Who is responsible for your data
The controller of your personal data is JG INVEST P.S.A. (prosta spółka akcyjna), ul. Jana Matejki 2, 32-600 Oświęcim, Poland, KRS 0000915798, NIP 5492463888, REGON 389702924. Contact: hello@tillradar.co.uk.
UK representative under Article 27 UK GDPR: to be appointed before TillRadar’s public launch. Details will be published here.
What we collect and why
| Data | Purpose | Legal basis | How long |
|---|---|---|---|
| Your email address, the consent text you agreed to, the date and the page you signed up on | Sending The Radar newsletter, proving consent | Consent (Article 6(1)(a) UK GDPR) | Until you unsubscribe, then the consent record for up to 3 years as evidence |
| Server logs: IP address, browser, pages requested, time | Keeping the site secure and working; counting visits as daily totals (no IP addresses kept in the totals) | Legitimate interests (Article 6(1)(f)) | Rotated by the hosting server, normally within weeks |
| Offer reminders: your email address, the offer, the days before its end you chose, the consent text and date | Emailing you before an offer you picked ends | Consent (Article 6(1)(a)) | Unconfirmed requests: 7 days. Sent or expired reminders: 30 days. You can cancel any time from the link in each email |
| Comments: what you write, the name you give (optional; we show “Reader” if you leave it empty), the page and the time; your email address only if you enter it; a keyed one-way hash of your IP address, never the address itself | Publishing the discussion under our guides, answering questions, keeping out spam and abuse; the email only to send the reply notifications you ask for and to recognise a returning commenter when we moderate | Legitimate interests (Article 6(1)(f) UK GDPR) in running a useful discussion; reply notifications: consent (Article 6(1)(a)) | Comments: until you ask us to remove them, or we remove them under our discussion rules. IP hash: 180 days, then erased. Spam: deleted after 30 days. Reply notifications: until you unsubscribe; unconfirmed addresses are deleted after 14 days |
| Connected apps (AI assistants you authorise to manage your reminders): your email, the app’s name, the permission you granted; access codes are stored only as one-way hashes | Letting an app you chose read and change your own reminders | Contract (Article 6(1)(b)), at your request | Until you disconnect the app on the “Your connected apps” page; inactive sign-ins expire after 30 days, every sign-in after 90 days |
| Messages you email us | Replying to you | Legitimate interests | Up to 2 years after the conversation ends |
Comments. You can comment without giving a name or an email address. If you give a name, it is shown with your comment; your email address is never shown and is used only if you tick “Email me when someone replies”: we then send one email asking you to confirm the address, and after that a notification when someone replies, each with a one-click unsubscribe link. It is not a newsletter sign-up and we do not use it for marketing. We do not store your IP address with a comment, only a keyed one-way hash of it, which lets us stop floods and repeated spam and is erased after 180 days. We do not use Gravatar or comment cookies. If you post, your browser keeps the name and email you typed in its own local storage, on your device only, so the form is filled in next time. “Helpful” votes and reports are counted with a hash of your IP address and browser made with a key that changes every day, so they cannot be linked from one day to the next. If you report a comment, we keep the reason and the details you write; the email you give for a receipt is deleted after 180 days. Comments without an email address, and the first comment from each address, are checked by hand before they appear. To have your comment corrected or removed, email hello@tillradar.co.uk. Notification emails are sent by Twilio SendGrid (see below).
With your consent (cookie banner), we use Google Analytics 4 to measure which pages and offers are useful: pages viewed, clicks on provider links, approximate location and device type. Legal basis: consent (Article 6(1)(a) UK GDPR and regulation 6 PECR). Google Signals and advertising features are switched off. See Cookies.
Without cookies and without your consent, we also count visits without identifying you. When a page loads, our script asks our own server for two tiny files: /tr-hit.txt (once per page view) and /tr-ev.txt (when you scroll through a page, spend time on it, see or click an offer, sign up for The Radar, ask for a reminder, make a cookie choice, or when the page hits a script error). These requests carry only the event, a rounded value such as “50% read” or the provider’s name, and the page address. They contain no identifier, store nothing on your device and are not shared with anyone. They appear in our server logs like any other request (see the server logs row above), and we use those logs for this count as well. Every 30 minutes a script on our server turns the logs into daily totals per page, without IP addresses or browser details, and only these totals are kept. Legal basis: legitimate interests (Article 6(1)(f) UK GDPR) in knowing which pages and offers are useful. You can object at any time by emailing us, and we will exclude your connection from the count.
We do not use advertising cookies, and we do not sell or share your data for marketing.
Who processes it for us
- Hosting: Aderlo Cloud (ADERLO PSA, Poland), on servers operated by Hetzner Online GmbH in Germany.
- Email delivery: Twilio SendGrid (Twilio Inc., USA) sends the confirmation email, the newsletter and comment reply notifications. Transfers to the USA rely on the UK Extension to the EU–US Data Privacy Framework.
- Mailing list: NetSendo, run by us on Google Cloud infrastructure, holds confirmed subscribers.
- Analytics (only with consent): Google Analytics 4, Google Ireland Limited.
Germany and Poland are in the European Economic Area, which the UK recognises as providing adequate protection for personal data.
Sign-ups that are not confirmed within 7 days are deleted.
Your rights
You can ask for a copy of your data, ask us to correct or delete it, object to processing based on legitimate interests, and withdraw consent at any time (for the newsletter, use the unsubscribe link or email us). You can complain to the Information Commissioner’s Office at ico.org.uk.