Privacy policy

1. Who is responsible

Thornbury Ledger Media Ltd, Second Floor, Larkmead House, 18 Pentridge Street, Camberwell, London SE5 9LT, United Kingdom, operates this website and is the controller of personal data collected through it. Privacy questions and rights requests should be sent to [email protected] with the subject line "Privacy".

2. What we collect

We collect three categories of data. First, information you provide directly: if you use the contact form or email us, we receive your name, email address, chosen subject and message content. Second, technical data generated automatically when a page is requested: IP address, browser and operating system identifiers, referring page, requested URL and timestamp, recorded in server logs. Third, cookie and local storage data, which includes the cookie preference you set through the banner.

We do not ask for health data, financial data, government identifiers or any special category data, and we ask that you do not include such information in messages sent to us.

3. Why we use it, and our lawful bases

Messages are used to answer enquiries and to handle corrections, on the basis of legitimate interests in responding to correspondence, or to take steps at your request before entering into a contract where relevant. Server logs are used to operate the site, diagnose faults and protect against abuse, on the basis of legitimate interests in security and reliability. Non-essential cookies are used only where you consent through the banner, and consent may be withdrawn at any time by clearing site data in your browser and choosing again.

4. Cookies

Essential cookies and local storage entries keep the site working and record your cookie choice. Analytics and functional cookies are optional and are set only after consent. The categories, purposes and retention periods are set out in our cookie policy, together with browser-level opt-out instructions.

5. Processors and recipients

We use third-party service providers acting on our instructions: a web hosting and content delivery provider, an email service provider for correspondence, and, where enabled with consent, a website measurement provider. These providers process data only to deliver their service to us and are bound by written terms. We do not sell personal data, we do not share it with data brokers, and we do not use it for automated decision-making or profiling that produces legal or similarly significant effects.

Data may be disclosed where we are legally required to do so, or where necessary to establish, exercise or defend legal claims.

6. International transfers

Our providers may process data outside the United Kingdom and the European Economic Area. Where that happens, transfers are made under an adequacy decision or under standard contractual clauses with supplementary measures where required.

7. Retention

Correspondence is kept for up to twenty-four months after the matter is closed, unless a longer period is needed for a legal claim. Server logs are kept for a short operational period, ordinarily not more than twelve months. Cookie preferences persist in your browser until they expire or you clear them. When a retention period ends, data is deleted or irreversibly anonymised.

8. Your rights

If you are in the United Kingdom or the European Economic Area, the UK GDPR or EU GDPR gives you rights of access, rectification, erasure, restriction, portability and objection, including objection to processing based on legitimate interests, plus the right to withdraw consent. You may complain to your supervisory authority; in the United Kingdom this is the Information Commissioner's Office.

If you are a California resident, the CCPA as amended gives you rights to know what personal information is collected and disclosed, to request deletion or correction, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined in that law. Residents of other jurisdictions may have comparable rights under local law, and we apply the same handling process to all requests.

9. Security and children

The site is served over HTTPS, access to correspondence is limited to people who need it, and we review provider security terms. No transmission over the internet is completely secure, and we cannot guarantee absolute security. The site is intended for a general adult audience and is not directed at children; we do not knowingly collect data from children.

10. Changes

If this policy changes materially we will update this page and note the change here. Please check it before sending us personal data if it has been some time since your last visit.