Privacy notice

Data collected on this site

The Consumer Brief runs an information site. It sells nothing, it takes no payments, and it does not require an account. In practice, that means the personal data collected during an ordinary visit is very limited. A visit to a page produces the routine web-server log entries that any website produces, including an IP address, a browser user-agent string, the requested URL, a timestamp and a referrer where the browser supplies one. Where a reader emails the editorial address, the message and any information supplied inside it are processed for the purpose of answering the correspondence.

No account can be created on this site, no comments can be posted, and no forms other than an optional correction email are offered to the reader. If any future feature would require the collection of further data, this notice will be updated in advance and the change will be reflected in the changelog for the page. Nothing on the site is set up to collect financial data, and no card details, bank identifiers or payment information are handled here at any point. Where a reader chooses to include such information in a message to the editor, they are asked in the response to remove it and to resend the enquiry without it.

Cookies and analytics

The site aims to run with the smallest possible cookie footprint. A strictly necessary cookie is used to remember a reader's choice on the cookie banner itself, so that the banner does not reappear on every page load. Beyond that, the site's default position is that no advertising cookies, no cross-site tracking and no third-party marketing tags are set. Where a light analytics tool is used for measuring aggregate readership, it is configured to anonymise IP addresses and to avoid setting cookies that would allow a reader to be re-identified across sessions.

The reader can decline all non-essential cookies at any time through the cookie banner, and can clear existing cookies through the browser's own privacy controls. Declining non-essential cookies does not affect the reader's ability to read any page on the site. There is no advertising on the site, and no advertising cookies are used. Where a page embeds a document from a UK public authority, the embed is served from the authority's own domain and any cookies set by that embed are governed by that authority's privacy notice rather than by this one.

How long we retain data

Web-server logs are retained for no longer than six months from the date of the visit, after which they are deleted on a rolling basis. This retention window is set to be long enough to help diagnose service problems and to respond to security incidents, and short enough to avoid holding routine visitor data indefinitely. Aggregate analytics data may be retained for longer where it has been sufficiently anonymised that no individual reader can be re-identified from it.

Email correspondence with the editor is retained for as long as needed to answer the correspondence and to keep a coherent record of any correction that resulted from it. Correspondence that led to a change on the site is referenced in the changelog for the affected page, without the correspondent's personal details. Correspondence with a request for permanent deletion is honoured, subject to any legal obligation to retain a specific record for a defined period. The site does not sell, rent or transfer correspondence data to any third party for any purpose.

Your rights under UK GDPR and Data Protection Act 2018

Under the UK General Data Protection Regulation and the Data Protection Act 2018, a reader whose personal data has been processed by the site has the right to be informed about the processing, the right of access to their data, the right to rectification, the right to erasure in specified circumstances, the right to restrict processing, the right to data portability where applicable, the right to object to processing on grounds relating to the reader's particular situation, and the right not to be subject to a decision based solely on automated processing. This site does not use automated decision-making about individual readers.

To exercise any of these rights, please write to the editor at the address given below. The site will confirm receipt of the request, verify that the request comes from the person to whom the data relates and then respond within the statutory period of one month from receipt, unless the request is unusually complex, in which case an extension of up to two further months is available under the regulation and the reader will be informed of the reason. No fee is charged for a first request. Repeated or manifestly unfounded requests may attract a reasonable administrative fee or be refused, as permitted by the regulation.

How to reach us and the ICO

The editor is contactable at [email protected]. Correspondence about a specific page should include the page URL and, where relevant, a short statement of the concern. Correspondence about a data-protection right should indicate which right is being exercised and what outcome is sought. All correspondence is read by the editor and handled without a fuss.

A reader who believes that a data-protection concern has not been resolved satisfactorily by the site has the right to complain to the Information Commissioner's Office, the UK regulator for data protection. The ICO can be contacted through ico.org.uk or by telephone on the number published on that site. Making a complaint to the ICO does not affect the reader's other legal rights, and it does not require any fee. This privacy notice was last reviewed on 5 August 2026 and will be re-checked at least once each quarter and whenever the site introduces a material change to how it handles personal data.