[NEEDS HUMAN CHECK] Draft preview, not yet checked. Unresolved notes stay highlighted on purpose. Nothing here is submitted, and no tracker is loaded.

Sill and Sprout

Privacy notice — launch draft

NOT READY FOR PUBLICATION. The operator, actual processors, contact route, transfer safeguards, retention settings and consent implementation must be completed and checked. This document does not certify UK GDPR/PECR compliance.

Who controls information

Controller/trading identity: [NEEDS HUMAN CHECK]. Contact for privacy questions and rights: [NEEDS HUMAN CHECK]. Business correspondence details where legally required: [NEEDS HUMAN CHECK]. This notice applies to sillandsprout.co.uk and the Sill and Sprout newsletter.

What we intend to collect and why

Newsletter: email address, optional preferences and a record of consent (source, timestamp, wording/version and confirmation). Marketing relies on consent; joining is optional and the public planner can be obtained without marketing consent. We will not add someone merely because they downloaded a file or contacted us.

Contact enquiries: information a person chooses to send, used to respond and manage correspondence. Proposed basis: legitimate interests in handling enquiries, subject to an appropriate assessment; pre-contract or legal-obligation bases may apply in particular cases. Please do not send sensitive information.

Technical/security logs: the hosting provider may process IP addresses, request information and errors. Confirm what is actually collected, access, retention and lawful basis before launch. No non-essential analytics or advertising tracking is enabled in the intended initial configuration.

If products or paid subscriptions launch later, update this notice for transactions, legal obligations and relevant payment processors before collecting that information.

Recipients and transfers

Proposed providers: Cloudflare for hosting/security, beehiiv for the newsletter and a selected mailbox provider. An orchestrator such as Make must not receive personal data unless necessary, documented and properly configured. These are proposed, not signed-up accounts or executed processing agreements.

[NEEDS HUMAN CHECK] Identify exact contracting entities, data roles, locations, processor agreements/subprocessors, any international transfers and appropriate UK safeguards (adequacy, IDTA/Addendum or other valid mechanism and assessments where needed). Do not assert all information stays in the UK. Sponsors do not receive subscriber addresses by default. No subscriber records go into AI research prompts.

Retention

Proposed schedule for approval: delete unconfirmed signups after 30 days; review inactive contacts after 12 months; review ordinary enquiries after 12 months; keep only necessary suppression information for as long as needed to honour opt-outs. Security/accounting records may need separate periods. [NEEDS HUMAN CHECK] Adopt justified periods, legal requirements, backup treatment and actual deletion processes; these proposals must not be advertised as implemented.

Your choices and rights

Unsubscribe using the link in every marketing email. Withdrawing consent does not affect prior lawful processing. Depending on the circumstances, people may request access, correction, erasure, restriction or portability and object to certain processing. Contact the privacy route above. Identity checks should be proportionate. Requests normally require a response within one month, subject to lawful extensions/exceptions.

You can complain to the Information Commissioner's Office: https://ico.org.uk/make-a-complaint/ . We welcome contact first but that is not a condition of exercising your rights.

Cookies and advertising

See the separate cookie notice for actual technologies. Affiliate merchants operate their own sites and privacy notices when you leave ours. We will not share newsletter addresses with sponsors without a valid basis and any necessary specific consent. Any material changes to purposes or marketing consent must be handled lawfully before use.

[NEEDS HUMAN CHECK] Add effective date only after launch audit and approval; no invented automated-decision-making claim. The intended site does not make significant solely automated decisions about readers.