This privacy policy explains how Katanaspin collects, uses and protects your personal information when you visit thornburycofe.org.uk. We process data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and we are committed to keeping your information secure.
Who controls your data
The data controller for this site is the thornburycofe.org.uk editorial team. We are responsible for deciding how your personal information is collected and used. For any questions about how we handle your data, contact us at [email protected].
What information we collect
We collect two broad categories of information: data you provide directly, and data we observe through your use of the site.
Information you provide: When you fill out our contact form or send us an email, we collect your name, email address and the content of your message. This is the only personal information you hand over directly.
Information we observe: Like most websites, we automatically collect technical data when you visit. This includes your IP address, browser type, operating system, referring URL, pages viewed and the time spent on each page. We also use cookies and similar technologies – see our separate cookie policy for details on what is stored and how to manage it.
Why we process your data
We use the information we collect for these purposes:
- To respond to enquiries sent through our contact form or by email
- To improve the site's content and layout based on how visitors navigate it
- To monitor traffic patterns and understand which sections are most useful
- To detect and prevent abuse, spam or fraudulent activity
We do not use your data for marketing purposes, and we do not sell or rent your personal information to third parties.
Lawful basis for processing
Under UK GDPR, every use of personal data must have a lawful basis. Ours are:
| Purpose | Lawful basis |
|---|---|
| Responding to contact-form submissions | Legitimate interest – you have asked us a question and expect a reply |
| Analytics and site improvement | Legitimate interest – understanding how the site is used helps us improve it |
| Security and abuse prevention | Legitimate interest – protecting the site and its visitors from harm |
Where we rely on legitimate interest, we have balanced our need to process data against your rights and freedoms, and we are satisfied the processing is proportionate and does not override your interests.
Sharing your information
We share personal data with a small number of third-party services that help us run the site. These are:
Analytics providers: We use third-party analytics tools to understand traffic patterns. These services process anonymised or pseudonymised data and are bound by their own privacy policies. We do not share identifiable contact-form data with analytics providers.
Hosting provider: Our web host stores the site's files and database, which may include contact-form submissions and server logs. The host acts as a data processor under our instruction and is contractually required to protect your data.
Email service: Messages sent through our contact form are delivered via email infrastructure, which temporarily processes your message content and address to route it to our inbox.
We do not share your personal information with advertisers, and we do not transfer data outside the United Kingdom or the European Economic Area without appropriate safeguards.
Your rights under UK GDPR
You have the following rights regarding your personal data:
- Access: You can request a copy of the personal information we hold about you.
- Rectification: If the information we hold is inaccurate or incomplete, you can ask us to correct it.
- Erasure: You can ask us to delete your data, subject to certain conditions – for example, we may need to retain correspondence for record-keeping.
- Restriction: You can request that we limit how we use your data.
- Portability: Where technically feasible, you can ask for your data in a structured, commonly used format.
- Objection: You can object to processing based on legitimate interest, and we will stop unless we have compelling grounds to continue.
- Withdraw consent: Where processing is based on consent (such as optional analytics cookies), you can withdraw that consent at any time.
How to exercise your rights
To make a request, email [email protected] with "Data Subject Request" in the subject line. We will respond within one month, and there is no charge unless your request is manifestly unfounded or excessive.
If you are not satisfied with how we handle your request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection supervisory authority. Visit ico.org.uk or call 0303 123 1113.
How long we keep your data
We retain personal information only as long as necessary for the purposes it was collected. Contact-form messages are kept for up to two years to maintain a record of correspondence. Server logs and analytics data are typically retained for 12–24 months, after which they are deleted or anonymised.
If you request deletion of your data, we will comply within 30 days unless we have a legitimate reason to retain it – for example, to defend a legal claim.
Protection of minors
This site is intended for users aged 18 and over (18+). We do not knowingly collect personal information from anyone under 18. If you are a parent or guardian and believe your child has provided us with personal data, contact us at [email protected] and we will delete it promptly.
Changes to this policy
We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. When we make significant changes, we will update the revision date below and, where appropriate, notify you by email or through a prominent notice on the site.
Last updated: 26 November 2025
This site is for players aged 18 and over (18+). If gambling ever stops feeling like entertainment, free and confidential help is available at BeGambleAware.org.