Privacy Policy — Grasol Notebook

1. Data Controller

Grasol Notebook, based at 47 Rivington Street, EC1V 8QL, London, United Kingdom, is the data controller responsible for personal data collected through this website. For data protection enquiries, write to [email protected].

2. Personal Data We Collect

We collect personal data only when you actively provide it to us. The categories of data we may collect include:

Contact form submissions: name, email address, and the content of your message, submitted via the contact form on this site.
Direct email correspondence: any personal data included in emails sent to our editorial address.
Technical data: IP address, browser type, device type, pages visited, and time on site, collected automatically via server logs and analytics tools (see Section 8).

We do not collect financial data, special category data, or data relating to children. We do not operate an email subscription list at this time.

3. Lawful Basis for Processing

We process personal data on the following lawful bases under UK GDPR:

Contract/pre-contract: to respond to your enquiry or correspondence.
Legitimate interests: to understand how our site is used, for security purposes, and to maintain accurate records of correspondence.
Consent: for any processing not covered by the above bases, where we will ask for your explicit consent before proceeding.

4. How We Use Your Personal Data

We use the data we collect to:

Respond to contact form submissions and editorial correspondence.
Maintain records of corrections, submissions, and reader communications.
Understand how readers use this publication, in order to improve the site.
Comply with applicable legal obligations.

We do not use your personal data for automated decision-making or profiling. We do not sell personal data to third parties.

5. Data Retention

Contact form submissions and email correspondence are retained for a maximum of three years from the date of receipt, after which they are deleted. Server log data is retained for a maximum of twelve months. Where data is processed under consent, we retain it until consent is withdrawn.

6. Third-Party Data Processors

We use a limited number of third-party processors that may access personal data in the course of providing their services. These include our hosting provider and, where analytics are enabled, Google Analytics. Each processor is bound by a data processing agreement and may not use your data for their own purposes. Full details of processors are available on request.

Data may be transferred outside the UK in connection with these processors. Where such transfers occur, we ensure appropriate safeguards are in place (e.g. Standard Contractual Clauses).

7. Your Rights

Under UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data:

Right of access — to request a copy of the personal data we hold about you.
Right to rectification — to request correction of inaccurate data.
Right to erasure — to request deletion of your personal data, subject to applicable legal obligations.
Right to restrict processing — to request that we limit how we use your data.
Right to object — to object to processing based on legitimate interests.
Right to data portability — to receive your data in a structured, machine-readable format.

To exercise any of these rights, write to [email protected]. We will respond within one calendar month. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8. Cookies

This site uses cookies. For full details of the cookies we use and how to manage your preferences, see our Cookie Policy.

9. Privacy Contact

For any questions about this privacy policy or how we handle your data, write to [email protected] with the subject line "Privacy Enquiry." We will respond within five working days.

This policy was last reviewed in January 2026 and will be reviewed annually. Material changes will be noted at the top of this page.