Privacy notice.
Last updated: 16 April 2026.
1. Data controller
Marchenholm Publishing Ltd, Unit 14, Blossom Works, Blossom Street, Ancoats, Manchester M4 6BF. ICO ZB629115. Data protection contact: dpo@marchenholm.co.uk.
2. Data we collect
Contact form (/contact/): name, email, topic, message, privacy-agreement timestamp, IP address at submission (for abuse prevention).
Browsing data: IP address (last octet discarded), browser string, device type, pages visited — via cookies with consent.
Age verification: localStorage flag mh_age_verified (client-side only, no server record).
Affiliate click data: when you click a "→ Visit [operator]" link, a tracking identifier is passed to the operator by URL parameter. The identifier allows the operator to attribute a registration to Marchenholm for commission purposes. The identifier is not personally identifiable.
CCTV: none. Our Ancoats office has no CCTV. The office is used for editorial work only.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Responding to contact form | UK GDPR Art. 6(1)(f) legitimate interest |
| Affiliate click tracking | UK GDPR Art. 6(1)(f) legitimate interest (commercial) |
| Analytics (Google Analytics 4) | UK GDPR Art. 6(1)(a) consent |
| reCAPTCHA (spam protection) | UK GDPR Art. 6(1)(f) legitimate interest |
| Corrections / complaints record-keeping | UK GDPR Art. 6(1)(c) legal obligation |
4. Retention
| Category | Retention |
|---|---|
| Contact form submissions | 12 months |
| Analytics (Google Analytics 4) | 14 months |
| Commercial correspondence | 7 years (UK company record-keeping requirement) |
| Affiliate click logs | 14 months |
| Cookies | see /cookies/ |
5. Recipients
- Hosting provider (United Kingdom — Manchester data centre)
- Cookiebot (Cybot A/S, Denmark) — consent platform
- Google reCAPTCHA (Google LLC, USA — UK IDTA) — spam protection on /contact/ only
- Google Maps (Google LLC, USA — UK IDTA) — keyless map embed on /contact/ only (helps visitors locate the office). Loaded on page render; Google receives your IP address for the embed request.
- Google Analytics 4 (Google LLC, USA — UK IDTA, consent-gated)
- Mailgun EU (Mailgun Technologies, EU region) — transactional email (contact form)
- Affiliate network partners — receive click-through identifier only
- Backup provider (Backblaze B2 EU region)
6. International transfers
Google services (reCAPTCHA, Analytics, Maps embed): USA, under the UK International Data Transfer Agreement (IDTA) per UK GDPR Art. 46. Mailgun EU: EU region (GDPR-adequate).
7. Your rights under UK GDPR
You have rights to: access, rectification, erasure, restriction of processing, data portability, objection, withdrawal of consent. To exercise any right, email dpo@marchenholm.co.uk. We respond within 30 days.
8. ICO
You have the right to lodge a complaint with the Information Commissioner's Office:
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
ico.org.uk · 0303 123 1113
9. Security
HTTPS (TLS 1.2+) across all pages. Security headers (HSTS, CSP, X-Content-Type-Options, Referrer-Policy, Permissions-Policy). Access control on administrative interfaces. Password policy and 2FA. Regular backups to a separate UK region. Incident response procedure reviewed annually.
10. Children
This site is intended for readers aged 18+. We do not knowingly collect data from users under 18. If we learn we have received data from a person under 18, we will delete it. An 18+ age gate blocks access on first visit.
11. Cookies
Cookies are addressed in the dedicated cookie policy at /cookies/. From that page you can also re-open the consent prompt at any time via the Manage cookies button.
12. Changes
Material changes will be notified on this page at least 30 days before effect.
Last updated: 16 April 2026.