What the desk collects, what the desk does not.

What the desk collects

Two narrow categories, named in plain text.

Category 1: standard server log

The desk collects the standard server log: the IP address the reader's request came from, the page URL requested, the response code returned, and the size of the response in bytes. The desk does not collect the reader's name, the reader's email address, the reader's phone number, or any other personal identifier beyond the IP address.

The standard server log is retained for the period the hosting provider's default log retention policy allows. The desk does not extend the retention period beyond the default. The desk does not analyse the log for reader profiling, for advertising, or for any commercial purpose.

Category 2: editorial contact

Where the reader chooses to write to the desk at [email protected], the desk receives the email address the reader used to send the contact, the timestamp of the contact, and the body of the contact itself. The desk does not store the contact beyond the standard email retention period of the desk's mail client.

What the desk does not collect

Seven categories the desk names as out of scope.

The desk does not collect the reader's name. The desk does not collect the reader's phone number. The desk does not collect the reader's postal address. The desk does not collect the reader's date of birth. The desk does not collect the reader's identity-document numbers. The desk does not collect the reader's bank account, payment card, or UPI handle. The desk does not collect the reader's location beyond the city-level resolution available from the IP address.

Where the reader chooses to disclose any of the above inside a contact to the desk, the desk treats the disclosure as voluntary and reads the disclosure in the context of the editorial contact. The desk does not store the disclosure beyond the standard email retention period; the desk does not share the disclosure with any third party.

The reader who wants the disclosure deleted from the desk's mail client before the standard retention period expires can ask the desk to delete; the desk deletes on receipt of the request. The desk reads deletion requests at the editorial contact address; the desk's response window for editorial contact is one business day during business hours.

Cookies, trackers, advertising

Four categories the desk names as not present on the site.

Data retention

Two narrow windows, named in plain text.

The standard server log is retained for the period the hosting provider's default log retention policy allows, typically 30 days. The editorial contact email is retained for the period the desk's mail client retains by default, typically 24 months. The desk does not extend either retention period beyond the default.

The reader who wants their editorial contact deleted from the desk's mail client before the default retention period expires can ask the desk to delete; the desk deletes on receipt of the request. The desk reads deletion requests at the editorial contact address; the desk's response window is one business day during business hours. The contact page walks through what helps the desk respond.

The desk does not maintain a contact database. The desk does not export the contact list, does not segment the contact list, and does not share the contact list with any third party. The contact is one-way editorial reading; the desk's commitment to the reader is the desk's editorial reading only.

Children

The desk does not target readers under 18.

The desk is an editorial reference desk for adult readers, 18 and above. The desk does not target readers under 18; the desk does not knowingly collect personal data from readers under 18. The desk's editorial contact is one-way; the desk does not require the reader to disclose age to read the desk. The reader who is under 18 should consult the adult who supervises their reading; the desk's editorial content is not designed for readers under 18.

Where the desk receives an editorial contact from a reader under 18, the desk deletes the contact on receipt of a deletion request from the reader or the reader's parent or guardian. The desk does not retain the contact beyond the standard email retention period. The desk does not use the contact for any purpose other than editorial reading.

The desk's commitment on age: the desk treats its reading audience as adult readers. The desk does not advertise to readers under 18; the desk does not run advertising trackers that target readers under 18; the desk does not place cookies that target readers under 18. The desk's reading audience is adult readers; the desk's editorial content is designed for adult readers.

Third-party processors

Three processors the desk names, and one the desk does not use.

The desk's hosting provider processes the standard server log on the desk's behalf. The desk's mail client processes the editorial contact on the desk's behalf. The Google Fonts CSS the site loads for typography is processed by Google on the desk's behalf; the desk names Google Fonts as the typography processor. The desk does not use any other third-party processor.

The desk does not use a content delivery network beyond what the desk's hosting provider already provides. The desk does not use a third-party form processor; the desk does not use a third-party analytics processor; the desk does not use a third-party customer-relationship processor. The desk's data flow is narrow: the reader's request reaches the hosting provider, the standard server log records the request, and the response returns to the reader.

The reader who wants the desk's third-party processors listed by name and country can read the desk's hosting provider's privacy policy for the hosting country, the desk's mail client's privacy policy for the mail country, and Google's privacy policy for the typography country. The desk publishes the processor list on this page; the desk does not extend the processor list with processors the desk does not use.

Reader rights

Three rights the desk names, and one the desk does not process.

Changes to this notice

The desk publishes the change in plain text.

Where the desk changes this privacy notice, the desk publishes the change in plain text at the top of the page with the change date and the change summary. The desk does not make material changes without a plain-text announcement; the desk does not make material changes without a contact opportunity for readers who want to ask about the change.

The desk's standing rule on changes: the desk publishes the change summary, names the section affected, names the date the change takes effect, and provides a contact window of at least 30 days for readers who want to ask about the change. The desk reads change-window contact within one business day during business hours.

This notice was last reviewed on 11 August 2026. The next scheduled review is in February 2027; the desk may publish an out-of-cycle change where the desk's hosting provider or mail client changes a default that affects this notice.

International readers

Where the desk names the desk's hosting country and mail client country.

The desk's hosting provider hosts the site in a country whose data-protection framework the desk's hosting provider publishes. The desk's mail client operates in a country whose data-protection framework the desk's mail client publishes. The desk does not transfer reader data across borders beyond what the standard server log and the editorial contact require.

Where the reader is reading the desk from a country outside the desk's hosting country and mail client country, the reader's standard server log request is processed in the desk's hosting country, and the reader's editorial contact is processed in the desk's mail client country. The desk does not maintain a per-country data flow; the desk's data flow is the standard flow described in this notice.

The reader who wants the desk's hosting country and mail client country named should consult the desk's hosting provider's privacy policy and the desk's mail client's privacy policy. The desk publishes the processor list on this page; the desk does not extend the processor list with processors the desk does not use.

Data security

Four measures the desk takes to protect the narrow data flow.

Measure one: the desk serves the site over HTTPS. The reader's standard server log entry is encrypted in transit between the reader's browser and the desk's hosting provider. The desk does not serve any page over plain HTTP; the desk redirects plain-HTTP requests to HTTPS at the hosting provider.

Measure two: the desk does not store reader data in a database. The standard server log is retained by the hosting provider's default log retention policy; the editorial contact is retained by the desk's mail client's default retention policy. The desk does not build a reader database; the desk does not extend the retention period beyond the default.

Measure three: the desk does not share reader data with any third party. The desk does not sell, rent, or trade reader data. The desk does not forward the editorial contact to a platform operator, a marketing partner, a regulatory body, or any other third party. The desk treats the contact as one-way editorial reading.

Measure four: the desk reads editorial contact from a single mail address. The desk does not run multiple mail addresses for the same desk; the desk does not run an inbox shared with marketing, partnerships, or any other operation. The single mail address is the desk's commitment to one-way editorial reading.

Lawful basis for processing

Where the desk names the desk's lawful basis for the two narrow categories.

The desk's lawful basis for processing the standard server log is the hosting provider's default log retention policy. The desk does not extend the retention period beyond the default; the desk does not analyse the log for reader profiling. The reader who wants the lawful basis named in detail should consult the desk's hosting provider's privacy policy.

The desk's lawful basis for processing the editorial contact is the desk's legitimate interest in editorial reading. The desk's legitimate interest is the desk's editorial code: reading rulebook clauses, regulator publications, and audit certificates. The desk does not process the editorial contact for any other purpose; the desk does not extend the processing beyond what the editorial code requires.

The reader who objects to the desk's processing of the editorial contact can ask the desk to delete the contact before the default retention period expires. The desk reads deletion requests at the editorial contact address; the desk deletes on receipt of the request. The desk's deletion window is one business day during business hours.

Where the desk changes the lawful basis (for example, where the desk's hosting provider changes the default retention period, or where the desk changes its mail client), the desk publishes the change in plain text at the top of this page. The desk's standing rule on lawful basis changes: the desk publishes the change summary, names the section affected, names the date the change takes effect, and provides a contact window of at least 30 days for readers who want to ask about the change.

Cookie policy

The cookies the desk uses, and the cookies the desk does not use.

The desk uses one functional cookie: the mobile drawer's open/close state. The cookie remembers whether the reader has opened or closed the mobile drawer during the current session. The cookie expires when the reader closes the browser tab or the browser session ends. The cookie is not used for tracking, profiling, or advertising.

The desk does not use analytics cookies. The desk does not use advertising cookies. The desk does not use third-party cookies. The desk does not use cookies that survive the browser session. The desk does not use cookies that the reader cannot disable from the browser's cookie settings.

The reader who wants to disable the mobile-drawer functional cookie can disable cookies in the browser settings; the desk's mobile drawer will continue to function without the cookie, with the open/close state resetting on each page load. The reader who wants to verify the cookie can read the cookie list in the browser's developer tools.

The desk's cookie list is published in plain text on this page. The reader who wants to read the cookie list in detail can read this section; the desk does not link to a separate cookie policy because the cookie list is short enough to publish in this section. The desk's cookie policy is the desk's commitment to narrow cookie use.