Privacy Policy — Winnix
Your rights
Under United Kingdom data protection law you have a set of rights over the data we hold about you. You can ask for a copy of your data, ask us to correct inaccurate records, ask us to delete records once they are no longer needed, object to processing or ask us to restrict it. To exercise any of these rights write to the data protection contact below. We will reply within one month. If you are not satisfied with the reply you can complain to the Information Commissioner at ico.org.uk. If you exercise the right to be forgotten we will still keep a minimal record of the deletion itself — the date, the e-mail address and a brief note of what was removed — so that we can demonstrate we acted on your request. That record is kept separately from the main data store and is itself deleted after six years. We do not charge for any data-rights request unless we judge it manifestly unfounded or excessive, in which case we will explain our reasoning before any fee is applied.
Changes to this policy
We update this policy when the processor list changes, when the law changes or when we add a new feature that touches reader data. The current version is always on this page with the date at the top. Material changes are flagged in the footer of the home page for a month after they take effect so that returning readers notice. The version history of this policy is kept in our internal wiki. If you want to see what has changed since a specific date, write to the data protection contact and we will share a side-by-side comparison. We do not maintain a public changelog on the page itself because the policy sees relatively few changes and a changelog would quickly outweigh the text it accompanies.
How we use data
We use access logs to detect attacks, debug errors and understand which pages are read. Aggregated analytics data feeds our editorial roadmap: a page that nobody reads is retired, a page with heavy traffic gets a deeper refresh. Reader e-mails are used strictly to answer the question you asked and are not forwarded to any third party. We do not profile individual readers and we do not build advertising audiences from site data. We never use access logs to build a profile of an individual reader and we do not have the identifiers we would need to do so even if we wanted to. Aggregated analytics are reviewed by the editorial team on a monthly basis and the raw event data is deleted after twelve months. Reader e-mails that do not require a response are kept for twelve months as well and are then destroyed. A data retention schedule for every category of data is kept with the data protection contact and is available on request.
Contact the data protection contact
Write to [email protected] with a short description of your request and a way to contact you. We do not require a formal subject-access template — plain English is fine — but we may ask one or two clarifying questions so that we send the right records. We never ask for passwords, payment details or copies of government identification. If a request concerns a specific page, including it in the subject line helps us locate the record without further back-and-forth. We are a small team so a one-line description of the issue, with a URL where relevant, is more useful than a long formal letter. If you prefer post, the registered address of the publisher is shown in the footer of every page.
International transfers
Where a processor stores data outside the United Kingdom or the European Economic Area, the transfer is covered either by an adequacy decision or by standard contractual clauses. The current list of processors, including the country where each one holds data, is available on request from our data protection contact. The United Kingdom Information Commissioner publishes a list of countries that have adequacy status: for destinations on that list no further safeguards are needed. For destinations without adequacy status we rely on the Information Commissioner's international data transfer agreement, which is the United Kingdom version of the European standard contractual clauses. We also run a short transfer risk assessment each time we onboard a new processor and keep the assessment on file.
What we collect
winnix.uk collects a minimal set of data. When you browse the site we log the standard information every web server stores: your IP address, the user agent of your browser, the referring URL, the pages you requested and the timestamp of each request. If you leave a comment, write to our editorial inbox or subscribe to a newsletter we store the e-mail address and any content you send us. We also use cookies — the strictly necessary ones to make the site work, and optional analytics cookies that you can switch off in the banner on your first visit. We do not collect payment data: there is nothing to buy on winnix.uk, and when you click through to the Winnix operator the transaction happens on their side. In addition to server-side logs we rely on a small number of cookies. The first group is strictly necessary — these keep a reader on the same language variant, remember that the cookie banner has been seen and store an anti-abuse token. The second group is optional analytics. Optional analytics are off by default and only switch on if you accept them in the banner. There is no third group: we do not run advertising, retargeting or social-network cookies because the site does not sell advertising space.
Third parties
We use a small set of processors. The site is hosted on Cloudflare Pages, which sees your IP address when you load a page. Our analytics provider stores anonymised event data for twelve months. Our newsletter runs on a transactional e-mail service that stores the subscriber list on servers in the European Economic Area. Each of these processors has its own privacy policy and acts under a written data processing agreement with us. We do not sell, rent or swap reader data with anyone. We also use a small set of embedded resources — a webfont provider for the article typography and a mathematics typesetter on the two statistical pages. Each of these loads from its own domain and sees your IP address when the font or stylesheet is fetched. None of them receive personal data from us. If you prefer to block those requests the site remains fully usable; it will simply fall back to the system font.