Privacy Policy

Version 1.0 · Effective 1 February 2026 · Last updated 4 August 2026

1. Data controller

UKNexa is the data controller for personal data collected through uknexa.co.uk. Address: 71–75 Shelton Street, Covent Garden, London WC2H 9JQ. Data protection enquiries: privacy@uknexa.co.uk.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

2. Our starting position: we collect as little as possible

This is a publication, not a service that requires an account. You can read every page on this website without telling us anything about yourself. We do not require registration, we do not run a newsletter, we do not operate a login, and we do not sell personal data to anyone under any circumstances.

3. What we collect and why

3.1 Information you give us voluntarily

If you use our contact form or email us, we process the name, email address, subject and message content you provide, so that we can read and answer your enquiry.

• Lawful basis: legitimate interests (Article 6(1)(f)) — responding to a person who has deliberately contacted us. Where you tick the consent box, consent (Article 6(1)(a)) also applies.
• Retention: up to 12 months from the close of the enquiry, then deleted. Complaints and correction requests are retained for 24 months as an editorial audit record.

3.2 Technical data collected automatically

Our web server keeps standard access logs containing the requesting IP address, timestamp, requested URL, HTTP status, referring URL and user-agent string. These exist for security, abuse prevention and fault diagnosis.

• Lawful basis: legitimate interests (Article 6(1)(f)) — keeping the website secure and operational.
• Retention: 30 days, then automatically deleted.

3.3 Optional analytics

With your consent we record aggregate usage — which pages are read, how far down them readers get, which outbound links are followed, and broad device and country information. This tells us which reviews are useful and where our writing loses people. It is aggregated, it is not used to build an advertising profile of you, and it is never sold or shared for marketing.

• Lawful basis: consent (Article 6(1)(a)), given through the cookie banner and withdrawable at any time.
• Retention: 14 months in aggregate form.

If you choose Reject optional, no analytics storage is set and the website works exactly as before. You can change your choice at any time using the Cookie preferences link in the footer.

3.4 What happens when you follow a link to an operator

Some outbound links carry a tracking parameter identifying us as the referring publisher, so that any commission due can be attributed. That is a transfer to that operator, who becomes an independent data controller for anything you subsequently do on their website — including any account you open, any identity documents you supply and any payment you make. We receive no personal data back. We are told only that a referral converted, in aggregate. Read the operator's own privacy policy before registering.

4. What we do not do

• We do not sell, rent or trade personal data.
• We do not build advertising profiles or run behavioural retargeting from this website.
• We do not process special category data (health, beliefs, biometrics) and ask that you do not send it to us.
• We do not carry out automated decision-making or profiling that produces legal or similarly significant effects.
• We do not knowingly collect data from anyone under 18. This website is for adults only. If we learn that we hold data belonging to a minor, we delete it.

5. Who we share data with

We use a small number of processors, each bound by a written data processing agreement:

We may also disclose data where required by law, by a regulator or by a court, or to establish, exercise or defend legal claims.

6. International transfers

We host and process within the United Kingdom and the European Economic Area wherever possible. If a transfer outside the UK becomes necessary, we rely on UK adequacy regulations or on the International Data Transfer Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment.

7. Security

This website is served over HTTPS with a strict Content Security Policy. Access to enquiry data is limited to the editorial team members who need it. Access logs are rotated and deleted on a 30-day cycle. No transmission over the internet can be guaranteed completely secure, but we take the measures appropriate to the limited data we hold, and we will notify the ICO and affected individuals where a breach is reportable.

8. Your rights under UK GDPR

You have the right to:

• Be informed — this policy;
• Access a copy of the personal data we hold about you;
• Rectification of inaccurate or incomplete data;
• Erasure of your data where there is no overriding reason for us to keep it;
• Restrict processing in certain circumstances;
• Data portability for data you provided under consent or contract;
• Object to processing carried out on the legitimate interests basis;
• Withdraw consent at any time, without affecting processing already carried out.

To exercise any of these, email privacy@uknexa.co.uk. We respond within one calendar month and there is no charge. We may ask you to confirm your identity where a request concerns data we cannot otherwise link to you.

9. Complaints

If you are unhappy with how we have handled your data, please tell us first at privacy@uknexa.co.uk so we can put it right. You also have the right to complain to the UK supervisory authority:

Information Commissioner's Office — Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF · Helpline 0303 123 1113 · ico.org.uk/make-a-complaint

10. Changes to this policy

We review this policy at least annually. The effective date above always reflects the current version, and material changes affecting your rights will be flagged prominently on the website.