ThamesQuill
18+

UK GDPR · Data Protection Act 2018 · Last reviewed May 2026

Data handling at ThamesQuill — the operational record

A complete accounting of what personal data this site collects, the lawful basis for each processing activity, how long it is held, and how to exercise your rights under UK GDPR.

// controller-identity

The data controller for all personal data processed via this website is ThamesQuill, an editorial publishing operation based in Wandsworth, South West London, SW18. Companies House registration on file; available to the ICO and accredited regulators upon verified written request. The controller does not hold a UKGC gambling licence. Contact for all data-related enquiries: [email protected]. Postal contact address: Registered office available on request at launch. The controller is registered with the Information Commissioner's Office under the Data Protection Act 2018 as an organisation that processes personal data for journalistic and editorial purposes.

No Data Protection Officer is required under UK GDPR Article 37 given the scale and nature of processing activities. The compliance editor (Jamie Hargreaves) reviews data-handling practices against applicable ICO guidance at each major product cycle. Any material changes to processing activities will trigger an updated version of this notice prior to the change taking effect.

// data-collected

ThamesQuill collects the following categories of personal data from visitors to this site:

  • Technical identifiers: IP address (truncated to /24 prefix before storage via Google Analytics 4 IP anonymisation), browser user-agent string, device type, operating system, and referring URL. Collected automatically on page load by the analytics integration.
  • Behavioural data: Pages visited, time on page, scroll depth, outbound link clicks (including clicks on sponsored operator links), and session duration. Collected via Google Analytics 4 event tracking, subject to consent.
  • Cookie consent state: A boolean record of whether you accepted or declined each cookie category, stored in your browser's localStorage under the key tq_consent. This data does not leave your browser — it is not transmitted to any server.
  • Contact form submissions: Name, email address, message content, and selected subject category submitted via the contact form at editorial-contact.php. Collected only when you actively submit the form.
  • Marketing identifiers: If you consent to marketing cookies, advertising platform identifiers (Google Ads click IDs, where present) may be associated with your session and transmitted to Google's advertising infrastructure. ThamesQuill does not itself store these identifiers.

ThamesQuill does not collect or process special category data as defined in UK GDPR Article 9 (health data, biometric data, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, data concerning sex life or sexual orientation). We do not process children's data; the site is intended for adults aged 18 and over only, and the age gate on the home page enforces this at the point of entry.

// lawful-basis

Each processing activity is conducted on one of the following lawful bases as defined in UK GDPR Article 6:

  • Legitimate interests (Article 6(1)(f)): Processing of technical identifiers for site security, bot detection, and fraud prevention. We have conducted a legitimate interests assessment (LIA); the record is available on written request. The interests pursued are securing the site and preventing abuse; these are not overridden by the rights and interests of data subjects given the minimal intrusiveness of the processing and the availability of opt-out mechanisms.
  • Consent (Article 6(1)(a)): Analytics cookie processing (Google Analytics 4 behavioural data) and marketing cookie processing (advertising identifiers). Consent is requested via the cookie banner on first visit and can be withdrawn at any time via the cookie preference panel, accessible from the footer. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
  • Contract / pre-contractual steps (Article 6(1)(b)): Processing of contact form submissions for the purpose of responding to editorial enquiries, data subject access requests, and corrections requests. The processing is necessary to fulfil the communication service you have requested by submitting the form.
  • Legal obligation (Article 6(1)(c)): Retention of certain data to comply with HMRC requirements regarding financial records (affiliate commission accounting), ICO registration obligations, and ASA complaints-handling records where applicable.

// retention-schedule

Personal data is retained for no longer than is necessary for the purpose for which it was collected. The following retention periods apply:

  • Analytics data (Google Analytics 4): Data retention set to 14 months within the GA4 property. After 14 months, individual event data is deleted from Google's servers; aggregate reporting data may persist in an anonymised form indefinitely.
  • Contact form submissions: Emails and form submissions retained for 24 months from the date of the last relevant communication in the thread, or until the subject of the correspondence is resolved, whichever is later. Copies held in the editorial email system subject to Google Workspace data retention settings.
  • Financial / commission records: Affiliate commission records that include personal identifiers (e.g. a contact email associated with an operator account) are retained for 7 years in compliance with HMRC record-keeping requirements under the Taxes Management Act 1970.
  • Cookie consent records: Stored client-side in localStorage; not transmitted to ThamesQuill servers. Cleared when you clear your browser storage or withdraw consent via the preference panel.
  • Corrections and complaints log: Dispute and corrections records retained for 24 months from the date of resolution, per editorial policy.

// rights-inventory

Under UK GDPR, you hold the following rights in respect of your personal data:

  • Right of access (Article 15): You may request a copy of the personal data we hold about you. We will respond within one calendar month of a verified request. Requests should be submitted via the contact form at editorial-contact.php, selecting the subject "Data request". Identity verification may be required before disclosing data.
  • Right to rectification (Article 16): If personal data we hold is inaccurate or incomplete, you may request correction. We will act on verified rectification requests within one month.
  • Right to erasure (Article 17): You may request deletion of your personal data where the processing is based on consent, or where the data is no longer necessary for the purpose for which it was collected. Erasure may be declined where processing is necessary for legal compliance or the establishment, exercise, or defence of legal claims.
  • Right to restrict processing (Article 18): You may request that we suspend active processing of your data in defined circumstances, including while a rectification or objection request is under review.
  • Right to data portability (Article 20): Where processing is based on consent or contract and is carried out by automated means, you may request your data in a structured, commonly used, machine-readable format.
  • Right to object (Article 21): You may object at any time to processing based on legitimate interests. We will assess whether our legitimate interests are overridden by your interests, rights, and freedoms and respond within one month.
  • Rights related to automated decision-making: ThamesQuill does not conduct automated decision-making or profiling that produces legal or similarly significant effects on individuals.

To exercise any of these rights, contact [email protected] or use the contact form. If you are dissatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office at ico.org.uk or by telephone on 0303 123 1113.

// sub-processors

ThamesQuill uses the following third-party sub-processors who may process personal data on our behalf or in conjunction with our site:

  • Google LLC (Google Analytics 4, Google Tag Manager, Google Ads): Processing location: United States (subject to UK Adequacy Decision or Standard Contractual Clauses). Purpose: analytics, consent management, and advertising measurement. Google's privacy policy: policies.google.com/privacy. Data processing terms: business.safety.google/dataprocessingterms.
  • Hosting provider: The web server hosting this site processes technical identifiers (IP addresses, request headers) in the course of serving HTTP responses. Server-level logs are retained for a maximum of 30 days and are not used for marketing purposes. Specific hosting provider details available on request.
  • Email service provider (Google Workspace): Contact form submissions and editorial correspondence are processed via Google Workspace. Google acts as a data processor for email content under our Google Workspace agreement.

We do not sell personal data to third parties. We do not share personal data with operators listed on this site for the purpose of direct marketing. Outbound clicks to operator sites via sponsored links may result in the operator's own tracking systems collecting data about your visit to their site — ThamesQuill is not the controller for that processing; the operator's own privacy notice applies from the moment you land on their domain.

// transfers

Data processed by Google LLC (Analytics, Tag Manager) is transferred to the United States. Such transfers are conducted under the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, which provide appropriate safeguards for the rights of UK data subjects in line with UK GDPR Chapter V. Google's compliance with these transfer mechanisms is documented at business.safety.google/dataprocessingterms.

No other international transfers of personal data are conducted by ThamesQuill. All editorial processing, correspondence handling, and financial record-keeping occur within the United Kingdom or the European Economic Area.

// notice-versioning

This notice was last reviewed and updated in May 2026. Version history:

  • v1.0 — October 2022: Initial publication at site launch.
  • v1.1 — March 2023: Added Google Analytics 4 migration note; updated data retention from Universal Analytics 26-month to GA4 14-month schedule.
  • v1.2 — November 2024: Updated sub-processor section to reflect Google Consent Mode v2 implementation and gtag consent default state.
  • v2.0 — May 2026: Full review against ICO's updated guidance on cookies and similar technologies (April 2026). Added international transfers section; clarified lawful basis matrix; expanded rights inventory to cover Article 20 portability and Article 22 automated decision-making.

Material changes to this notice will be communicated via a notification banner on the site for a minimum of 14 days before the change takes effect. Non-material corrections (typographical errors, broken links) may be applied without notice. The effective date of the current version is shown in the page metadata above.