Privacy notice

Who we are

Our ICO registration number is [ to be confirmed ]. You can write to us at enquiries@glossarum.co.uk, or by post at [ to be confirmed ].

We have not appointed a data protection officer. Whether one is required of us is [ to be confirmed ].

What this notice covers

It covers two things. This website, at glossarum.co.uk. And the mailbox enquiries@glossarum.co.uk, which is the only way the site invites you to contact us.

It does not cover work we do for a client. If we are engaged, the engagement letter and the data protection terms in it govern the personal data involved in that work. Those are separate documents and this notice does not vary them.

No cookies. No analytics. No tracking.

This site sets no cookies of any kind. Not for analytics, not for preferences, not for sessions, not for anything else. There is no cookie banner because there is nothing to consent to.

There is no analytics package on this site. No Google Analytics, no privacy-preserving alternative, no pixel, no beacon, no tag manager.

Each page carries its own styling inside it and loads no JavaScript that runs in your browser. The only other thing a page fetches is two typeface files, and those are served from this domain rather than from a font service, so no third party learns that you visited. Nothing on these pages is embedded from anywhere else.

Some pages here link out to the FCA, to legislation.gov.uk and to other public sources, so that you can read a rule rather than take our word for it. Following one of those links is a request you made, not one this site made for you. What happens after you arrive is that site's business, and its privacy terms, not ours.

You can check all of this. Open your browser's network panel and reload the page. Every request should be to glossarum.co.uk and there should be no cookie in the store.

Server logs

This site is hosted on Cloudflare Pages. The Cloudflare entity for customers in the United Kingdom is Cloudflare, Ltd., and its privacy terms are at cloudflare.com/privacypolicy.

Like every web host, Cloudflare writes a log entry for each request it serves. That entry normally records the IP address the request came from, the time, the file asked for, and the browser's user-agent string. It also runs the security filtering that keeps the site up.

An IP address can be personal data. We treat it as though it is. We do not read those logs to identify anyone. We do not join them to anything else, we build no profile from them, and we do not use them to market to you. They exist so that the host can run and secure the service.

Cloudflare runs a global network and serves each request from whichever of its locations is nearest to you. A log entry for your visit may therefore be written outside the United Kingdom. Clause 08 covers that.

What we collect when you email us

Whatever you put in the message. In practice that is usually your name, your email address, the firm you work for, your role, and what you have asked us about. It is also anything you attach.

We ask for none of it. There is no form on this site and no field to fill in. You decide what to send. If you would rather not name your firm at the first contact, do not name it, and we will still reply.

If you never email us, we hold nothing about you at all.

Why we are allowed to use it

Our lawful basis is legitimate interests, under Article 6(1)(f) of the UK GDPR.

The interest is straightforward. You have sent a business enquiry to an address published for that purpose, and we need to read it, think about it, and reply. We cannot do that without processing what you sent. Nobody emails an enquiries address expecting silence, so this use is exactly what you would expect, and it overrides nothing that matters to you. That is the whole of the balancing test.

We do not rely on consent, so there is no consent for you to withdraw. We do not use your address for marketing. We keep no mailing list and we send no newsletter. If that ever changes, it will be on the basis you opt in to, and this notice will say so before it happens.

Who else sees it

Our mailbox is hosted by Migadu-Mail GmbH, a company registered in Switzerland. It processes the contents of the mailbox on our instructions, as a processor, so that mail reaches us. Its own privacy terms are at migadu.com/privacy.

Cloudflare hosts the site and sees the server logs described in clause 04. It never sees your email, because email does not go through it.

Nobody else. We do not sell personal data, we do not share it with advertisers or data brokers, and we do not pass it to anyone for their own purposes. We would disclose it if the law required us to, and we would tell you unless we were prohibited from telling you.

Where it is kept

Both of the processors in clause 07 can take personal data outside the United Kingdom. Mail sent to enquiries@glossarum.co.uk is handled by a Swiss company. Server logs are written on a global network. The mechanism we rely on for those transfers is [ to be confirmed ], and it is the one thing on this page a lawyer has to settle rather than us.

Migadu's own privacy policy does not name the country its mail servers sit in, so neither do we. We will not tell you a storage location we cannot show you.

How long we keep it

Correspondence that does not lead to an engagement is kept for [ to be confirmed ] from our last reply, and is then deleted.

Correspondence that does lead to an engagement stops being covered by this notice at that point. It is kept under the engagement letter, for the period that letter sets.

Your rights

Under the UK GDPR and the Data Protection Act 2018 you have the right to:

• ask for a copy of the personal data we hold about you, and to be told what we do with it;
• have anything inaccurate corrected;
• have it erased;
• have our use of it restricted while a question about it is resolved;
• object to our using it, on grounds relating to your particular situation.

Email enquiries@glossarum.co.uk and say what you want. There is no form and no fee. We will answer within one month. If a request is genuinely complex we may extend that, and we will tell you why within the first month.

Two limits, stated rather than buried. The right to data portability does not apply here, because it applies only where we rely on your consent or on a contract with you, and we rely on neither. And your right to object is a qualified one, not an absolute one, because we are not processing for direct marketing. In practice we expect to act on an objection rather than argue with it.

We take no automated decisions about you and we do no profiling. There is no algorithm here. A person reads your email.

How to complain

Tell us first, at enquiries@glossarum.co.uk. It is the fastest route and we would rather fix a problem than have it reported.

You do not have to come to us first. You have the right to complain directly to the Information Commissioner's Office, which is the UK's supervisory authority for data protection. Its complaint route is at ico.org.uk/make-a-complaint. Complaining to us does not reduce that right, and complaining to the ICO does not stop you also raising it with us.

Changes to this notice

If we change it, we change the version number and the date at the top of this page. The date at the top is the date the current text took effect.

We will not make a change that quietly widens what we do with your data and leave you to find it. If the substance changes, the change is stated.