Privacy Policy

Last updated: 5 October 2026

This Privacy Policy explains how Cerge Media collects, uses, stores and shares personal data when you visit cergemedia.com, contact us, sign up to our newsletter, comment on articles, create an account or buy something from our shop. It also explains the rights you have over your data and how to use them.

We have written this policy to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR). We’ve tried to keep it readable. If anything is unclear, please email us.

1. Who we are

The data controller responsible for your personal data is Cerge Media, an independent online magazine based in London, United Kingdom. When this policy says “we”, “us” or “our”, it means Cerge Media.

You can contact us about anything in this policy, or about how we handle your data, at [email protected]. Please put “Data request” or “Privacy” in the subject line so your message is prioritised.

2. The personal data we collect

We collect only the data we need for the purposes described below. Depending on how you use the site, this may include the following.

Contact form and email

When you use the contact form (powered by the Contact Form 7 plugin) or email us, we collect your name, email address, the subject and the content of your message, plus anything else you choose to tell us. If you send us a story tip, we may also hold any documents you attach.

Newsletter

If you subscribe to our newsletter, we collect your email address and, if you provide it, your name. We also keep a record of when and how you gave consent. Our email platform may record whether a newsletter was delivered and opened and which links were clicked, so that we can understand what readers find useful.

Shop orders

When you buy from our shop, which runs on WooCommerce, we collect your name, billing and delivery address, email address, phone number (if you provide it for delivery purposes), the items ordered, order value and order history. Payment card details are entered directly with our third-party payment providers. We do not see or store your full card number.

Customer accounts

If you create an account, we store your username, email address, an encrypted version of your password, saved addresses and past orders.

Comments

If you comment on an article, we collect the name and email address you enter, the comment itself, the time it was posted, and your IP address and browser user agent string. These help us moderate comments and detect spam. Your email address is never shown publicly.

Technical and log data

Like most websites, our servers record technical information when you visit, such as your IP address, browser type, device type, operating system, pages requested, referring page and the date and time of each request. Our security plugin, Wordfence, also logs IP addresses, login attempts and request patterns in order to detect and block attacks, brute-force login attempts and malicious traffic.

Cookies and similar technologies

We use cookies that are strictly necessary for the site and shop to work. We use other cookies, including any analytics cookies such as those set by Google Analytics, only with your consent, which you give or refuse through our CookieYes consent banner. Full details are in our Cookie Policy.

We do not intentionally collect special category data (such as information about health, ethnicity, religion or sexual orientation). Please don’t send us this kind of information unless it is genuinely necessary, for example as part of a news tip.

3. How we use your data and our lawful bases

Under UK GDPR we must have a lawful basis for each way we use personal data. The table below sets out our purposes and the basis we rely on for each.

Purpose	Data used	Lawful basis
Replying to messages sent via the contact form or email	Name, email address, message content	Legitimate interests (responding to enquiries and running the magazine)
Assessing and following up story tips and pitches	Name, contact details, message and attachments	Legitimate interests (journalism); the special purposes exemption for journalism under the Data Protection Act 2018 may also apply
Sending our newsletter	Email address, name (optional), consent record	Consent (you can withdraw at any time)
Processing and delivering shop orders	Name, addresses, email, phone, order details	Performance of a contract
Taking payment and preventing payment fraud	Order details, billing address, transaction data held by the payment provider	Performance of a contract; legitimate interests (fraud prevention)
Handling returns, refunds and customer service	Order details, correspondence	Performance of a contract; legal obligation (consumer law)
Keeping accounting and tax records for orders	Order and transaction records	Legal obligation
Running customer accounts	Username, email, password (encrypted), addresses, order history	Performance of a contract
Publishing and moderating comments	Name, email, comment, IP address, user agent	Legitimate interests (hosting discussion and preventing spam and abuse)
Keeping the website secure (Wordfence firewall and logs)	IP address, request data, login attempts	Legitimate interests (security of the site and its users)
Strictly necessary cookies (e.g. basket, login, consent record)	Cookie identifiers	Legitimate interests; exempt from consent under PECR as strictly necessary
Analytics cookies, if used	Cookie identifiers, pseudonymous usage data	Consent (via the CookieYes banner)
Responding to legal claims or regulator requests	Any relevant data	Legal obligation; legitimate interests (establishing or defending legal claims)

Where we rely on legitimate interests, we have considered whether our interests are outweighed by your rights and freedoms, and we believe they are not. You can ask us for more information about this assessment.

We do not sell your personal data. We do not use your data for automated decision-making that has legal or similarly significant effects on you.

4. How long we keep your data

We keep personal data only for as long as we need it for the purpose it was collected for, and then delete or anonymise it. As a guide:

• Contact form messages and general email: up to 2 years after our last correspondence, unless the matter is ongoing.
• Newsletter subscriptions: until you unsubscribe. We keep a record that you unsubscribed so we don’t contact you again.
• Shop orders and related invoices: 6 years from the end of the financial year in which the order was placed, to meet UK accounting and tax requirements.
• Customer accounts: until you ask us to close your account, or after 3 years of inactivity, after which order records are kept only as required for accounting.
• Comments: for as long as the comment remains published. IP addresses attached to comments may be kept with the comment for moderation purposes.
• Security and server logs: typically up to 90 days, unless needed longer to investigate a specific incident.
• Cookies: for the periods set out in our Cookie Policy.

5. Who we share your data with

We share personal data only where necessary, and only with organisations that are required to protect it. These include:

• Payment providers. Payments in our shop are processed by third-party payment providers. They receive the information needed to take payment and prevent fraud, and they act under their own privacy policies and the payment card industry security standards.
• Hosting and infrastructure providers. Our website, database and backups are stored with a hosting provider that processes data on our behalf.
• Website plugin and service providers. We use WooCommerce for the shop, Contact Form 7 for the contact form, Yoast SEO for search engine optimisation, Wordfence for security and CookieYes for cookie consent management. Some of these, such as Wordfence and CookieYes, may process limited data (for example IP addresses or consent records) on their own systems in order to provide their service.
• Analytics providers. If you consent to analytics cookies, data about how you use the site may be processed by an analytics provider such as Google.
• Email and newsletter service. If you subscribe to our newsletter, your email address is stored with the email service provider we use to send it.
• Delivery services. Your name, delivery address and, where needed, contact details are shared with the postal or courier service that delivers your order.
• Professional advisers. Such as accountants or lawyers, where needed.
• Authorities. Where we are legally required to, for example in response to a court order, or where it is necessary to prevent fraud or protect people’s safety.

Where a provider processes data on our behalf, we use a written agreement that requires it to act only on our instructions and to keep the data secure.

6. International transfers

Some of the service providers listed above are based, or store data, outside the United Kingdom, including in the European Economic Area and the United States. Where personal data is transferred outside the UK, we make sure it is protected by one of the safeguards recognised by UK data protection law. These include transfers to countries covered by UK adequacy regulations (including the EEA and, for certified organisations, the UK Extension to the EU-US Data Privacy Framework), or the use of the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can contact us for more information about the safeguards that apply to a particular transfer.

7. Your rights

Under UK data protection law you have the following rights. Some apply only in certain circumstances.

• Right to be informed about how your data is used, which is what this policy is for.
• Right of access to a copy of the personal data we hold about you.
• Right to rectification of data that is inaccurate or incomplete.
• Right to erasure (sometimes called the right to be forgotten), where there is no good reason for us to keep the data.
• Right to restrict processing, for example while we check whether data is accurate.
• Right to data portability: to receive data you provided to us in a structured, machine-readable format, where processing is based on consent or contract and carried out by automated means.
• Right to object to processing based on legitimate interests, and an absolute right to object to direct marketing.
• Rights relating to automated decision-making, although we don’t make decisions about you by purely automated means.
• Right to withdraw consent at any time where we rely on consent, for example by unsubscribing from the newsletter or changing your cookie settings. Withdrawing consent does not affect processing that took place before you withdrew it.

To exercise any of these rights, email [email protected]. We may need to ask you for information to confirm your identity. We will respond within one month, which can be extended by up to two further months for complex or numerous requests, in which case we’ll let you know. There is usually no fee.

Please note that where we process data for journalistic purposes, certain rights may be limited by the exemptions in the Data Protection Act 2018. If that applies to your request, we’ll tell you.

8. Your right to complain

If you are unhappy with how we have handled your personal data, please contact us first so we can try to put things right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator:

• Website: ico.org.uk
• Helpline: 0303 123 1113

9. Children

Cerge Media is a general-interest publication for adults. Our shop and newsletter are not aimed at children, and we do not knowingly collect personal data from anyone under 13. Customers must be 18 or over, or have the permission of a parent or guardian, to place an order. If you believe a child has given us their personal data, please contact us and we will delete it.

10. How we keep your data secure

We take reasonable technical and organisational measures to protect personal data against loss, misuse and unauthorised access. These include encrypted connections (HTTPS) across the site, a web application firewall and login protection provided by Wordfence, restricted access to the site’s administration area, strong passwords for administrative accounts, regular software updates and backups. Payment data is handled by our payment providers rather than stored on our servers.

No system is completely secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will report it to the ICO within 72 hours where required, and tell you without undue delay if the risk is high.

11. Links to other websites

Our articles often link to other websites. We are not responsible for how those sites handle personal data, so please read their privacy policies before giving them any information.

12. Changes to this policy

We may update this Privacy Policy from time to time, for example when we start using a new service or when the law changes. The date at the top of this page shows when it was last revised. If we make significant changes that affect how we use data you have already given us, we will tell you by email or by a notice on the site.

13. Contact

For any question about this policy or your personal data, please contact Cerge Media, London, United Kingdom, at [email protected].