Privacy policy

1. The short version

• We collect as little personal data as we can.
• We don’t sell your data, and we don’t use advertising or tracking cookies.
• We don’t currently use analytics tools such as Google Analytics.
• Some links are affiliate links, such as links to Amazon. We never receive your name or details when you use them.
• Our fonts are hosted on our own server, so loading this site doesn’t send your details to Google.
• You can ask us to see, correct or delete your data at any time by emailing privacy@72hoursout.co.uk.

2. Who we are

This website, 72hoursout.co.uk, is run by 72 Hours Out (“we”, “us”, “our”). We are the controller of the personal data described in this policy, which means we decide how and why it is used.

For anything to do with your personal data, contact us at privacy@72hoursout.co.uk.

We handle personal data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

3. What we collect and why

When you visit the website

What: like almost every website, our web server automatically records technical information when you visit. This includes your IP address, browser type, device type, the pages you request, the date and time, and the website that referred you.

Why: to deliver the website to you, keep it secure, prevent abuse and fix problems.

Lawful basis: legitimate interests. We have a legitimate interest in running a secure, working website.

When you leave a comment

What: the name, email address and (optional) website you enter, your comment, your IP address and your browser’s user agent string.

Why: to publish your comment, to moderate comments before they appear, to detect spam and abuse, and so we can contact you about your comment if we need to. Your name, website and comment are shown publicly. Your email address and IP address are never published.

Profile pictures: WordPress may create a scrambled code (a “hash”) from your email address and send it to the Gravatar service, run by Automattic, to check whether you have a Gravatar profile picture to show next to your comment. Gravatar’s privacy policy is at automattic.com/privacy.

Lawful basis: legitimate interests. We have a legitimate interest in running a moderated, spam-free comment section, and you choose to take part.

If you sign up for email updates

What: your email address, your name if you give it, the date and time you signed up, and basic information about whether our emails are opened and which links are clicked.

Why: to send you the updates you asked for and to understand which content is useful.

Lawful basis: consent. You can withdraw it at any time with the unsubscribe link in every email, or by emailing us. We will only email you if you have signed up.

Our email updates are managed with Hostinger Reach, part of our web host. This website loads a small script from Hostinger Reach so that sign-up forms can work.

When you email us

What: your email address, name and anything you include in your message.

Why: to reply to you and deal with your request.

Lawful basis: legitimate interests in responding to people who contact us. If you are making a data protection request, legal obligation.

When you click an affiliate link

Some links on this site, and in our YouTube video descriptions, are affiliate links to Amazon.co.uk. When you click one, Amazon may set a cookie on its own website to record that you came from us, so we can be paid a commission if you buy something. Amazon handles this data as a separate controller under its own privacy notice at amazon.co.uk/privacy. Amazon only gives us anonymous reports, such as which products were bought and the commission earned. We never receive your name, address or payment details.

If you buy from our shop

What: your name, billing and delivery address, email address, phone number, what you ordered, and order and payment status. If you create an account, your login details and order history. Card payments are handled by our payment provider, and we never see or store your full card details.

Why: to take payment, deliver your order, send order updates, handle returns and refunds, prevent fraud, and keep the accounting records the law requires.

Lawful basis: contract, because we need the data to fulfil your order. Legal obligation, for tax and accounting records. Legitimate interests, for fraud prevention.

Embedded videos from YouTube

Pages on this site may include embedded YouTube videos. Embedded content behaves in the same way as if you had visited YouTube directly. When a page with an embedded video loads, or when you play it, YouTube (owned by Google) may collect data about you, set cookies and track your interaction with the video. This is controlled by Google, not by us. See Google’s privacy policy.

What we don’t collect

We don’t ask for or knowingly collect special category data, such as information about health, religion or ethnicity. Please don’t include it in comments or emails. We don’t use your data for automated decision-making or profiling.

4. Cookies

Cookies are small text files stored on your device. We keep them to a minimum:

• Comment cookies (optional). If you tick “Save my name, email, and website in this browser” when commenting, WordPress stores those details in cookies for one year so you don’t have to type them again. They are only set if you tick the box.
• Essential cookies. WordPress sets technical cookies that are strictly necessary for the site to work, for example to check your browser accepts cookies, and to keep site administrators logged in. These don’t need consent.
• Shop cookies. If you add something to your basket, WooCommerce sets cookies that remember your basket and session. These are strictly necessary for the shop to work and are removed when your session ends or after a short time.
• Third-party cookies. YouTube may set cookies when you view or play an embedded video, as described above. Amazon may set cookies on its own website when you follow an affiliate link.

We don’t use advertising cookies. If we ever add analytics or other non-essential cookies, we will ask for your consent first and update this policy. You can also block or delete cookies in your browser settings.

5. Who we share your data with

We never sell your personal data. We only share it with service providers who help us run the website, and only as far as they need it:

• Hostinger: web hosting, server logs, security, content delivery and email updates (Hostinger Reach). Hostinger acts as our processor and only uses your data on our instructions.
• Automattic (Gravatar): profile pictures for comments, as described above.
• Google (YouTube): if you view embedded videos, as described above.
• Amazon: if you follow an affiliate link, as described above.
• Payment providers (such as Stripe or PayPal): to process payments and prevent fraud if you buy from our shop. They act as independent controllers under their own privacy policies.
• Delivery companies (such as Royal Mail): your name, delivery address and, where needed, your contact details, so they can deliver your order.
• Authorities: we may disclose data if the law requires it, or to protect our rights or the safety of others.

6. International transfers

Some of our providers store or process data outside the UK, including in the European Economic Area and the United States. When that happens, we make sure it’s protected by a safeguard recognised under UK law, such as a UK adequacy regulation (which covers the EEA), the UK Extension to the EU-US Data Privacy Framework, or approved contract terms such as the International Data Transfer Addendum.

7. How long we keep it

• Server logs: kept by our host for a limited period for security and troubleshooting, then deleted automatically.
• Comments: kept for as long as the comment is published. Comments that are rejected or marked as spam are deleted.
• Orders: kept for six years after the end of the financial year the order was placed in, because UK tax law requires us to keep accounting records. Customer accounts are kept until you ask us to close them.
• Email updates: kept until you unsubscribe. After that, we keep only a minimal record of your email address so we don’t email you again by mistake.
• Emails you send us: kept for up to two years after our conversation ends, unless we need them longer to deal with a legal claim.

8. Your rights

Under UK data protection law you have the right to:

• Access: ask for a copy of the personal data we hold about you.
• Rectification: ask us to correct data that is wrong or incomplete.
• Erasure: ask us to delete your data, for example a comment you left.
• Restriction: ask us to limit how we use your data.
• Objection: object to us using your data on the basis of legitimate interests.
• Portability: ask for data you gave us in a commonly used, machine-readable format.
• Withdraw consent: where we rely on consent, such as email updates, withdraw it at any time. This doesn’t affect anything we did before you withdrew it.

To use any of these rights, email privacy@72hoursout.co.uk. There is normally no charge. We will reply within one month, and may ask you to confirm your identity first. Some rights have legal limits, and if we can’t do what you ask we will explain why.

9. How to complain

If you’re unhappy with how we’ve handled your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator: ico.org.uk/make-a-complaint, or call 0303 123 1113.

10. Keeping your data secure

The website is served over an encrypted (HTTPS) connection. Access to the site’s admin area is restricted and protected, and we keep the website software up to date. No website can be completely secure, but we take reasonable steps to protect your data. If a breach ever puts your rights at high risk, we will tell you and, where required, the ICO.

11. Children

This website is intended for adults and is not aimed at children. You must be 13 or over to leave a comment or sign up for email updates. If you believe a child under 13 has given us personal data, contact us and we will delete it.

12. Links to other websites

We link to other websites, such as YouTube and official government advice. We are not responsible for how those sites handle your data, so please read their privacy policies.

13. Changes to this policy

We will update this policy if the way we use personal data changes, for example if we add analytics or a new service. The date at the top shows when it was last updated. If a change significantly affects you, we will make it clear on the website or tell you by email if you’ve signed up.

14. Contact

Questions about this policy or your personal data: privacy@72hoursout.co.uk.