Privacy Policy & Data Processing Notice

2. Identity and Contact Details of the Data Controller

For the purposes of the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the EU GDPR (Regulation (EU) 2016/679), the Data Controller responsible for your personal data is:

3. Lawful Bases for Processing Under UK GDPR

Under Article 6 of the UK GDPR, data controllers must establish at least one recognized legal basis prior to processing personal data. We rely on the following lawful bases depending on the context of your interaction:

• Consent (Article 6(1)(a)): You have provided clear, affirmative, unambiguous consent for us to process your personal data for a specific purpose (e.g., subscribing to The Operator’s Notebook monthly newsletter, or consenting to third-party advertising cookies via our Consent Management Platform).
• Contractual Necessity & Pre-Contractual Steps (Article 6(1)(b)): Processing is necessary to take preliminary steps at your request prior to entering into a commercial engagement or advisory contract (e.g., responding to your project brief or consulting enquiry submitted via our contact form).
• Legitimate Interests (Article 6(1)(f)): Processing is necessary for legitimate commercial and operational interests pursued by us or a third party, provided those interests are not overridden by your fundamental rights and freedoms. Our legitimate interests include:
  • Maintaining network and server security, mitigating DDoS attacks, and preventing automated spam abuse (Recital 49 UK GDPR).
  • Conducting aggregate, non-invasive website performance measurement and citation tracking.
  • Engaging in professional B2B communications with corporate contacts who have expressed commercial interest in our advisory work.
• Legal Obligation (Article 6(1)(c)): Processing is necessary to comply with statutory and regulatory obligations, including statutory data protection requirements under the Data Protection Act 2018 and the Data (Use and Access) Act 2025.

4. Detailed Record of Processing Activities (ROPA Matrix)

In accordance with the principle of accountability (Article 5(2) UK GDPR), the table below specifies each category of personal data processed, its source, operational purpose, lawful basis, storage location, and retention schedule:

5. Third-Party Processors and International Data Transfers

To provide high-availability hosting, threat prevention, reliable email routing, and monetization, we engage vetted third-party service providers acting as data processors. We restrict data transfers to the minimum necessary for operational fulfillment:

• Hetzner Online GmbH (Germany / European Union): Provides dedicated virtual private cloud infrastructure and database hosting in Falkenstein, Germany. Covered by the UK Government’s adequacy decision for the EEA under UK GDPR Schedule 21.
• Cloudflare, Inc. (United States / Global Anycast): Provides edge reverse proxy, DNS resolution, DDoS protection, and Cloudflare Turnstile bot verification. Cloudflare is certified under the UK Extension to the EU-US Data Privacy Framework (DPF) and complies with the UK International Data Transfer Agreement (IDTA) / Standard Contractual Clauses (SCCs).
• Microsoft Ireland Operations Limited / Microsoft Corporation (UK / EU / US): Provides enterprise email hosting and transactional inbox infrastructure (Microsoft 365 Exchange) for receiving form notifications. Governed by UK adequacy, Microsoft’s Data Protection Addendum (DPA), and the DPF.
• Google Ireland Limited / Google LLC (Ireland / United States): Provides Google AdSense display advertising, Google Site Kit, Google Analytics, and web font delivery. Google LLC is certified under the UK Extension to the EU-US Data Privacy Framework and enforces the IAB Europe Transparency and Consent Framework (TCF v2.3).

6. Cookie Policy and AdTech Disclosure (PECR & Google AdSense)

In compliance with Regulation 6 of the Privacy and Electronic Communications Regulations (PECR) and Google’s EU User Consent Policy, our website uses cookies and similar storage technologies. Cookies are categorized as follows:

A. Strictly Necessary Cookies (Exempt from Prior Consent)

These cookies are required for the technical operation, security, and integrity of the website. Under PECR Reg 6(4), they do not require consent because they are strictly necessary for service delivery:

• __cf_bm: Set by Cloudflare to distinguish between humans and automated bots. Lifespan: 30 minutes.
• cookieyes-consent: Stores your cookie preference choices to ensure non-essential cookies are blocked until consented. Lifespan: 1 year.
• wordpress_test_cookie: Used by WordPress to check if cookies are enabled in your browser. Lifespan: Session.

B. Advertisement & Monetisation Cookies (Consent Required)

We display third-party advertisements via Google AdSense (Publisher ID: ca-pub-7280527332466405). When you grant consent via our cookie banner, Google and its certified advertising technology partners deploy cookies to serve ads based on your prior visits to this or other websites:

• __gads / __gpi: Used by Google AdSense to facilitate ad delivery, frequency capping, and fraud detection. Lifespan: 13 months.
• IDE: DoubleClick advertising cookie set across Google domains to measure ad performance and user interactions. Lifespan: 13 months.

Consent Revocation: You can alter or revoke your advertising cookie consent at any time by clicking the “Cookie Settings” link in the website footer. Alternatively, you can opt out of personalized advertising by visiting Google’s Ads Settings or via aboutads.info.

7. Your Statutory Rights Under UK and EU Data Protection Law

Subject to statutory conditions and exemptions, you have comprehensive rights regarding your personal data under Chapter III of the UK GDPR and EU GDPR:

• Right of Access (Article 15): You have the right to obtain confirmation as to whether we process your personal data, and to receive a copy of that data alongside transparency disclosures.
• Right to Rectification (Article 16): You have the right to request the correction of inaccurate or incomplete personal data without undue delay.
• Right to Erasure / “Right to be Forgotten” (Article 17): You have the right to request that we delete your personal data where it is no longer necessary for its original purpose, or where you have withdrawn consent.
• Right to Restriction of Processing (Article 18): You have the right to restrict processing while the accuracy of data or lawful basis is contested.
• Right to Data Portability (Article 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format (CSV/JSON).
• Right to Object (Article 21): You have the absolute right to object at any time to processing for direct marketing purposes, and to object to processing grounded in legitimate interests.
• Automated Decision-Making & Profiling (Article 22): We do not conduct automated decision-making or profiling that produces legal or similarly significant effects.

To exercise any of these rights, contact us at [email protected]. We will respond within one calendar month of receiving a verified request, free of charge.

8. Mandatory Internal Data Protection Complaints Procedure

In accordance with the Data (Use and Access) Act 2025 (which amended UK data protection law in June 2026), all UK data controllers must maintain and document an internal procedure for handling data protection complaints. Individuals are encouraged to submit concerns to our internal process before escalating to regulatory bodies.

9. Supervisory Authority Escalation (Information Commissioner’s Office)

If you are dissatisfied with our response to an internal complaint, or if you believe our processing of your personal data infringes data protection legislation, you have the statutory right under Article 77 of the UK GDPR to lodge a complaint directly with the UK supervisory authority:

If you reside in the European Economic Area (EEA), you may alternatively lodge a complaint with your national Data Protection Authority (DPA) under the European Data Protection Board (EDPB) framework.

10. Updates to This Policy

We review and update this Privacy Policy periodically to reflect technological changes, new commercial capabilities, or updates in statutory jurisprudence. Any revisions will be published on this page with an updated “Last Modified” timestamp. For material modifications that affect your rights or processing scope, registered newsletter subscribers will receive prior notification via email.