Privacy Policy
Last updated: 29th October 2026
This policy explains how The London Review handles personal data. It covers readers of our website, subscribers to our newsletter, and anyone who registers interest in our Junior Researcher Mentorship Programme. The only personal data we collect is what you choose to give us through one of those forms. The London Review is the data controller for that information. If you have any questions, you can reach us at hello@thelondonreview.org.uk.
If you separately choose to interact with forms.thelondonreview.org.uk, for example to join one of our programmes, to give consent as a parent or guardian, or to respond to a survey we are running, that is covered by its own notice at forms.thelondonreview.org.uk/privacy.
The newsletter
What we collect
When you sign up for the newsletter we collect your first name and email address. That is all. We do not require an account, and we do not collect any other personal information from you to run the newsletter.
Why we use it, and our lawful basis
We use your name and email solely to send you The London Review newsletter. Our lawful basis under UK GDPR is your consent: you opt in by submitting the signup form, and we use a double opt-in, so we only add you once you confirm via the link in our confirmation email. We do not use your data for any other purpose, and we never sell it or share it with third parties for their own purposes.
Who processes it
We send the newsletter using beehiiv, which acts as our data processor: it handles your data only on our instructions, to deliver the newsletter. beehiiv stores subscriber data on Amazon Web Services servers in the United States. That international transfer is covered by beehiiv’s Data Processing Addendum, including Standard Contractual Clauses and a UK addendum. beehiiv in turn relies on its own sub-processors (such as AWS for hosting), bound by equivalent obligations. To operate the newsletter, beehiiv may record whether emails are delivered, opened, or have their links clicked.
How long we keep it
We keep your details for as long as you remain subscribed. You can unsubscribe at any time using the link in any newsletter email, after which you are removed from the list. If our newsletter account is ever closed, beehiiv deletes the associated personal data within 30 days, except where the law requires it to be kept longer.
The Mentorship Programme interest form
While applications to our Junior Researcher Mentorship Programme are closed, the programme page has an interest form where you can ask us to email you when they reopen. Everything in this section applies to that interest form only, and to nowhere else on the site. It is separate from the newsletter: registering does not subscribe you, and the interest form’s newsletter box is optional and starts unticked.
What we collect
Your name, your email address, the year you complete your A levels (or their equivalent), and any comments you choose to add. We also record when you registered and when you last updated your details.
Why we use it, and our lawful basis
We use your details only to email you about joining The London Review: to tell you when Junior Researcher applications reopen or, if you have left school by then, about applying to join us as a researcher. We use the year you give us to work out which of those is relevant to you. Our lawful basis under UK GDPR is your consent, which you give by submitting the interest form and can withdraw at any time by asking us to delete your details.
Who can see it
Only members of The London Review’s team who run the programme and the website. We do not share your details with anyone outside the team, we never sell them, and we do not use them for any other purpose. If you tick the newsletter box, your name and email address are also passed to beehiiv, exactly as if you had used the newsletter signup, and the newsletter section above applies to them from then on.
Who processes it
Your details are stored in our own database, which is hosted by Turso, and our website runs on Cloudflare. Both act as our data processors and handle your data only to provide those services to us. The database is stored on Amazon Web Services servers in Ireland, which UK data protection law recognises as giving adequate protection. Cloudflare runs a global network, and its data processing terms include safeguards for any transfer of your data outside the UK.
Spam protection on the interest form
To stop automated spam, the interest form uses Cloudflare Turnstile. Turnstile runs on the interest form and nowhere else on this site, and it only starts once you begin filling the interest form in: reading the programme page, or any other page, does not start it. It looks at technical signals from your browser, such as your IP address and browser type, to tell people from bots, and most people never see it. Cloudflare processes those signals to protect the interest form, and also uses them to improve Turnstile, for which it is responsible under its own privacy notice. Our lawful basis for using Turnstile is our legitimate interest in keeping the list free of spam and abuse.
Turnstile may store or read a small amount of information in your browser to check that you are not a bot. This happens only once you start using the interest form, and only because it is strictly necessary to accept your registration safely, which is why it needs no consent banner.
How long we keep it
Until the end of the calendar year after the year you told us you complete your A levels. If you finish in 2027, for example, your details are deleted automatically at the end of 2028. That covers our programme rounds while you are at school and our researcher round in your first year at university. You can ask us to delete them sooner at any time, and we will. Our database is backed up every night and backups are kept for 90 days, so a deleted entry disappears from the backups within 90 days as well.
Cookies
We use no cookies on this site. Not for analytics, not for advertising, not for cross-site tracking, and the newsletter signup sets none either. We also store nothing else on your device: no local storage, no session storage. That is why you have not been shown a cookie banner: the rules that require one apply to storing or reading information on your device, and we do neither. The single exception is the spam check on the Mentorship Programme interest form, explained in that section, which runs only if you use that form.
Audience measurement
We count how many pages are read and how many visits they came from, because we would otherwise have no idea whether anyone is reading our work. We do this ourselves rather than handing it to an analytics company, and we have designed it to keep as little as possible.
When you open a page, our server records the path and, from information your browser sends with every request anyway, your country, your browser and device type, your browser’s language, and the site that linked you here. These are stored as counts, not as a record of your visit. Nothing in them can be traced back to you.
To tell one visit from another we need some way of recognising that two page views came from the same person, and the only thing available for that is your IP address. We do not store it. It is combined in memory with your browser’s user-agent string and a random secret that we generate fresh every day, and turned into an irreversible fingerprint. Only that fingerprint is saved, and only for up to 48 hours, after which both it and the day’s secret are deleted. Once the secret is gone the fingerprint cannot be turned back into an IP address by us or by anyone else, because the information needed to do so no longer exists. Because the secret changes daily, we also cannot tell that someone who visits today is the same person who visited yesterday.
We do not build profiles, track you across other websites, sell or share any of this, or use it for advertising. There is no third-party analytics script on this site. Until September 2026 we used a privacy-focused external service called counter.dev; we have removed it and now do this ourselves.
Our lawful basis for the brief processing of your IP address is legitimate interests: knowing the size and shape of our readership so we can run the publication. We have weighed that against your privacy: the processing is momentary, the result cannot identify you, nothing is shared, and there is no realistic way this affects you. If you disagree, you have the right to object, and you can do so using the contact details below.
Your rights
Under UK GDPR you have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to its processing, and to data portability. You can also withdraw your consent at any time: unsubscribing does this for the newsletter, and asking us to delete your details does it for the Mentorship Programme list. To exercise any of these rights, email us at hello@thelondonreview.org.uk.
Complaints
If you have a concern about how we handle your data, please contact us first so we can help. You also have the right to complain to the UK Information Commissioner’s Office at ico.org.uk.
Changes to this policy
We may update this policy from time to time. Any changes will appear on this page with a revised date above.