Privacy notice

The categories of personal data processed here

NGC Legal is an editorial project that publishes information for a British adult reader. The site does not run user accounts, does not carry a login area, does not process payments and does not sell any product or service. In the ordinary course of a visit to any page on the domain, the only personal data that comes into our possession is the technical information necessary to serve the page: your device's Internet Protocol address, the user-agent string of your browser, the URL of the page you requested and the URL of the previous page if you arrived by clicking a link.

That technical information is logged by the hosting provider for a short period for the purposes of security, fraud prevention and the diagnosis of errors, and is not combined with any other data set that could identify you personally.

Where you write to the editor at the address on the About page, we receive your email address, your name if you have chosen to include it and the content of your message. We use that data solely to respond to your message and, where relevant, to log a correction to a page.

We do not add your address to any marketing list, we do not share it with any third party and we do not use it for any purpose other than the reply and, if applicable, the correction record. The lawful basis for the processing under Article 6 of the UK GDPR is the legitimate interest of NGC Legal in maintaining editorial accuracy and in responding to reader correspondence, together with the legitimate interest of the reader in receiving a substantive reply.

Cookies and analytics

NGC Legal uses the smallest set of cookies compatible with the basic functioning of the site. The site does not set any third-party advertising cookies, does not use any third-party tracking pixels and does not integrate with any social-media sharing widget that would set a cookie in your browser.

The only cookies set by the domain are strictly necessary session cookies used for basic page delivery and a preference cookie for the site's own light or dark theme where that feature is present. Under regulation 6(4) of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (as amended, PECR), the strictly necessary cookies do not require prior consent, and the site does not present a cookie banner for cookies to which consent is not required.

The site uses privacy-preserving analytics, configured to collect aggregate visit counts by page and to omit any identifier that would tie a visit to an individual reader. Internet Protocol addresses are anonymised at collection, no user-level profile is constructed and no cross-site tracking is performed.

The analytics data is used solely to understand which pages are read and which pages need improvement, and is not shared with any third party for any commercial purpose. Where the site later adopts a more feature-rich analytics service, this notice will be updated in advance of that change and a cookie banner will be introduced where the change would require consent under PECR.

The period for which data is retained

Hosting-provider server logs are retained for thirty days for the purposes described in section one above and are then routinely purged. Aggregate analytics data (visit counts by page, without any identifier) is retained for twenty-four months for editorial-planning purposes. Email correspondence with the editor is retained for six years, which reflects the ordinary limitation period for a contract claim in England and Wales under the Limitation Act 1980; where a correction has been made in response to correspondence, the correspondence is retained together with the correction record for the same period.

Nothing on this site is stored on your device beyond the strictly necessary cookies and the theme preference cookie described in section two above.

Where you exercise a right under section four below to have your data erased, we will erase your data from our operational systems within thirty days of the request, subject only to the retention that is legally required for the defence of legal claims or the exercise of a statutory function.

The retention that survives an erasure request is the minimum necessary for those purposes and is not used for any editorial or commercial purpose. Backups are held for a further ninety days on a rolling basis and are not indexed for retrieval; data in backups is over-written by successive backup cycles and is not restored except in the case of a system failure.

Your rights under UK GDPR and the Data Protection Act 2018

You have, in respect of any personal data that NGC Legal processes about you, the rights set out in Chapter III of the UK General Data Protection Regulation and in Part 3 of the Data Protection Act 2018. Those rights include the right of access under Article 15 of the UK GDPR (a subject-access request), the right to rectification under Article 16, the right to erasure under Article 17, the right to restriction of processing under Article 18, the right to data portability under Article 20 where applicable and the right to object to processing under Article 21.

Where processing is based on consent, you also have the right to withdraw that consent at any time under Article 7(3), and the withdrawal does not affect the lawfulness of processing that took place before the withdrawal.

To exercise any of these rights, please write to the editor at the address in section five below. We will respond within thirty days of receiving your request, in accordance with Article 12(3) of the UK GDPR, and we will not charge a fee for a reasonable request.

Where a request is manifestly unfounded or excessive, we may charge a reasonable administrative fee or refuse to act on the request, in which case we will explain the reason in writing. Where the response requires us to verify your identity (for example, on a subject-access request where the identity of the requester is not otherwise clear), we will ask you for evidence of identity proportionate to the sensitivity of the data concerned.

Reaching us, and referring a complaint to the ICO

The point of contact for any privacy matter under this notice is the editor at [email protected]. We will respond to your enquiry within a reasonable time, and in any event within the thirty-day period contemplated by Article 12(3) of the UK GDPR for a formal rights request.

Where your enquiry concerns an editorial matter rather than a data-protection matter, we will still respond, and the reviewer, Damian Farthing, is available to respond to legal-accuracy queries through the same route. Correspondence relating to a Commission enforcement matter should also be directed to the editor address for onward routing.

Where a concern has not been resolved through direct correspondence with us, you have the right under section 165 of the Data Protection Act 2018 to raise the concern with the Information Commissioner's Office as the supervisory authority for data protection in the United Kingdom.

The Information Commissioner's Office can be contacted through ico.org.uk, by telephone on the helpline number published on that site, or in writing to the Wycliffe House address published on that site. Making a complaint to the Information Commissioner does not affect any other legal right you may have, including the right to bring a civil claim against us under Article 82 of the UK GDPR for material or non-material damage, and does not affect the running of any limitation period for such a claim under the Limitation Act 1980.