Privacy notice

Data collected on this site

Offshore Ledger UK is a public information site that does not require registration, does not process payments, and does not host any user-generated content. In the ordinary course of a reader visiting a page, the only personal data received by our infrastructure is the technical data that any web request produces, that is, the requesting IP address, the user-agent string of the browser, the requested URL, the referring URL where a referrer header is present, and the timestamp of the request. This technical data is processed in server logs held by our hosting provider for the purpose of running the site securely and diagnosing faults. It is not enriched with third-party data, is not sold, and is not shared with any operator or advertising network.

Where a reader contacts the editor at [email protected], the email address and the content of the message become personal data that we process for the purpose of responding to the query. The legal basis for that processing is our legitimate interest in running an accurate public information site, read alongside the reader's interest in receiving a response to the query they sent. We do not add reader email addresses to any mailing list, and we do not have a mailing list; a reader who contacts the editor should not expect any subsequent contact beyond a direct reply to the query they sent.

Cookies and analytics

The site does not set any tracking cookies and does not run third-party analytics that identify an individual reader. Strictly necessary cookies are used where they are required for the technical operation of the site, and the reader will not be asked to consent to strictly necessary cookies because the Privacy and Electronic Communications Regulations do not require consent for cookies that are strictly necessary for the service the reader has requested. Where a future feature of the site introduces a cookie that is not strictly necessary, the reader will be asked to consent through a proportionate cookie interface consistent with the Information Commissioner's Office guidance on cookies.

Server-side aggregate statistics are held for the purpose of understanding which pages are read, on which devices, from which broad geographies. The aggregate statistics do not identify individual readers, are held in a form that does not resolve to a personal identifier, and are used for editorial planning rather than for advertising. We do not carry advertising on the site and do not participate in any advertising network. If a reader's browser is configured to send a Global Privacy Control signal, the site treats the signal as an objection to any processing that would otherwise rest on legitimate interests for analytics purposes, and the aggregate statistics for that reader are not collected.

How long we retain data

Server logs are retained for a rolling window of 30 days, after which they are deleted. This retention window is calibrated to be long enough to support security investigation and fault diagnosis and short enough to minimise the personal data held on the site. Aggregate statistics that do not resolve to a personal identifier are retained for longer, on a rolling twelve-month window, for editorial planning purposes. Editor correspondence sent to the editor address is retained for the duration of the correspondence and for a reasonable period afterwards, typically not exceeding twelve months from the last message, unless the correspondence relates to a correction that has been noted on a page, in which case the correspondence is retained for the life of the page as part of the correction record.

Where a reader exercises the right to erasure and the request is granted, the retained personal data relating to that reader is deleted within a month of the request, consistent with the timelines set by the Information Commissioner's Office. Where a retention period is required to be extended for a specific legal reason, the reader is informed of the reason. There is no operational reason on this site for a longer retention period than is described here, and the site does not hold any special-category data.

Your rights under UK GDPR and Data Protection Act 2018

Under UK GDPR and the Data Protection Act 2018, a reader has the right to be informed about processing that concerns them, the right of access to personal data held about them, the right to rectification of inaccurate data, the right to erasure in the circumstances set out in the Regulation, the right to restrict processing, the right to data portability where the processing rests on consent or contract, the right to object to processing, and rights in relation to automated decision-making. The site does not carry out automated decision-making of the kind that engages Article 22 of the Regulation, and the rights that most often engage on this site are the right of access, the right of rectification, and the right to erasure.

A reader wishing to exercise any of these rights can do so by writing to the editor address below. The site will respond within one month of receiving a rights request, subject to the extensions permitted where a request is complex or where multiple requests have been received from the same reader. Where a request is refused, the site will set out the reason for the refusal in writing and will explain the reader's route to complain to the Information Commissioner's Office, which is the supervisory authority for UK data protection matters.

How to reach us and the ICO

The contact route for privacy queries and rights requests is [email protected]. The email address reaches the editor, who is the responsible person for data-protection matters on the site. The site does not hold a dedicated data protection officer role because the volume of personal data processed on the site sits well below the thresholds at which the appointment of a DPO becomes mandatory under UK GDPR. The editor role covers the equivalent function for the site.

Where a reader is unable to resolve a data-protection concern by contacting the editor, the reader has the right to complain to the Information Commissioner's Office, whose contact details are published on ico.org.uk. The ICO is the supervisory authority for the UK and handles complaints about the processing of personal data by data controllers in the UK. The right to complain to the ICO does not affect a reader's other legal remedies under UK GDPR and the Data Protection Act 2018, including the right to seek a judicial remedy through the courts where the reader considers that their rights have been infringed.