Privacy notice | nilvado

Who we are

nilvado is an independent editorial publication written and run by Deborah Aspinall in Sheffield, United Kingdom. It is not a company. There is no limited company, no registered number and no VAT registration, because there is no trading entity to register, and we are not going to invent one to look more substantial than we are. The data controller is Deborah Aspinall, contactable at [email protected].

What we collect

If you subscribe

Your email address, which is required.
Your name, if you choose to give one. It is optional.
A tag recording that you signed up from this website, so we know where a subscriber came from.
A push subscription identifier, if and only if you allow notifications in your browser.

That is the whole record. There is no phone number field on this site and we do not ask for one anywhere.

If you email us

We hold your message and your email address for as long as needed to deal with it, and afterwards where it forms part of the record behind a correction we published.

Automatically

Our hosting provider keeps standard server logs: IP address, user agent, the page requested, and a timestamp. These exist for security and to keep the site running.

Why, and on what lawful basis

Sending you the brief and push notifications: your consent, Article 6(1)(a) UK GDPR. You gave it with the tick box. You can take it back at any time and we will delete your record.
Replying to your email: legitimate interests, Article 6(1)(f), namely answering a person who wrote to us.
Server logs: legitimate interests, Article 6(1)(f), namely keeping the site secure and available.

Who else touches your data

Two organisations, both acting as processors under Article 28.

OneSignal, Inc. (United States). Handles our email list and web push. When you load any page here, its SDK loads from OneSignal's CDN, registers a service worker on this domain and stores identifiers in your browser's localStorage and IndexedDB. Its privacy policy is on its site.
Our hosting provider, which processes server logs in the ordinary course of serving the pages.

We do not sell, rent or trade your data. There is no advertising network here, no tracking pixel, no analytics package and no profiling. We do not build a picture of you, and we could not: the record is your email address and possibly your first name.

Data leaving the UK

Yes, it does. OneSignal is based in the United States, so subscribing means your name and email address are transferred there. The transfer is made under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, as required by Articles 44 and following of the UK GDPR. If you do not want your data leaving the UK, do not subscribe. Reading the site does not put you on any list.

How long we keep it

Subscription data: until you withdraw consent, at which point it is deleted. We do not run re-engagement campaigns at people who left.
Emails to the desk: up to 24 months, or longer where the exchange sits behind a published correction, in which case we keep it so the correction can be defended.
Server logs: as retained by our host in the ordinary course, typically a short rolling window.

Your rights

Under the UK GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or hand it over in a portable format. You can object to processing based on legitimate interests. You can withdraw consent at any moment, and doing so does not affect anything that happened before you withdrew it.

Write to [email protected]. We respond within one month, usually within a week, and we do not require a reason or a form.

Complaints

If you think we have handled your data badly, please tell us first, because it is likely to be a mistake and we would like to fix it. You also have the right to complain directly to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk or on 0303 123 1113. You do not have to come to us first.

Changes

If this notice changes in a way that affects you, the date at the top changes and subscribers are told in the next brief. We do not quietly rewrite this page.

What we hold, and why.