Privacy policy

Who is responsible

The data controller for this website is Cavershall Editorial Ltd, Second Floor, Thrushgate House, 41 Penwortham Row, Kelham Island, Sheffield S3 8HW, United Kingdom. Privacy enquiries should be sent to [email protected] with "Privacy" in the subject line.

What we collect

We collect two categories of personal data. The first is information you give us directly through the contact form: your name, your email address, the subject category you select and the content of your message. The second is technical information generated automatically when a page is requested, which our hosting provider records in server logs. That typically includes the IP address making the request, the date and time, the page requested, the referring page where one is sent, and the browser and operating system identifiers contained in the request headers.

We do not ask for financial details, we do not operate user accounts, and we do not knowingly collect data from children. We do not buy personal data from third parties or combine our records with external marketing datasets.

Why we use it, and the lawful basis

Messages sent through the contact form are used to answer the enquiry and, where relevant, to make a correction to a page. The lawful basis is our legitimate interest in responding to correspondence about our own published material, together with the consent you give by ticking the box on the form.

Server logs are used for security, fault diagnosis and abuse prevention. The lawful basis is legitimate interest in keeping the website available and secure. Where any non-essential cookie is used, the lawful basis is your consent, given through the cookie banner, and that consent can be withdrawn at any time.

Cookies and similar technologies

The site stores your cookie banner choice in your browser's local storage so that the banner does not reappear on every page. Analytics and functional cookies are set only where you have agreed to them through the banner or the preferences panel. Full details of each category, and how to block or delete cookies in your browser, are set out in the cookie policy.

Processors and third parties

We use a small number of service providers acting on our instructions. These are our web hosting provider, which stores the site files and generates server logs, and our email provider, which delivers and stores correspondence. Each is bound by a contract requiring them to process personal data only as instructed and to apply appropriate security measures.

We do not sell personal data, and we do not share it with advertisers or data brokers. We may disclose information where we are legally required to do so, for example in response to a valid request from a law enforcement body or a court.

International transfers

Where a processor stores data outside the United Kingdom, we rely on the safeguards permitted by UK data protection law, such as an adequacy decision covering the destination country or standard contractual clauses with additional measures where needed.

How long we keep things

Contact form correspondence is kept for up to twenty-four months from the last message in the exchange, after which it is deleted, unless it forms part of a published correction record, which we keep for as long as the page in question remains online. Server logs are retained for a short operational period, generally measured in weeks rather than months, and are then deleted or aggregated so that individuals cannot be identified.

Your rights

Under the UK General Data Protection Regulation and the Data Protection Act 2018, you have the right to be informed about how your data is used, to request a copy of it, to have inaccurate data corrected, to request erasure, to restrict or object to processing, and to data portability where the processing is based on consent or contract and carried out by automated means. Where processing relies on consent, you may withdraw that consent at any time without affecting processing already carried out.

Visitors in the European Economic Area have equivalent rights under the EU General Data Protection Regulation. Residents of California have rights under the California Consumer Privacy Act as amended, including the right to know what personal information is collected, the right to request deletion, the right to correct inaccurate information and the right to opt out of any sale or sharing of personal information. We do not sell or share personal information as those terms are defined in that legislation.

To exercise any right, email us using the address above. We will respond within one month and may ask for enough information to confirm your identity before acting.

Complaints

If you are unhappy with how we have handled your personal data, please contact us first so that we can try to resolve it. You also have the right to complain to the Information Commissioner's Office, the United Kingdom's supervisory authority for data protection, which publishes guidance and a complaints procedure on its website. Visitors in the EEA may complain to the supervisory authority in their country of residence.

Security and changes

The site is served over an encrypted connection, access to the mailbox and hosting account is restricted and protected by multi-factor authentication, and the number of people able to read contact form messages is kept deliberately small. No website can promise perfect security, but we keep the amount of personal data we hold as small as the task allows.

We may update this policy when our practices or the law change. The current version always appears on this page.