Privacy Policy

Last updated: April 2026

This Privacy Policy explains how [SToC Framework / your legal name or organisation name] collects, uses and protects personal information when you use this website: https://stoc.org.uk/.

This website is used to publish information, research commentary, SToC Framework materials, analysis posts, journal-related updates and teaching resources.

This policy is intended to meet the transparency requirements of the UK GDPR and Data Protection Act 2018. The Information Commissioner’s Office states that privacy information should explain who you are, how people can contact you, why you use personal data, your lawful basis, retention periods, sharing, and individual rights.

1. Who we are

The data controller for this website is:

[Your name / organisation name]
Website: https://stoc.org.uk/
Email: [insert contact email]

For privacy-related questions, requests or concerns, please contact:

[insert privacy contact email]

2. What personal information we collect

We may collect the following types of personal information:

Information you provide directly

This may include:

your name
email address
message content submitted through a contact form
comments or contributions submitted to the website
any information you choose to send by email

Technical information collected automatically

When you visit the website, some technical information may be collected automatically, including:

IP address
browser type and version
device type
operating system
pages visited
date and time of visit
referring website
approximate location based on IP address
cookie and analytics data, where applicable

WordPress account information

If user registration, contributor accounts or editor access are enabled, we may collect:

username
email address
display name
role or permission level
login activity
content created or edited through WordPress

3. How we use your information

We use personal information for the following purposes:

Purpose	Personal data used	Lawful basis
Responding to enquiries	Name, email address, message content	Legitimate interests or consent
Operating and securing the website	IP address, technical logs, device/browser data	Legitimate interests
Managing comments or user submissions	Name, email, comment content, IP address	Legitimate interests
Managing WordPress user accounts	Username, email, role, login activity	Legitimate interests or contract
Sending updates, if you subscribe	Name, email address, preferences	Consent
Improving website content and performance	Analytics and usage data	Legitimate interests or consent, depending on cookie settings
Complying with legal obligations	Relevant records and communications	Legal obligation

We do not sell personal information.

4. Cookies and analytics

This website may use cookies and similar technologies.

Cookies may be used to:

make the website function properly
remember user preferences
support WordPress login and security features
measure website traffic and performance
understand which content is most useful to visitors

Where cookies are not strictly necessary, we will seek consent where required. The ICO explains that visitors should be told when cookies are used, what they do, and that consent is needed for cookies that are not strictly necessary.

You can usually control cookies through your browser settings.

A separate Cookie Policy may provide more detail about specific cookies used on this site.

5. Comments and user-generated content

If comments are enabled, WordPress may collect the information shown in the comments form, together with the visitor’s IP address and browser user agent string to help detect spam.

Any information you publish in a comment may become publicly visible. Do not submit personal, confidential or sensitive information in public comments.

6. Embedded content from other websites

Pages or posts on this website may include embedded content, such as videos, images, social media posts or articles.

Embedded content from other websites behaves as though you visited that external website directly. Those websites may collect data about you, use cookies, embed additional third-party tracking and monitor your interaction with the embedded content.

Examples may include:

YouTube or Vimeo videos
X/Twitter posts
LinkedIn content
academic publication platforms
news articles
aviation or safety-related websites

You should review the privacy policies of those external websites.

7. Who we share personal information with

We may share limited personal information with trusted service providers where necessary to operate the website. These may include:

website hosting providers
WordPress theme or plugin providers
website security tools
analytics providers
spam protection providers
email or contact form providers
backup providers

We only share information where necessary and appropriate.

We may also disclose information if required by law, regulation, court order, legal process or to protect the security of the website.

8. International transfers

Some website services, plugins, analytics tools or hosting-related providers may process data outside the United Kingdom.

Where this happens, we will rely on appropriate safeguards where required, such as adequacy regulations or approved contractual protections.

9. How long we keep your information

We keep personal information only for as long as necessary.

Typical retention periods are:

Type of information	Retention period
Contact form enquiries	Up to 24 months unless longer retention is needed
Email correspondence	Up to 6 years where relevant to professional, academic or legal records
Website analytics	According to the analytics provider’s retention settings
Comments	For as long as the relevant post remains published, unless removed earlier
WordPress user accounts	For as long as the account is active or needed for site administration
Security logs	Usually short-term, unless needed to investigate misuse or security issues

10. Your rights

Under UK data protection law, you may have the right to:

request access to your personal information
request correction of inaccurate information
request deletion of your information
request restriction of processing
object to processing
withdraw consent where processing is based on consent
request data portability in certain circumstances
complain to the Information Commissioner’s Office

The ICO notes that privacy notices should tell people about their information rights and how they can complain if they have concerns.

To exercise your rights, contact:

[insert privacy contact email]

11. Complaints

If you are unhappy with how we handle your personal information, please contact us first so we can try to resolve the issue.

You also have the right to complain to the Information Commissioner’s Office:

Information Commissioner’s Office
Website: https://ico.org.uk/
Telephone: 0303 123 1113

12. Security

We take reasonable steps to protect personal information from loss, misuse, unauthorised access, disclosure, alteration or destruction.

However, no website or internet transmission is completely secure. You should avoid sending highly sensitive information through website forms unless specifically requested and appropriately protected.

13. Children

This website is intended for general educational, academic and professional audiences. It is not aimed specifically at children.

If we become aware that personal information has been collected from a child without appropriate consent, we will take reasonable steps to delete it.

14. Links to other websites

This website may link to external websites. We are not responsible for the privacy practices, content or security of external websites.

You should read the privacy policy of any external website you visit.

15. Changes to this policy

We may update this Privacy Policy from time to time.

The latest version will always be available on this page. If material changes are made, we may take additional steps to bring them to your attention.

If you upload images to the website, you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the website can download and extract any location data from images on the website.

Contact forms

Cookies

If you leave a comment on our site you may opt in to saving your name, email address and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies will last for one year.

If you visit our login page, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.

When you log in, we will also set up several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select “Remember Me”, your login will persist for two weeks. If you log out of your account, the login cookies will be removed.

If you edit or publish an article, an additional cookie will be saved in your browser. This cookie includes no personal data and simply indicates the post ID of the article you just edited. It expires after 1 day.

Embedded content from other websites

Articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.

These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.

Analytics

Who we share your data with

How long we retain your data

If you leave a comment, the comment and its metadata are retained indefinitely. This is so we can recognise and approve any follow-up comments automatically instead of holding them in a moderation queue.

For users that register on our website (if any), we also store the personal information they provide in their user profile. All users can see, edit, or delete their personal information at any time (except they cannot change their username). Website administrators can also see and edit that information.

What rights you have over your data

If you have an account on this site, or have left comments, you can request to receive an exported file of the personal data we hold about you, including any data you have provided to us. You can also request that we erase any personal data we hold about you. This does not include any data we are obliged to keep for administrative, legal, or security purposes.