Privacy

1

Why this page is shorter than most

This page is shorter and vaguer than most privacy notices, and the vagueness is deliberate rather than careless. A notice that names a company, a registration number, a processor and a retention period it cannot stand behind is a worse document than one that admits the gap. So the gaps are admitted here, and part 5 lists them one by one.

What follows is therefore written at the level this page can honestly reach: the kinds of data a website of this sort handles, what each kind is for, what happens when a reader leaves for an operator, and the rights anybody has in general terms. Where a detail is genuinely needed, it sits with the ownership information published for this site, or comes on request.

2

What a visit involves

A visit to any website starts with a request to a server, and the server is told four things by the request itself. The network address the request came from, the moment it arrived, the address of the page wanted, and whatever the browser volunteers about itself. None of that is typed by a reader and all of it travels before a single word of this page has been read. It is how the web works rather than a choice any publisher makes.

Small files kept by the browser are the second kind, and they have a sheet of their own at Cookies, which sets out what each kind of file is for and how a reader turns them off.

Measurement is the third. Counts of pages opened, totted up across everybody, tell a publisher which sheets are read and which are ignored. A count is not a person, and nothing on these pages needs to know who a reader is in order to serve them a figure.

The fourth kind is whatever a reader chooses to type and send, and there is very little of it. No page on this site asks for a date of birth, an address or a name, and there is nothing here to open an account with, no balance to be held and no deposit to be taken. A message sent about a figure contains whatever the sender put in it, and the reply goes back to wherever it came from. What a message should contain, and what happens to it, is set out on Write to the sheet.

Nothing collected here is sold, and no profile of a reader is assembled from it. There would be very little to assemble one out of, which is the practical reason as well as the stated one.

3

What happens when a reader leaves for an operator

Follow a commercial link out of this site and a different organisation takes over. From the moment a reader lands on an operator’s own pages, that operator decides what is collected there and its own notice is the one that applies. Nothing on this site reaches inside an account at a cashier, and nothing a cashier holds comes back here.

That matters more at this end of the market than it would anywhere else, and the regulator has said so. On unlicensed websites the regulator names three exposures in one breath: fraud, trouble over data privacy, and practices that are not fair. Its enforcement blog is sharper still, logging data protection worries it calls serious and naming identity theft among the risks.

Set that against the licensed position and the shape of it is clear enough. A licensed operator has to verify who a customer is before play begins, so the documents proving it sit with that operator, under a condition it can be enforced against. Away from the British register there is no such duty, and no approved route for complaining about how the documents were handled either. The rest of that list is at Staying in control.

4

Rights, in general terms

The rights a reader holds in this area are general rather than particular to any one publisher, so they can be set out generally without anything being invented. Being told what is held about you. Getting a copy of it. Having an error put right. Having it deleted. Restricting what is done with it, or objecting to that use. Taking it elsewhere, where it was handed over by consent or under a contract. Withdrawing a consent already given.

A right is exercised against whoever controls the data, so the first step is the ownership information published with this site and not this page. Complaining to the statutory regulator for data protection sits on top of all of that, and it needs nobody’s permission.

5

Where this page will not be specific

Four things this page will not state, and the reason in each case is the same. No retention period: nothing here names a number of months or years, because a number printed without a process behind it is a guess dressed up as a commitment. No processor is identified and no list of them is offered. No table of lawful bases, and no account of where anything is transferred to. And no vendor names for cookies either; the cookies sheet sets out the kinds and leaves the names alone for the same reason.

Each of those is either set out alongside the site’s ownership details or supplied on request, which is a duller answer than a fabricated one and a more useful one. A reader who wants one of them should ask for it rather than read it off a page that was guessing.

This sheet carries a revision number and a checked date like every other, so a reader can see when it last moved. Where the ownership details or the processes behind them change, this page changes with them and the revision number says so. The same discipline is described on Terms of use, which also declines to name a jurisdiction it cannot source.