Privacy Policy
This policy explains what personal data is processed when you use grobuzz.co.uk, why, and what rights you have. It is written to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 — and to be actually readable.
Who is responsible
The data controller for this website is Grobuzz, an independently published site — not a registered company — operated from Bangladesh. Grobuzz has no establishment in the United Kingdom. UK GDPR nevertheless applies to this site, and we comply with it, because we offer our content to readers in the UK (Article 3(2) UK GDPR).
All contact with us — including data-protection requests and right-of-reply — is by email: [email protected] with "Privacy" in the subject line. Email is not a fallback for a missing office; it is how this publication operates, and requests are answered within the timeframes set out below.
The short version
This is a static website. It has no user accounts, no comment system, no newsletter, and currently no analytics and no advertising. We set no cookies. Personal data we process about visitors is limited to (1) the technical logs any web server keeps, and (2) whatever you choose to send us by email. We also process personal data about the people we write about — see section 3.
1. Server logs
What: when you request a page, our web server records your IP address, the page requested, the date and time, your browser's user-agent string and the referring page. This is standard for virtually every website.
Why (lawful basis): our legitimate interest in keeping the site secure and diagnosing faults — Article 6(1)(f) UK GDPR.
Where: the site is hosted on a server in Germany operated by Hetzner, acting as our processor. Storing data in the EEA is a restricted transfer permitted under the UK's adequacy regulations. If the site is later served through a content-delivery network (such as Cloudflare), that provider would also act as our processor under contract; if its network extends outside the UK/EEA, we will update this policy with the applicable transfer safeguard before it goes live.
How long: access logs are rotated and deleted automatically on a short cycle — typically within 14 days. We do not build profiles from them.
2. Email you send us
What: your email address and whatever you write.
Why (lawful basis): our legitimate interest in answering you — Article 6(1)(f); or, where you are exercising a legal right, compliance with a legal obligation — Article 6(1)(c).
How long: we keep correspondence only as long as needed to deal with it, and delete routine correspondence within 12 months. Correction and privacy-request threads may be kept longer as a record that we handled them properly.
3. People we write about
Grobuzz publishes articles about named individuals. Writing, editing and publishing those articles is processing of personal data for journalistic purposes. We rely on our legitimate interests in publishing journalism (Article 6(1)(f) UK GDPR) together with the special-purposes exemption in the Data Protection Act 2018 (Schedule 2, Part 5), which can limit some data-subject rights where applying them would be incompatible with journalism. If we have written about you and you believe something is inaccurate, unfair or seriously out of date, use the right-of-reply route in our editorial policy — we correct errors, and we review removal or anonymisation requests on their merits.
4. Cookies
Grobuzz sets no cookies — not for analytics, not for preferences, not for advertising. The site's search runs entirely in your browser and sends no queries to us or anyone else.
5. If we add analytics or advertising later
We may in future add privacy-respecting analytics or advertising. If we do, this policy will be updated before anything goes live, a cookie consent mechanism will be added if one is legally required, and the "no cookies" statements above will be corrected. Until this page says otherwise, they stand.
6. Third parties
We do not sell, rent or share personal data with anyone for marketing. The only parties that touch data at all are our hosting provider, Hetzner (Germany), and, potentially, a CDN provider as described above. Articles currently embed no third-party content. If we ever embed content such as a video player, the embedding service could process connection data under its own policy when that page loads — and we would revisit the cookie statements above before doing so.
7. Your rights
Under UK GDPR you have the right to:
- Access — ask for a copy of the personal data we hold about you;
- Rectification — have inaccurate data corrected;
- Erasure — have your data deleted where there is no good reason for us to keep it;
- Restriction — limit what we do with it while a dispute is resolved;
- Objection — object to processing based on legitimate interests;
- Portability — receive data you gave us in a usable machine-readable format.
To exercise any of these, email [email protected] with "Privacy" in the subject. We will respond within one calendar month; for particularly complex requests the law allows up to two further months, and if we ever need that we will tell you within the first month and explain why. Requests are free unless they are manifestly unfounded or excessive.
8. Complaints
If you think we have handled your data badly, we would like the chance to fix it first — but you also have the right to complain directly to the UK's supervisory authority: the Information Commissioner's Office (ICO), at ico.org.uk/make-a-complaint or by phone on 0303 123 1113.
9. Changes
Any change to this policy will be posted here with a new "last updated" date. Substantive changes will be flagged on this page, not buried.