The privacy receipt, in plain English

Line-item 1 — Who runs the till (data controller)

The data controller for this site is the editorial entity trading as KensingtonPlace. Registered office details are on file at the editorial desk and available on request via the contact form. The desk is an editorial publication, not a UKGC licensee — none of the operators we review have access to the data we collect from readers.

Line-item 2 — What we collect, and why

The categories below are exhaustive at the time of writing. Each one is printed with its purpose and the lawful basis under UK GDPR.

• Server-side technical logs. Each request to the site is logged with IP address, user-agent, requested URL, timestamp and HTTP status. Held for 30 days for security and operational reasons. Lawful basis — legitimate interest in keeping the site running safely.
• Analytics events. Only when you have accepted analytics in the cookie panel. Anonymised page-view counts and broad device class. Held for 14 months in aggregated form. Lawful basis — consent.
• Attribution events. Only when you have accepted attribution in the cookie panel. Records that a "Visit" click left the site towards a marked operator, so the operator's referral payment can be matched. Held for the operator's own attribution window plus six months. Lawful basis — consent.
• Correspondence. If you write in via the contact form, we keep the message and reply trail for as long as we are reasonably likely to need it (typically up to 24 months). Lawful basis — legitimate interest in answering the message, or consent if you tick the optional newsletter box.
• Consent records. The state of your cookie preferences is stored client-side in localStorage, and a hashed echo is logged server-side to demonstrate compliance with UK GDPR. Held for the lifetime of the consent plus 12 months.

Line-item 3 — Who else sees the till

We use a small handful of sub-processors. The list is short on purpose; it is reviewed at the start of every cycle.

• Hosting — the site sits on a UK-based shared hosting account. The host has access to the server-side logs only to the extent needed to keep the server running.
• Analytics (optional) — Google Analytics, fired only after analytics consent. The analytics provider is on UK adequacy regulations and Standard Contractual Clauses for any transfer outside the UK.
• Attribution (optional) — a single first-party attribution tag, fired only after attribution consent, that records the outbound click for the operator's own referral counting.

Line-item 4 — International transfers

The default position is no international transfer. Where one is unavoidable (analytics fall-back routing, for example), the transfer is to a country with a UK adequacy regulation in place or under Standard Contractual Clauses approved by the ICO. We do not transfer any reader data into jurisdictions without one of those protections.

Line-item 5 — Retention, in days and months

Each category has its own retention window — printed against the line-item above. The shortest is server-side logs at 30 days; the longest is attribution events at the operator's attribution window plus six months. No category is held indefinitely.

Line-item 6 — Your UK GDPR rights, in eight clear bullets

• Access — request a copy of what is held under your details.
• Rectification — correct anything we have wrong.
• Erasure — ask for the lot to be removed.
• Restriction — pause processing while a question is being resolved.
• Portability — ask for what we hold in a structured, machine-readable format.
• Withdrawal of consent — for anything we run on consent (analytics, attribution, newsletter).
• Object — to any processing run on legitimate interest.
• Complain — at any time, to the Information Commissioner's Office, the UK supervisory authority.

Send any of the above via the contact form. We reply within one calendar month under UK GDPR Article 12. No charge.

Line-item 7 — Adults-only clause

KensingtonPlace is intended for readers aged 18 and over. We do not knowingly process the personal data of any person under 18. If we ever discover that we have, we will delete it without delay. If you believe data of an underage reader has reached the desk, write in and we will act inside one working day.

Line-item 8 — How this receipt is updated

The desk reviews this notice at the start of every cycle. Material changes are printed at the top of the page with a dated stamp. Cosmetic edits (typo fixes, link corrections, small reorderings) are not flagged — only changes that affect what is collected, why, or who else sees it.

Last revised: 27 May 2026. Receipt cycle: May 2026.