Privacy Notice (UK GDPR & PECR)

Site: shepwayvox.org
Controller: The Shepway Vox Team (“we”, “us”)
Last updated: 15 January 2026

1) Who we are and how to contact us

We are the data controller for personal information collected through this website.

Email: TheShepwayVoxTeam@proton.me
Postal address: We don’t publish a residential address online. If you need a postal correspondence address (for example, to send legal documents), email us and we will provide one.

2) What this notice covers

This notice explains what personal information we collect, why we use it, who we share it with, and your rights under the UK GDPR and Data Protection Act 2018. It also explains our approach to cookies and similar technologies under PECR.

3) The personal information we collect

Information you choose to give us

• Emails to us: your email address, name (if you provide it), and the content of your message (and any attachments).

• Comments (if enabled): the comment text and the details you submit with it (for example name and email).

Information collected automatically when you use the site

• Basic technical and usage data: pages you visit, approximate time/date, browser/device information, and technical identifiers such as IP address (often needed for security and basic site operation).

• Cookies and similar technologies: depending on your cookie choices (see section 8).

4) What we use your information for, and our lawful bases

UK GDPR requires us to have a lawful basis for each use of personal information and to tell you what it is.

A) Running, protecting, and improving the website

What we do: keep the site working, prevent abuse, troubleshoot problems, monitor performance, and maintain security.
Lawful basis: Legitimate interests (running a website securely and effectively). We balance this against your rights and use only what’s necessary.

B) Responding to messages and enquiries

What we do: reply when you contact us, keep a record of the conversation, and handle complaints.
Lawful basis: Legitimate interests (communicating with readers and handling issues). In some situations it may also be necessary for a contract (for example, if you ask us to do something and we agree to provide it).

C) Publishing and moderating comments (if enabled)

What we do: display comments you submit and moderate them for spam/abuse.
Lawful basis: Legitimate interests (enabling discussion and protecting the site/community). If you don’t want your comment published, don’t submit it.

D) Analytics (only if you accept analytics cookies)

What we do: understand how visitors use the site so we can improve it (for example which pages are popular, whether the site loads properly).
Lawful basis: Consent (for non-essential analytics cookies). You can refuse or withdraw consent at any time via cookie settings.

E) Legal obligations and protecting legal rights

What we do: comply with legal obligations, respond to lawful requests, and protect or enforce our legal rights (for example, dealing with threats, harassment, or legal claims).
Lawful basis: Legal obligation (where applicable) and/or legitimate interests.

5) Editorial and journalistic purposes

As a news and commentary website, we may process personal information for journalistic purposes, such as researching stories, verifying information, contacting sources, and publishing material in the public interest.

Where personal information is processed with a view to publication for journalistic purposes, the law can provide exemptions from certain UK GDPR obligations/rights where applying them would be incompatible with journalism and freedom of expression, and where publication is in the public interest. We consider requests and complaints case-by-case and aim to be fair, proportionate, and accurate.

6) Special category data and criminal offence data

Sometimes people send sensitive information by email (for example health, political opinions, or alleged wrongdoing). We don’t ask you to provide sensitive information through the website, but if you choose to send it, we will handle it carefully and only use it where necessary for the purpose you sent it (and, where relevant, for journalistic purposes and public interest reporting).

7) Who we share personal information with

We don’t sell your personal information.

We may share information with:

• Service providers who help run the site (for example, web hosting, email hosting, security tools, and analytics providers) acting as processors under contract.

• Law enforcement, regulators, or courts where we’re legally required to disclose information, or where disclosure is necessary to protect rights, prevent harm, or pursue legal claims.

• Professional advisers (for example, legal advisers) where needed.

Google Analytics (if enabled): If you accept analytics cookies, Google may process certain usage/technical data to provide analytics services. See section 8.

8) Cookies and similar technologies (PECR)

Cookies are small files placed on your device. PECR requires that we clearly explain cookies and obtain consent for cookies that are not strictly necessary.

Cookie categories we use

• Strictly necessary cookies: needed for the website to work (for example security, basic preferences, and (if enabled) comment functionality). These don’t require consent.

• Analytics cookies (optional): help us understand site usage. We only set these if you consent.

Your choices: When you first visit, you can accept or reject optional cookies using the cookie banner/settings. You can also change your choices later using the cookie settings link (if provided) or your browser controls.

9) Email updates / marketing (if we offer them)

If we offer email updates (for example a newsletter), we will only send them:

• where you have actively opted in (consented); or

• where a PECR “soft opt-in” applies (typically only for existing customers in a commercial context, with a clear opt-out at collection and in every message).

Every marketing email will include a simple way to unsubscribe. You can also opt out at any time by emailing us.

10) International transfers

Some of our suppliers may process or store personal information outside the UK. Where this involves a “restricted transfer”, we use appropriate safeguards such as UK adequacy regulations, the UK–US Data Bridge (where relevant), or approved contractual safeguards and risk assessments where required. You can ask us for more details.

11) How long we keep your information

We keep personal information only as long as necessary for the purposes in this notice.

Typical retention periods:

• Emails and enquiries: up to 12 months after the last message, unless we need to keep them longer (for example for an ongoing issue or legal reasons).

• Comments (if enabled): while the article remains published, unless moderation/removal is required or you ask us to remove them and we can do so.

• Security logs: typically up to 90 days, unless needed to investigate abuse or security incidents.

• Analytics data (if enabled): retained according to the settings in our analytics tools (commonly up to 14 months), then deleted or aggregated.

If we keep something longer, it will usually be because we have a legal reason to do so, or because it’s needed for journalistic archiving/public interest reasons (where applicable).

12) Your rights under UK GDPR

You have rights including:

• Access (a copy of your data)

• Rectification (fix inaccurate data)

• Erasure (delete data, in some circumstances)

• Restriction

• Objection (including an absolute right to object to direct marketing)

• Data portability (in some circumstances)

To exercise your rights, email TheShepwayVoxTeam@proton.me.

Time limits: We respond without undue delay and within one month. For complex requests, we may extend by up to two further months, but we will tell you within the first month if we need more time.

Identity checks: If we’re not sure it’s you, we may ask for proportionate information to confirm your identity. We won’t ask for excessive ID where it’s not necessary.

Important note for published/journalistic material: Where information is processed for journalistic purposes, some rights may be limited in specific circumstances to protect freedom of expression and publication in the public interest. We still consider requests carefully and case-by-case.

13) How to complain

If you’re concerned about our use of your personal information, contact us first at TheShepwayVoxTeam@proton.me.

You can also complain to the UK regulator:

Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Tel: 0303 123 1113
Website: ico.org.uk

14) Security

We take reasonable technical and organisational measures to protect personal information. No online service is 100% secure, but we work to reduce risks (for example access controls, secure configurations, and limiting retention).

15) Links to other websites

Our pages may link to third-party websites. We are not responsible for their privacy practices. Please read their privacy notices.

16) Changes to this notice

We may update this notice from time to time. We’ll publish the updated version on this page and change the “Last updated” date. If changes are significant, we’ll add a more prominent notice on the website.