Privacy notice

1. Who is responsible

The controller of personal data processed through this website is:

For anything to do with your data, write to privacy@ichslta.com, or by post to the address above marked “Data protection”.

The controller is established in Estonia, so the EU General Data Protection Regulation (EU GDPR) and Estonian data protection law apply. Because this website is written for readers in the United Kingdom, we also apply the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 to the data of UK readers. In this notice “GDPR” means both; the article numbers are the same in each.

2. When you read the site

Server logs

Our hosting provider records technical information for each request: IP address, date and time, the page requested, the response status, the referring page if your browser sends it, and browser and operating system details. This happens before any cookie choice, because it is part of delivering and securing the site.

• Purpose: delivering pages, fixing faults, and detecting and preventing abuse.
• Legal basis: legitimate interests in running a secure, working website (Article 6(1)(f) GDPR).
• Retention: kept for a short period for security and diagnostics, then deleted or overwritten in the ordinary course.

We do not combine logs with other data and do not try to identify individual readers from them.

Fonts and other resources

All typefaces, icons, images and stylesheets are served from this website itself. No request is made to Google Fonts or any other third-party server when a page loads.

Your cookie choice and other browser storage

The cookie banner stores your choice (“Accept” or “Essential only”) in your browser's local storage under the name ic-consent-v1, so you are not asked on every page. It contains only that choice. If you arrive from an advertisement, campaign parameters in the link (such as utm_campaign or click_id) are kept in your browser's session storage for the visit, so that a newsletter sign-up can be attributed to a campaign. When you sign up, your email address is kept in session storage only long enough to show it on the confirmation page. Session storage is cleared when you close the tab.

• Legal basis: strictly necessary to provide the service you asked for and to remember your choice; for campaign parameters, our legitimate interest in knowing, in aggregate, which advertising brings in subscribers.

3. Advertising measurement

This site is promoted through paid advertising, and advertising platforms commonly offer a measurement tag (a “pixel”) that records that a visitor arrived from an advertisement.

At present no advertising or analytics tag is active on ichslta.com. No data is sent to an advertising network when you read a page.

The site is built so that, if a measurement tag is configured in future, it loads only after you choose “Accept” in the cookie banner, and only on content pages (the front page, articles, section pages and the newsletter page), never on this page, the imprint, the about page, the cookie notice, the terms, the contact page or the confirmation page. If you choose “Essential only”, no tag loads. Before any tag is activated, this notice and the cookie notice will be updated to name the provider, the data it receives and the legal basis, which would be your consent (Article 6(1)(a) GDPR).

4. The Friday Sheet (our weekly email)

If you sign up for the Friday Sheet, we ask for one thing: your email address. We do not ask for your name, age, income, tax details or National Insurance number, and you should not send them.

• What we store: your email address, the date and time of sign-up and of confirmation, and, if your visit came from an advertisement, the campaign parameters in that link.
• Double opt-in: we first send an email with a confirmation link. You are added to the list only when you click it. If you do not, the address is not used and is deleted.
• Purpose: sending the weekly email you asked for and keeping a record that you consented.
• Legal basis: your consent (Article 6(1)(a) GDPR). The consent record is kept on the basis of our legitimate interest in being able to show that consent was given.
• Retention: until you unsubscribe or ask us to delete your address. After that, we may keep a minimal record of the unsubscribe so that we do not email you again.
• Unsubscribing: every email has an unsubscribe link, or write to privacy@ichslta.com.

We do not sell, rent or share your email address with other companies. No article on this site requires you to sign up.

5. When you contact us

If you email, write or telephone, we use what you send to answer you. Legal basis: legitimate interests in responding to enquiries (Article 6(1)(f) GDPR). Correspondence is kept only as long as needed to deal with the matter and any follow-up.

6. Who else processes data

We use a small number of service providers who process data only on our instructions and under written agreements: a hosting provider for the website and its logs, and an email delivery provider for the newsletter. They may not use the data for their own purposes. We disclose data otherwise only where the law requires it.

Where a provider processes data outside the UK or the European Economic Area, we rely on an adequacy decision or on standard contractual clauses (with the UK addendum where relevant).

7. What we do not do

• No automated decision-making or profiling with legal or similarly significant effects.
• No social media plug-ins, retargeting or content-recommendation tracking.
• We do not ask for, or want, financial, tax or health information about you, and we will never ask for your National Insurance number, bank details, or Government Gateway or GOV.UK One Login details.
• This site is meant for adults; we do not knowingly collect data about children.

8. Your rights

Under the GDPR you can ask us to:

• confirm what we hold about you and give you a copy (Article 15);
• correct inaccurate data (Article 16);
• delete data where there is no longer a reason to keep it (Article 17);
• restrict processing (Article 18);
• give you your data in a portable form (Article 20); and
• stop processing based on legitimate interests (Article 21).

Where we rely on consent, you can withdraw it at any time, through the unsubscribe link or the cookie notice. Withdrawal does not affect processing already carried out.

To use any of these rights, write to privacy@ichslta.com. We reply within one month. We may ask for information to confirm it is you, but never for more than is needed.

9. Complaints

You are welcome to contact us first, and we would prefer to put things right directly. You also have the right to complain to a supervisory authority.

Lead authority in the EU: the Estonian Data Protection Inspectorate
Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, Estonia
www.aki.ee

For readers in the United Kingdom: the Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
ico.org.uk

10. Changes to this notice

If we change what we process or why, including activating an advertising measurement tag, this notice is updated and the date at the top changes. Where a change needs your consent, we will ask rather than assume.