endblock %}

From 91856cc1860f7b9261f88670299c6029a3e43252 Mon Sep 17 00:00:00 2001
From: Pete Herlihy <peter.herlihy@digital.cabinet-office.gov.uk>
Date: Wed, 23 May 2018 15:13:27 +0100
Subject: [PATCH 6/8] Some bonus tags and address formatting on the privacy
 page

---
 app/templates/views/privacy.html | 67 ++++++++++++++++++++++----------
 1 file changed, 47 insertions(+), 20 deletions(-)

diff --git a/app/templates/views/privacy.html b/app/templates/views/privacy.html
index 9e8fbd1f3..ea799f9da 100644
--- a/app/templates/views/privacy.html
+++ b/app/templates/views/privacy.html
@@ -14,17 +14,21 @@
 
     <h2>Who we are</h2>
     
-    <p>GOV.UK Notify is provided by the Government Digital Service (GDS) which is part of the Cabinet Office. Our job is the digital transformation of government.</p>
+    <p>GOV.UK Notify is provided by the Government Digital Service (GDS) which is part of the Cabinet Office. 
+      Our job is the digital transformation of government.</p>
 
-    <p>We are a centre of excellence in digital, technology and data, collaborating with departments to help them with their own transformation. We work with them to build platforms, standards and digital services.</p>
+    <p>We are a centre of excellence in digital, technology and data, collaborating with departments to help 
+      them with their own transformation. We work with them to build platforms, standards and digital services.</p>
 
-    <p>GOV.UK Notify is a service that lets public service teams in the UK send emails, text messages, and letters to users of their service.</p>
+    <p>GOV.UK Notify is a service that lets public service teams in the UK send emails, text messages, and letters 
+      to users of their service.</p>
 
     <p>Organisations sending notifications using GOV.UK Notify are the data controller and Cabinet Office is the data processor.</p>
 
     <p>For the credentials used to access GOV.UK Notify, Cabinet Office is both the data controller and data processor.</p>
 
-    <p>For more information see the Information Commissioner’s Office (ICO) <a href="https://ico.org.uk/esdwebpages/search">Data Protection Public Register</a>. The Cabinet Office registration number is: Z7414053</p>
+    <p>For more information see the Information Commissioner’s Office (ICO) <a href="https://ico.org.uk/esdwebpages/search">Data Protection Public Register</a>. 
+      The Cabinet Office registration number is: Z7414053</p>
 
     <h2>What data we need</h2>
     
@@ -37,12 +41,15 @@
         <li>The IP address you use to access GOV.UK Notify</li>
     </ul>
 
-    <p>The legal basis for processing this data is public task – allowing you to access GOV.UK Notify to send notifications to users of your public service.</p>
+    <p>The legal basis for processing this data is public task – allowing you to access GOV.UK Notify to send notifications 
+      to users of your public service.</p>
 
     <h2>Why we need your data</h2>
+    
     <p>We require your personal data to ensure only legitimate users of GOV.UK Notify can use it to send notifications.</p>
 
     <h2>What we do with your data</h2>
+    
     <p>We use your data to check that you are allowed to access GOV.UK Notify and to record your activity when using it.</p>
 
     <p>We will not:</p>
@@ -55,22 +62,33 @@
     <p>We will share your data if we are required to do so by law – for example, by court order, or to prevent fraud or other crime.</p>
 
     <h2>How long we keep your data</h2>
+    
     <p>We will retain your personal data for as long as you have a GOV.UK Notify account.</p>
 
     <h2>Where your data might go</h2>
-    <p>Our IT infrastructure and technology has been validated from inception to delivery with supporting contracts to ensure compliance with all data sharing activities.</p>
+    
+    <p>Our IT infrastructure and technology has been validated from inception to delivery with supporting contracts to ensure 
+      compliance with all data sharing activities.</p>
 
-    <p>Your personal data will not be transferred outside of the European Economic Area (EEA) throughout the course of its processing at GDS or any third party suppliers.</p>
+    <p>Your personal data will not be transferred outside of the European Economic Area (EEA) throughout the course of its 
+      processing at GDS or any third party suppliers.</p>
 
     <h2>How we protect your data and keep it secure</h2>
-    <p>We are committed to doing all that we can to keep your data secure. To prevent unauthorised access or disclosure we have put in place technical and organisational procedures to secure the data we collect about you – for example, we protect your data using varying levels of encryption. We also make sure that any third parties that we deal with have an obligation to keep all personal data they process on our behalf secure.</p>
+    
+    <p>We are committed to doing all that we can to keep your data secure. To prevent unauthorised access or disclosure we have 
+      put in place technical and organisational procedures to secure the data we collect about you – for example, we protect your 
+      data using varying levels of encryption. We also make sure that any third parties that we deal with have an obligation to 
+      keep all personal data they process on our behalf secure.</p>
 
     <h2>Children’s privacy protection</h2>
-    <p>We understand the importance of protecting children’s privacy online. Our services are not designed for, or intentionally targeted at, children 13 years of age or younger. It is not our policy to intentionally collect or maintain data about anyone under the age of 13.</p>
+    
+    <p>We understand the importance of protecting children’s privacy online. Our services are not designed for, or intentionally 
+      targeted at, children 13 years of age or younger. It is not our policy to intentionally collect or maintain data about anyone
+      under the age of 13.</p>
 
     <h2>What are your rights</h2>
     
-    <p>You have the right to: 
+    <p>You have the right to:</p>
 
     <ul>
         <li>request information about how your personal data are processed and to request a copy of that personal data</li>
@@ -83,28 +101,37 @@
 
     <h2>Changes to this notice</h2>
 
-    <p>We may modify or amend this privacy notice at our discretion at any time. When we make changes to this notice, we will amend the last modified date at the top of this page. Any modification or amendment to this privacy notice will be applied to you and your data as of that revision date. We encourage you to periodically review this privacy notice to be informed about how we are protecting your data.</p>
+    <p>We may modify or amend this privacy notice at our discretion at any time. When we make changes to this notice, we will 
+      amend the last modified date at the top of this page. Any modification or amendment to this privacy notice will be applied 
+      to you and your data as of that revision date. We encourage you to periodically review this privacy notice to be informed 
+      about how we are protecting your data.</p>
 
     <h2>How to contact us</h2>
 
-    <p>If you have any questions about anything in this document or if you consider that your personal data has been misused or mishandled you can contact the Data Protection Officer (DPO) at: DPO@cabinetoffice.gov.uk</p>
+    <p>If you have any questions about anything in this document or if you consider that your personal data has been misused or 
+      mishandled you can contact the Data Protection Officer (DPO) at: DPO@cabinetoffice.gov.uk</p>
 
     <p>Or by post at:</p>
 
-    Data Protection Officer
-    Cabinet Office
-    70 Whitehall
+    <p>
+    Data Protection Officer<br>
+    Cabinet Office<br>
+    70 Whitehall<br>
     London SW1A 2AS
+    </p>
 
-    <p>You may also make a complaint to the Information Commissioner, who is an independent regulator. The Information Commissioner can be contacted at: casework@ico.org.uk or on 0303 123 1113.</p>
+    <p>You may also make a complaint to the Information Commissioner, who is an independent regulator. The Information 
+      Commissioner can be contacted at: casework@ico.org.uk or on 0303 123 1113.</p>
 
     <p>Or by post at:</p>
 
-    Information Commissioner’s Office
-    Wycliffe House
-    Water Lane
-    Wilmslow
+    <p>
+    Information Commissioner’s Office<br>
+    Wycliffe House<br>
+    Water Lane<br>
+    Wilmslow<br>
     Cheshire SK9 5AF
+    </p>
 
 
   </div>

From 8d2739be623c67f30412b3a96af60707e8cd2b57 Mon Sep 17 00:00:00 2001
From: Pete Herlihy <peter.herlihy@digital.cabinet-office.gov.uk>
Date: Wed, 23 May 2018 15:27:17 +0100
Subject: [PATCH 7/8] Updating the page title on privacy page

---
 app/templates/views/privacy.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/templates/views/privacy.html b/app/templates/views/privacy.html
index ea799f9da..3b27f0c94 100644
--- a/app/templates/views/privacy.html
+++ b/app/templates/views/privacy.html
@@ -1,7 +1,7 @@
 {% extends "withoutnav_template.html" %}
 
 {% block per_page_title %}
-  Privacy
+  Privacy notice
 {% endblock %}
 
 {% block maincolumn_content %}

From 7325656456c915e4010fa89644f5b1d37527a1fa Mon Sep 17 00:00:00 2001
From: Leo Hemsted <leo.hemsted@digital.cabinet-office.gov.uk>
Date: Wed, 23 May 2018 15:37:27 +0100
Subject: [PATCH 8/8] add css classes to h2s and uls

---
 app/templates/views/privacy.html | 80 ++++++++++++++++----------------
 1 file changed, 40 insertions(+), 40 deletions(-)

diff --git a/app/templates/views/privacy.html b/app/templates/views/privacy.html
index 3b27f0c94..20ff41b26 100644
--- a/app/templates/views/privacy.html
+++ b/app/templates/views/privacy.html
@@ -9,88 +9,88 @@
 <div class="grid-row">
   <div class="column-two-thirds">
     <h1 class="heading-large">Privacy notice</h1>
-    
+
     <p>Date last modified: 23 May 2018</p>
 
-    <h2>Who we are</h2>
-    
-    <p>GOV.UK Notify is provided by the Government Digital Service (GDS) which is part of the Cabinet Office. 
+    <h2 class="heading-medium">Who we are</h2>
+
+    <p>GOV.UK Notify is provided by the Government Digital Service (GDS) which is part of the Cabinet Office.
       Our job is the digital transformation of government.</p>
 
-    <p>We are a centre of excellence in digital, technology and data, collaborating with departments to help 
+    <p>We are a centre of excellence in digital, technology and data, collaborating with departments to help
       them with their own transformation. We work with them to build platforms, standards and digital services.</p>
 
-    <p>GOV.UK Notify is a service that lets public service teams in the UK send emails, text messages, and letters 
+    <p>GOV.UK Notify is a service that lets public service teams in the UK send emails, text messages, and letters
       to users of their service.</p>
 
     <p>Organisations sending notifications using GOV.UK Notify are the data controller and Cabinet Office is the data processor.</p>
 
     <p>For the credentials used to access GOV.UK Notify, Cabinet Office is both the data controller and data processor.</p>
 
-    <p>For more information see the Information Commissioner’s Office (ICO) <a href="https://ico.org.uk/esdwebpages/search">Data Protection Public Register</a>. 
+    <p>For more information see the Information Commissioner’s Office (ICO) <a href="https://ico.org.uk/esdwebpages/search">Data Protection Public Register</a>.
       The Cabinet Office registration number is: Z7414053</p>
 
-    <h2>What data we need</h2>
-    
+    <h2 class="heading-medium">What data we need</h2>
+
     <p>The personal data we collect from public sector employees that create a GOV.UK Notify account will include:</p>
 
-    <ul>
+    <ul class="list list-bullet">
         <li>Your name</li>
         <li>Your email address</li>
         <li>Your mobile phone number</li>
         <li>The IP address you use to access GOV.UK Notify</li>
     </ul>
 
-    <p>The legal basis for processing this data is public task – allowing you to access GOV.UK Notify to send notifications 
+    <p>The legal basis for processing this data is public task – allowing you to access GOV.UK Notify to send notifications
       to users of your public service.</p>
 
-    <h2>Why we need your data</h2>
-    
+    <h2 class="heading-medium">Why we need your data</h2>
+
     <p>We require your personal data to ensure only legitimate users of GOV.UK Notify can use it to send notifications.</p>
 
-    <h2>What we do with your data</h2>
-    
+    <h2 class="heading-medium">What we do with your data</h2>
+
     <p>We use your data to check that you are allowed to access GOV.UK Notify and to record your activity when using it.</p>
 
     <p>We will not:</p>
 
-    <ul>
+    <ul class="list list-bullet">
         <li>sell or rent your data to third parties</li>
         <li>share your data with third parties for marketing purposes</li>
     </ul>
 
     <p>We will share your data if we are required to do so by law – for example, by court order, or to prevent fraud or other crime.</p>
 
-    <h2>How long we keep your data</h2>
-    
+    <h2 class="heading-medium">How long we keep your data</h2>
+
     <p>We will retain your personal data for as long as you have a GOV.UK Notify account.</p>
 
-    <h2>Where your data might go</h2>
-    
-    <p>Our IT infrastructure and technology has been validated from inception to delivery with supporting contracts to ensure 
+    <h2 class="heading-medium">Where your data might go</h2>
+
+    <p>Our IT infrastructure and technology has been validated from inception to delivery with supporting contracts to ensure
       compliance with all data sharing activities.</p>
 
-    <p>Your personal data will not be transferred outside of the European Economic Area (EEA) throughout the course of its 
+    <p>Your personal data will not be transferred outside of the European Economic Area (EEA) throughout the course of its
       processing at GDS or any third party suppliers.</p>
 
-    <h2>How we protect your data and keep it secure</h2>
-    
-    <p>We are committed to doing all that we can to keep your data secure. To prevent unauthorised access or disclosure we have 
-      put in place technical and organisational procedures to secure the data we collect about you – for example, we protect your 
-      data using varying levels of encryption. We also make sure that any third parties that we deal with have an obligation to 
+    <h2 class="heading-medium">How we protect your data and keep it secure</h2>
+
+    <p>We are committed to doing all that we can to keep your data secure. To prevent unauthorised access or disclosure we have
+      put in place technical and organisational procedures to secure the data we collect about you – for example, we protect your
+      data using varying levels of encryption. We also make sure that any third parties that we deal with have an obligation to
       keep all personal data they process on our behalf secure.</p>
 
-    <h2>Children’s privacy protection</h2>
-    
-    <p>We understand the importance of protecting children’s privacy online. Our services are not designed for, or intentionally 
+    <h2 class="heading-medium">Children’s privacy protection</h2>
+
+    <p>We understand the importance of protecting children’s privacy online. Our services are not designed for, or intentionally
       targeted at, children 13 years of age or younger. It is not our policy to intentionally collect or maintain data about anyone
       under the age of 13.</p>
 
-    <h2>What are your rights</h2>
-    
+    <h2 class="heading-medium">What are your rights</h2>
+
     <p>You have the right to:</p>
 
-    <ul>
+    <ul class="list list-bullet">
         <li>request information about how your personal data are processed and to request a copy of that personal data</li>
         <li>request that any inaccuracies in your personal data are rectified without delay</li>
         <li>request that any incomplete personal data are completed, including by means of a supplementary statement</li>
@@ -99,16 +99,16 @@
         <li>request a copy of any personal data you have provided, and for this to be provided in a structured, commonly used and machine-readable format</li>
     </ul>
 
-    <h2>Changes to this notice</h2>
+    <h2 class="heading-medium">Changes to this notice</h2>
 
-    <p>We may modify or amend this privacy notice at our discretion at any time. When we make changes to this notice, we will 
-      amend the last modified date at the top of this page. Any modification or amendment to this privacy notice will be applied 
-      to you and your data as of that revision date. We encourage you to periodically review this privacy notice to be informed 
+    <p>We may modify or amend this privacy notice at our discretion at any time. When we make changes to this notice, we will
+      amend the last modified date at the top of this page. Any modification or amendment to this privacy notice will be applied
+      to you and your data as of that revision date. We encourage you to periodically review this privacy notice to be informed
       about how we are protecting your data.</p>
 
-    <h2>How to contact us</h2>
+    <h2 class="heading-medium">How to contact us</h2>
 
-    <p>If you have any questions about anything in this document or if you consider that your personal data has been misused or 
+    <p>If you have any questions about anything in this document or if you consider that your personal data has been misused or
       mishandled you can contact the Data Protection Officer (DPO) at: DPO@cabinetoffice.gov.uk</p>
 
     <p>Or by post at:</p>
@@ -120,7 +120,7 @@
     London SW1A 2AS
     </p>
 
-    <p>You may also make a complaint to the Information Commissioner, who is an independent regulator. The Information 
+    <p>You may also make a complaint to the Information Commissioner, who is an independent regulator. The Information
       Commissioner can be contacted at: casework@ico.org.uk or on 0303 123 1113.</p>
 
     <p>Or by post at:</p>