Privacy notice

Data collected on this site

The Non-GamStop Ledger is an information site. It does not run user accounts, it does not process payments, it does not host a comment system and it does not operate a login page. Where a visitor arrives on the site the visitor's browser makes a standard HTTP request that includes the IP address, the user-agent string, a referrer header where the browser sends one and the URL requested. The web server records that request in an access log for the purpose of ensuring the site loads correctly, for diagnosing errors and for detecting automated traffic patterns that would otherwise degrade the site for other visitors. No further personal data is required to read a page, no cookie is set that identifies the visitor personally and no third-party marketing script runs on the pages that make up the content of the site.

Where a visitor sends an email to the editor at [email protected], that email is processed for the purpose of responding to the correspondence. The email contains the sender's address, whatever the sender has written and any attachment the sender has chosen to include. The correspondence is retained for the period necessary to answer the enquiry and for the record-keeping period the site's editorial policy identifies. No other data is collected on the site, and no data is shared with any third party for a marketing purpose.

Cookies and analytics

The Non-GamStop Ledger uses a minimal cookie set. A first-party session cookie is used to remember any accessibility preference a visitor has selected during a browsing session, and this cookie is cleared at the end of the session. No advertising cookie is set on the site, no cross-site tracking cookie is set on the site and no cookie is used to profile the visitor for the purpose of behavioural targeting. The Privacy and Electronic Communications Regulations 2003 as amended, together with the UK GDPR and the Data Protection Act 2018, apply to the cookies used and the site's cookie use is limited to what those regulations describe as strictly necessary.

Where the site collects aggregate readership figures for editorial purposes, it does so through a privacy-respecting analytics arrangement that records only aggregate visit counts, page URLs requested and country-level information derived from the IP address. Individual user profiles are not built. Sessions are not linked across devices. No visitor identifier is exchanged with an advertising network. The purpose of the aggregate data is to allow the editorial team to see which chapters are being read, which are being missed and which release windows drive the largest arrival volumes, so that the update calendar can be aligned to the actual pattern of use.

How long we retain data

Server access logs are retained for a rolling ninety-day period, after which they are automatically deleted from the server. This retention period is sufficient to support diagnostic and security review work and is short enough to minimise the standing exposure of any incidental personal data captured in the request headers. Aggregate analytics figures are retained at the aggregate level for the editorial year and are not retained at any level that would permit an individual visit to be reconstructed. The session cookie referenced in the previous section is cleared at the end of the browsing session and no persistent identifier remains on the visitor's device from the standard content pages.

Email correspondence sent to the editor is retained for the period necessary to answer the enquiry, to record any correction that arises from the correspondence and to demonstrate that a correction has been actioned. Where the correspondent asks for the email to be deleted at the end of the response, the deletion request is actioned. Where the correspondence relates to a formal correction that has been recorded in the site's changelog, the underlying email is retained for the period the editorial policy requires so that the correction can be traced back to the source that raised it, and the retention is confined to that specific purpose.

Your rights under UK GDPR and Data Protection Act 2018

The UK General Data Protection Regulation and the Data Protection Act 2018 give a visitor a set of specific rights over any personal data the site processes about them. The rights include the right of access to any personal data held, the right to rectification of inaccurate personal data, the right to erasure of personal data where the conditions for erasure are met, the right to restrict processing in specific circumstances, the right to data portability where the underlying data has been provided by the individual, the right to object to processing on legitimate interest grounds and the right not to be subject to a decision based solely on automated processing. The site does not carry out automated decision-making in relation to visitors.

The lawful basis for the processing described in this notice is a combination of legitimate interests, being the operation of an information site to a professional standard, and consent where the visitor has provided it, for example by sending an email to the editor. The site does not process special-category personal data as part of ordinary browsing, does not knowingly collect personal data from children under the age of eighteen and applies the same data protection standard to every visitor irrespective of the country the visitor is accessing the site from. Where a right is exercised, the site's response is provided within the statutory response window.

How to reach us and the ICO

To exercise any of the rights described above, or to raise a question about this notice, contact the editor at [email protected]. The editorial team acts as the point of contact for privacy matters and will respond within the statutory response window applicable to the specific right being exercised. Where a request requires further information to identify the personal data held about the requester, the site will ask for that information at the earliest opportunity, and the statutory clock is suspended while the further information is being gathered in the manner set out in the Information Commissioner's guidance.

Where a visitor is not satisfied with the site's response, the visitor has the right to complain to the Information Commissioner's Office. The Information Commissioner's Office is the UK supervisory authority for data protection and its contact details are published at ico.org.uk. A complaint to the Information Commissioner's Office does not depend on the visitor having first exhausted the site's own complaints route, and the visitor can raise a complaint at any point at which they consider that their data protection rights have been breached. This notice is reviewed at each editorial refresh cycle and was last updated on 5 August 2026.