Notice · UK GDPR & DPA 2018

Privacy notice

Last updated: 30 April 2026.

Shesaftir Editorial ("we", "us", "our") is the data controller for personal data collected through this site. We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018) and the Privacy and Electronic Communications Regulations (PECR).

1. Information we collect

  • Newsletter subscriptions — email address only. Lawful basis: consent (Article 6(1)(a) UK GDPR).
  • Contact-form submissions — name, email, message, subject. Lawful basis: legitimate interest in responding (Article 6(1)(f)).
  • Cookie data — see the Cookies notice.
  • Server logs — IP address and request metadata, retained 30 days for security; not used to identify you.

2. How we use collected information

Newsletter emails are sent only to deliver the quarterly Shesaftir Heat Sheet you subscribed to. Contact-form submissions are used only to reply to your message and (where relevant) keep a record of the editorial resolution. We do not use either dataset for marketing profiling, and we do not share data with the bookmakers we list.

3. Cookiebot processor disclosure

Consent management on this site is provided by Cookiebot (operator: Cookiebot ApS, Havnegade 39, 1058 Copenhagen, Denmark). Cookiebot acts as a data processor on our behalf for the limited purpose of recording and respecting your cookie consent. Cookiebot stores anonymised consent records; see the Cookiebot privacy policy for the full processor terms.

4. reCAPTCHA + Data Privacy Framework disclosure

The newsletter and contact forms are protected by Google reCAPTCHA v3, which loads on first form interaction. reCAPTCHA collects an IP address and browser fingerprint to score the request — this data may be transferred to Google in the United States. The transfer relies on the UK Extension to the EU-US Data Privacy Framework (in force 12 October 2023) under UK GDPR Article 46 / DPA 2018 Schedule 21, supplemented by Standard Contractual Clauses where applicable. See the Google Privacy Policy for the full processor terms.

5. httpbin.org/post placeholder note

During initial deployment phase, form submissions are routed to a public mock endpoint (httpbin.org/post) for testing only and are not stored. The site operator will replace this endpoint with a private form-handler before production use. Once the operator has wired a real endpoint, this paragraph will be replaced with the operator's processor disclosure for that endpoint.

6. Data protection measures

The site is HTTPS-only. Form submissions transit over TLS. Stored data is held by our hosting provider in the United Kingdom or European Economic Area. Internal access to subscriber and contact-form data is limited to the editorial team (currently three people).

7. Sharing data with third parties

We do not share your data with any of the bookmakers listed on this site. Necessary processors (Cookiebot, Google reCAPTCHA, our hosting provider) are documented in §3-§5 above. Where the law requires disclosure (e.g. court order, request from the UK Information Commissioner's Office or the UK Gambling Commission), we will comply with the request and notify you where lawful to do so.

8. Your rights as a data subject

Under UK GDPR you have the right to: access, correct, delete (right to erasure), restrict processing, port (data portability), and object to processing of your data. Email info@shesaftir.digital to make a request. You can also complain to the UK Information Commissioner's Office at ico.org.uk — the regulator for UK data protection.

9. How long we keep it

  • Newsletter subscriptions: until you unsubscribe.
  • Contact-form submissions: 24 months from last reply, then deleted.
  • Server logs: 30 days.

10. Contact

Editor-in-chief and responsible officer: Okan Olgun. Shesaftir Editorial, 12 Sandyford Court, Newcastle upon Tyne NE2 1RT. Email info@shesaftir.digital.