Privacy Policy
Who I am
This site is run by me, Will Patrick. You can contact me about anything in this policy at [email protected].
I do not have a data protection officer; one is not required for a personal blog. However, you can use the same email address for any data protection queries.
What data I collect and why
| What I do | Data involved | Legal basis |
|---|---|---|
| Serve this website | IP address, user agent, page URL, referrer (from standard HTTP headers) | Legitimate interest (Art. 6(1)(f)) — running the site |
| Newsletter signup | Email address you enter into the subscribe form | Consent (Art. 6(1)(a)) — you actively submit the form |
| Respond to your emails | Your email address and message content | Legitimate interest (Art. 6(1)(f)) — replying to correspondence |
Categories of personal data
- IP address, user agent, page URL, referrer (from standard HTTP request headers)
- Email address (only if you subscribe to the newsletter or contact me directly)
Who I share data with
| Recipient | Role | Location | What they receive |
|---|---|---|---|
| Cloudflare, Inc. | Processor (hosting) | United States | HTTP request data for hosting |
| Substack, Inc. | Separate controller (newsletter delivery) | United States | Email address you submit via the subscribe form |
Newsletter
When you subscribe using the form on this site, your email address is sent directly from your browser to Substack Inc. (United States), which is a separate controller for delivering the newsletter.
I rely on your consent, given by submitting the form, as the lawful basis for this processing. Substack handles your email under its own privacy policy.
You can unsubscribe at any time using the link in any newsletter email. If you want your data fully erased, email me and I will action the request with Substack on your behalf.
International transfers
Your data may be transferred outside the United Kingdom:
- Cloudflare (United States): certified under the EU-US Data Privacy Framework with the UK Extension. Verified at dataprivacyframework.gov/list.
- Substack (United States): relies on Standard Contractual Clauses (SCCs) with the UK International Data Transfer Addendum.
How long I keep data
| Data | Retention |
|---|---|
| Server/CDN logs (Cloudflare) | 30 days |
| Newsletter subscriber email (Substack) | Per Substack’s own retention policy |
| Email correspondence | Duration of the conversation plus a reasonable period |
Your rights
Under UK GDPR you have the right to:
- Access your personal data (Art. 15)
- Rectify inaccurate data (Art. 16)
- Erase your data (Art. 17)
- Restrict processing (Art. 18)
- Data portability (Art. 20)
- Object to processing based on legitimate interest (Art. 21)
- Withdraw consent at any time without affecting earlier processing (Art. 7(3))
To exercise any of these rights, email [email protected]. I will respond within one calendar month.
Complaints
If you are unhappy with how I have handled your data, you have the right to lodge a complaint with the Information Commissioner’s Office:
- Website: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
Is providing your data required?
No. Providing your data is entirely voluntary. You are not obliged to subscribe or to contact me. The site works without either.
Automated decision-making
This site does not use automated decision-making or profiling.
Cookies and storage
This site uses minimal cookies and no browser storage. The table below lists everything:
| Name | Provider | Purpose | Duration | Type | Category |
|---|---|---|---|---|---|
__cf_bm | Cloudflare | Bot management | ~30 minutes | Cookie | Strictly necessary |
cf_clearance | Cloudflare | Security challenge clearance | ~1 day | Cookie | Strictly necessary |
Cloudflare cookies (__cf_bm, cf_clearance) are strictly necessary for security and are set automatically by Cloudflare’s CDN. They cannot be disabled.
The newsletter subscribe form does not set any cookies or browser storage. Your email address is sent directly from your browser to Substack when you submit the form.
If you visit the newsletter page directly at newsletter.willpatrick.co.uk, Substack may set its own localStorage keys (such as __kl_key and __kla_viewed, used by Klaviyo for email delivery). These are governed by Substack’s privacy policy, not this one.
Children
This site is not directed at children under 13. I do not knowingly collect personal data from children under 13. If you believe I have, please email me and I will delete it promptly.
Security
Data is protected by:
- TLS encryption on all connections (via Cloudflare)
- Processor selection based on compliance posture and signed data processing agreements
- Two-factor authentication on all service accounts
Changes to this policy
If I make material changes to this policy, I will update the effective date at the top. Where possible I will note significant changes on the site or in the newsletter.