The BristolStakes data chamber — what the desk holds, why it holds it, and how to take it back

Who keeps the records — the data controller

The data controller for this publication is BristolStakes, a company registered in England and Wales (company number on file; available on request from the ICO register and from the desk directly). The desk operates this website and is the sole party that determines how your personal data is collected and used in the course of visiting these pages.

You may direct any data-protection question, subject access request, or erasure demand to the desk at: [email protected]. The desk does not currently operate a separate Data Protection Officer but will designate one should the volume of data processed require it under Article 37 UK GDPR.

Correspondence by post should be addressed to: BristolStakes Editorial, Editorial offices, Bristol, England. The full registered address is available on request.

What the desk collects from you

This desk operates a deliberately lean data posture. The following is a complete account of what is collected, under what circumstances, and how it is held.

Analytics data (conditional on consent)

If you accept analytics cookies via the cookie consent bar on your first visit, this site passes anonymised behavioural data to Google Analytics 4. This includes: pages visited, approximate session duration, the device category and screen resolution used, the country from which you visit (not more granular than country unless you are in a region where city-level data is available to Google), and the referring source that brought you to the desk. IP addresses are anonymised before storage. No cross-site tracking profile is maintained by the desk itself; Google Analytics operates under its own terms and data-processing agreement with us.

If you accept analytics cookies and subsequently withdraw consent, data collection stops from that point forward. Already-collected anonymised data cannot be retrospectively removed from the aggregate dataset because it is not linked to any individual identifier on our side.

Contact form submissions

The contact form on the press enquiries page collects: your name (optional), your email address (required for a response), and the text of your message. This information is held in the desk's secure correspondence file and used solely for the purpose of responding to your enquiry. It is not shared with third parties, not used for marketing, and not added to any mailing list.

Cookie preference records

When you make a choice in the cookie consent bar — whether to accept all cookies, accept necessary only, or adjust the individual toggles — that preference is stored in your browser's local storage under the key bristolstakes-x7s_consent. This record does not leave your device and is not transmitted to any server. It exists solely to ensure the desk does not show you the consent bar on every page load once you have made a decision.

What the desk does not collect

The desk does not collect your name, address, date of birth, financial information, government-issued identifiers, or any other category of personal data except as described above. There is no user account system on this site; no passwords are held. The desk does not knowingly collect data from anyone under the age of eighteen — see the section on adults-only requirements below.

The desk's lawful basis for keeping these records

Every processing activity must rest on a lawful basis under Article 6 UK GDPR. The desk's activities and their respective bases are as follows.

Analytics processing rests on your consent (Article 6(1)(a)). You are not required to provide it; the site functions fully if you decline analytics cookies. Consent is granular — you may accept analytics without accepting marketing — and is freely withdrawable at any time via the cookie settings button in the footer or by clearing your browser's local storage.

Contact form submissions are processed on the basis of legitimate interests (Article 6(1)(f)) — specifically the desk's legitimate interest in responding to editorial, press, and reader enquiries, balanced against your interest in having your communication handled responsibly and in confidence. If you submit a request for data deletion or a subject access request via the form, that processing is additionally grounded in Article 6(1)(c) (legal obligation to comply with UK GDPR rights).

Cookie preference storage in your browser's local storage is a strictly necessary technical function and requires no lawful basis under UK GDPR as it does not constitute processing of personal data transmitted to a controller — it stays on your device.

Your rights under UK GDPR — the full catalogue

The United Kingdom General Data Protection Regulation and the Data Protection Act 2018 confer the following rights on you. Each is described plainly, not in the attenuated form that data controllers sometimes prefer.

The right of access (Article 15)

You may ask the desk to confirm whether it holds personal data about you, and if so, to provide you with a copy of that data and information about how it is used. The desk will respond within one calendar month of receiving a valid request. There is no charge for a first request. Write to [email protected] with the subject line "Subject Access Request".

The right to erasure (Article 17 — the "right to be forgotten")

You may request that the desk delete personal data it holds about you. This right applies where: the data is no longer necessary for the purpose it was collected; you withdraw the consent on which processing was based; you object to processing and there is no overriding legitimate interest; the data was unlawfully processed. The desk will action erasure requests within one calendar month. Note that where data has already been anonymised and aggregated (as with consented analytics), individual erasure may be technically impossible — the desk will confirm this in its response if applicable.

The right to rectification (Article 16)

If personal data held about you is inaccurate or incomplete, you may ask the desk to correct it. Contact form content, for instance, is held as you submitted it; if you submitted incorrect information and wish to have it amended in the correspondence record, the desk will make that correction.

The right to data portability (Article 20)

Where processing is based on your consent and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format (typically JSON or CSV) and to transmit it to another controller. Given the limited personal data this desk holds, portability requests will principally relate to contact form data.

The right to restriction of processing (Article 18)

You may ask the desk to pause processing of your personal data in certain circumstances — for example, while you contest the accuracy of data held, or while an objection is being considered. During a restriction period, the desk will store but not actively use the relevant data.

The right to object (Article 21)

Where processing is based on legitimate interests, you may object to that processing. The desk will cease processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or unless processing is necessary for the establishment, exercise, or defence of legal claims.

The right to lodge a complaint

If you are dissatisfied with how the desk handles your data or responds to a rights request, you have the right to complain to the Information Commissioner's Office. The ICO's website is ico.org.uk; their helpline is 0303 123 1113.

How long the desk keeps records

The desk operates defined retention periods tied to the purpose for which each category of data was collected. No data is kept beyond what is necessary for that purpose.

• Contact form correspondence — retained for a maximum of twelve months from the date of last communication in the thread, then securely deleted. If the correspondence relates to a legal matter (a complaint, a correction dispute, or a subject access request), it is retained for the duration of that matter plus one further year.
• Google Analytics data (consented) — data retention within Google Analytics is set to twenty-six months from the date of collection. After that window, event-level data is deleted automatically by Google's platform. The desk reviews this setting annually.
• Cookie preference records — stored in your browser's local storage for twelve months, after which the consent bar will reappear on your next visit to invite a fresh choice.

Third parties and processors the desk uses

The desk maintains a strict policy of minimising third-party data sharing. The following is a complete list of third parties that may receive personal data as a result of your visit to this site.

Google LLC, operating Google Analytics 4, receives anonymised behavioural data if you have consented to analytics cookies. Google acts as a data processor under a Data Processing Addendum signed with the desk. Google's data processing and privacy terms are available at policies.google.com/privacy.

No other third party receives data from this site. There are no advertising networks, retargeting platforms, social media pixels, or audience-enrichment services deployed here — not because the desk could not monetise such arrangements, but because they are not consistent with the editorial posture the desk has chosen to maintain.

International transfers — where the records travel

Google LLC is headquartered in the United States, which means that data transferred to Google Analytics may be processed outside the United Kingdom. This transfer is governed by Google's use of the UK's International Data Transfer Agreement (IDTA) and the EU Standard Contractual Clauses where applicable, ensuring that the data receives a level of protection equivalent to that required under UK GDPR. The desk has reviewed and is satisfied with these mechanisms.

No other international data transfer takes place in connection with this site. Contact form correspondence is held on servers located within the United Kingdom.

Adults-only requirement — the desk does not address content to children

This website carries information about sports wagering, which is a licensed activity restricted to adults aged eighteen and over in the United Kingdom. The desk does not knowingly collect, process, or retain personal data from individuals under the age of eighteen. If you are under eighteen, please leave this site.

If the desk becomes aware that it has inadvertently received personal data from a person under the age of eighteen — for example, through a contact form submission — it will delete that data promptly and without retaining any record of it beyond what is necessary to confirm the deletion has taken place.

Parents and guardians who believe that a child under their care has submitted information to this site should contact the desk immediately at [email protected] and the data will be removed within twenty-four hours of receipt of the notification.

How this notice is revised — keeping the record honest

This privacy notice is reviewed at least annually and updated whenever there is a material change to the desk's data-processing activities. The date at the top of this page reflects the most recent revision. A "material change" means the introduction of a new category of data collected, a new third-party processor, a new lawful basis, or a significant change to retention periods.

When a material change occurs, a prominent notice will be displayed on the homepage and on this page for a minimum of thirty days following the update, drawing attention to the nature of the change. Minor amendments — corrections of grammar, clarification of existing practice without substantive change — will be made without a formal notice but will be reflected in the revised date above.

Archived versions of this notice are available on request from [email protected]. The desk believes that a reader should always be able to compare the current notice with the one in force at the time they first visited this site.