1. Who I am

This privacy policy applies to
ceridwenhughson.com.

The data controller is
Ceridwen Clark, writing as Ceridwen Hughson.
Ceridwen Hughson is also a name I am legally entitled to use.
I am based in Wales, United Kingdom.

This policy explains how I process personal information under
the UK General Data Protection Regulation, the Data Protection
Act 2018 and, where applicable, the Privacy and Electronic
Communications Regulations 2003.

2. Information I collect

I may collect the following limited categories of personal
information.

Contact information

If you use the contact form or otherwise contact me, I may
receive:

• your name;
• your email address;
• the contents of your message; and
• any other information you choose to provide.

Contact-form messages are used to respond to your enquiry.
Please don’t include sensitive personal information unless it is
necessary.

Newsletter information

If you subscribe to the newsletter, Substack collects and
processes information including your email address,
subscription status and information about newsletter delivery
and engagement.

Technical information

The website host may automatically record technical information
needed to provide and secure the website, including:

• your IP address;
• browser and device type;
• pages requested;
• the date and time of requests;
• referral information; and
• security, diagnostic and error logs.

Analytics information

If you consent to optional analytics cookies, Google Analytics
collects anonymised usage information. This may include pages
visited, approximate geographical area, device category,
referring source and interactions with the website.

I use aggregate reports to understand website traffic and
reader interest. I don’t use Google Analytics to identify
individual visitors.

3. How I use information

I use personal information to:

• respond to messages and enquiries;
• administer newsletter subscriptions through Substack;
• send newsletters requested by subscribers;
• operate, maintain and secure the website;
• diagnose faults and prevent malicious activity;
• understand website use through consented, anonymised
  analytics;
• maintain appropriate business records; and
• comply with applicable legal obligations.

I don’t sell, rent or trade personal information.

4. Lawful bases for processing

UK data-protection law requires a lawful basis for each use of
personal information.

• Contact enquiries: legitimate interests in
  communicating with people who contact me and, where relevant,
  taking steps at their request before entering into a
  contract.
• Newsletter: consent. You may withdraw
  consent at any time by using the unsubscribe link in a
  newsletter or managing your subscription through Substack.
• Website security and administration:
  legitimate interests in providing a reliable, functional and
  secure website.
• Optional analytics: consent given through
  the cookie banner.
• Required business records: compliance with
  legal obligations or legitimate interests in administering
  and protecting the business.

Where I rely on legitimate interests, I use information only
where the processing is necessary, proportionate and unlikely
to override your privacy rights.

5. Service providers and other websites

I use third-party services to operate the website and
newsletter.

IONOS

IONOS hosts this website. It may process
technical information, server logs and website data to provide
hosting, security, backups and maintenance.

Substack

The newsletter is managed through
Substack.
Substack processes the information you provide when subscribing
and information connected with newsletter delivery and use.

Substack’s own
privacy policy
also applies to its processing.

Google Analytics

Google Analytics provides anonymised and aggregated information
about website use. Analytics operates only where you have
consented to the relevant cookies.

Contact form

Information entered into the contact form is transmitted so
that I can receive and answer your message. Website and email
providers may process that information while delivering or
storing the message.

Retailers and external websites

The website links to retailers and other external websites.
When you follow a link, the destination website may collect
information or place its own cookies. Its own privacy and cookie
policies apply.

Embedded content

Pages may contain embedded material such as videos. Embedded
content may behave as though you visited the provider’s website
directly and may collect information or place cookies, subject
to consent where required.

6. Cookies

The website uses strictly necessary cookies and similar
technologies needed for functions such as security and
remembering your cookie choices. These don’t require consent
where they meet the legal definition of strictly necessary.

Optional analytics or third-party cookies are used only where
you have given consent through the cookie banner. Rejecting
optional cookies won’t prevent you from reading the website.

You can accept, reject or change your choices using the cookie
controls on this website. Further details about the cookies
currently in use and their duration are available in the
Cookie Policy.

You can also restrict cookies through your browser, although
blocking all cookies may affect some website functions.

7. Affiliate links

Some links to books or retailers are affiliate links. If you
follow an affiliate link and make a purchase, I may receive a
commission from the retailer. This doesn’t increase the price
you pay.

As an Amazon Associate I earn from qualifying purchases.

Amazon and other participating retailers may use cookies or
similar technologies to record that you arrived through an
affiliate link and attribute a resulting purchase. Their own
privacy and cookie policies apply.

Affiliate links are identified where required.

8. International transfers

Some providers, including Google and Substack, may process
information outside the United Kingdom.

Where UK data-protection law applies to an international
transfer, the relevant provider must use an approved mechanism,
such as UK adequacy regulations, the UK International Data
Transfer Agreement or an approved contractual addendum.

Further information about the safeguards used by a provider can
be found in that provider’s privacy documentation.

9. How long information is kept

Personal information is kept only for as long as reasonably
needed for the purpose for which it was collected.

• Contact messages: normally retained for up
  to two years after the enquiry is resolved, unless they need
  to be kept longer for a contract, dispute or legal
  obligation.
• Newsletter information: retained while you
  remain subscribed. Substack may retain limited records after
  unsubscription where required for suppression lists,
  security or legal compliance.
• Technical and security logs: retained
  according to IONOS’s operational, backup and security
  schedules.
• Analytics information: retained according
  to the retention period configured in Google Analytics.
  Anonymised aggregate reports may be retained for longer where
  they no longer constitute personal information.
• Legal and business records: retained for
  the period required by applicable law or while reasonably
  needed to establish, exercise or defend legal claims.

10. Security

I take reasonable technical and organisational measures to
protect personal information against accidental loss, misuse,
unauthorised access, alteration or disclosure.

No website or email service can guarantee complete security.
Please don’t include unnecessary confidential or sensitive
information in a contact-form message.

11. Your data-protection rights

Depending on the circumstances and lawful basis involved, you
may have the right to:

• request access to personal information held about you;
• ask for inaccurate or incomplete information to be corrected;
• ask for personal information to be erased;
• ask for processing to be restricted;
• object to processing based on legitimate interests;
• object to the use of your information for direct marketing;
• receive certain information in a portable format; and
• withdraw consent where processing relies on consent.

These rights aren’t absolute and may depend on why the
information is being processed. You won’t normally be charged
for exercising them.

To make a request, use the
contact form.
I may request enough information to confirm your identity and
understand your request.

Requests will normally be answered within one month, subject to
the extensions permitted by law for particularly complex or
numerous requests.

Complaining to the ICO

If you are concerned about how your information has been used,
please contact me first so that I have an opportunity to address
the issue.

You also have the right to complain to the
Information Commissioner’s Office,
the UK data-protection supervisory authority.

ICO telephone: 0303 123 1113

12. Children’s information

This website isn’t intended to collect personal information
directly from children. It doesn’t provide visitor accounts,
public comments or interactive community features.

If you believe a child has provided personal information
unnecessarily, please contact me so that I can investigate and,
where appropriate, remove it.

13. Changes to this policy

I may update this policy when the website, its services or legal
requirements change. The effective date at the top of the page
shows when it was last revised.

Significant changes will be highlighted on the website where
appropriate.

14. Contact details

Use these details if you have a question about this policy,
want to exercise a data-protection right or wish to raise a
concern.