This Privacy Policy explains how COFAX collects and uses personal information. COFAX, the trading name identified on the Ownership & Funding page, acts as controller for the processing described here. If a separate legal operating entity is appointed, this notice will be updated.
Information we collect
- Contact and correspondence: name, email address, subject, message and any information you choose to provide through the contact form.
- Technical records: IP address, browser and device information, requested URL, timestamps and security logs generated by the hosting platform.
- Account information: details required for authorised contributors and administrators.
- Consent choices: any preference recorded by a future cookie-consent tool.
Why we use it and our lawful bases
- To answer enquiries, assess corrections and manage editorial correspondence — our legitimate interests in operating an accountable publication.
- To protect the website, investigate abuse and maintain service reliability — our legitimate interests in security and fraud prevention.
- To administer contributor relationships or requested services — contract or steps requested before a contract, where applicable.
- To meet legal, regulatory and record-keeping duties — legal obligation.
- To use non-essential cookies or send optional marketing — consent, where required.
We do not make decisions producing legal or similarly significant effects based solely on automated processing.
Sharing and international processing
Information may be processed by service providers supporting hosting, security, email delivery, backups and site administration. We share only what is necessary and expect appropriate confidentiality and security. If information is transferred outside the UK, we use an applicable adequacy arrangement or other lawful safeguard.
Retention
General correspondence is normally retained for up to 24 months. Editorial complaints, legal notices and records needed to defend or establish legal rights may be retained for up to six years. Routine security logs are normally retained for up to 90 days unless an incident requires longer investigation. Account records are kept while the account is active and for a reasonable period afterwards. We review and delete or anonymise information when it is no longer needed.
Your rights
Depending on the circumstances, you may have rights of access, correction, erasure, restriction, objection and data portability, and the right to withdraw consent. Some rights are limited by exemptions, including protections for journalism and freedom of expression.
You have the right to object to processing based on legitimate interests and an absolute right to object to direct marketing.
Contact and complaints
Submit a privacy request through the Contact page and select Other enquiry. You also have the right to complain to the UK Information Commissioner’s Office at ico.org.uk.
Last reviewed: 4 August 2026. This operational draft should be reviewed when analytics, advertising, newsletters, a consent platform or a separate legal entity is introduced.