Privacy Policy

Last updated: the 14th of October 2025

1) Who we are

“The Leeds Lantern” (the Site) is operated by Cogio LTD (referred to as we, us, or our).

  • ICO registration number: ZB768902
  • Contact for privacy queries: dataprotection@cogio.co.uk

We are the data controller of personal data processed via this Site.

2) What this policy covers

This Privacy Policy explains what personal data we collect, how and why we use it, who we share it with, how long we keep it, your rights, and how to contact us. It applies to use of this Site, including our contact form and Business Directory registration area.

3) What we collect

We collect and process the following categories of data:

  • Contact and enquiry data – details you submit via our contact form (e.g., name, email, message).
  • Directory account and listing data – details you provide when you register or add/manage a business listing (e.g., name, email, username, password (encrypted and not readable by us), business profile, images).
  • Content you publish or send us – news tips or materials you submit for publication.
  • Technical and usage data – IP address, device identifiers, pages viewed, links clicked, time spent, and similar, collected via our Site and cookies/consent tools.
  • Log and security data – server logs, firewall/anti-spam signals (e.g., to protect forms from automated abuse).
  • Marketing preferences – if you opt in to receive updates (where offered).

If you comment on articles or upload media, we will process the data you provide and any metadata attached.

4) How we get your data

  • Directly from you when you fill in forms, register for the directory, send us emails, or submit stories.
  • Automatically via cookies/consent tools and similar technologies (see Cookies below).
  • From publicly available sources (e.g., business information you deliberately publish in your listing).

5) Why we use your data (lawful bases)

We use your data for the following purposes under UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (as amended by the Data (Use and Access) Act 2025 (“DUAA”), parts of which are being commenced in stages):

  • To operate the Site and provide our services (running the news site, hosting, security, form handling, user accounts, and directory listings).
    • Lawful bases: contract (where you create an account or submit a listing); legitimate interests (for operating a secure, functional website); consent (where required for cookies or optional features).
  • To respond to enquiries you send via our contact form.
    • Lawful bases: legitimate interests (responding to your request) and/or contract (pre-contract steps, if relevant).
  • To publish user-submitted content and administer the directory (including public display of business details you choose to publish).
    • Lawful bases: contract; legitimate interests (publishing and maintaining a business directory).
  • Analytics and Site improvement.
    • Lawful bases: consent via our cookie banner for non-essential tracking. Where a DUAA/PECR exemption for certain low-risk first-party analytics or appearance/performance cookies applies and is in force, we may rely on legitimate interests without consent; otherwise we seek consent.
  • Marketing (if offered, e.g., newsletters).
    • Lawful bases: consent (electronically, under PECR’s rules) or soft opt-in for similar products/services to existing customers, where lawful.
  • Safety, security and anti-abuse (detecting and preventing spam/bot activity, safeguarding system integrity).
    • Lawful bases: legitimate interests (network and information security).
  • Legal and regulatory compliance, including handling rights requests or complaints.
    • Lawful bases: legal obligation.

Note on DUAA 2025: UK data protection and PECR rules are being updated in phases. We will rely on DUAA changes (e.g., new cookie exemptions and “recognised legitimate interests”) only once the relevant provisions are in force and applicable. We will keep this policy and our consent banner in line with ICO/GOV.UK guidance.

6) Cookies and similar technologies

Our Site uses a consent interface labelled “Manage Cookie Consent” with categories including Functional, Preferences, Statistics and Marketing. You can accept, deny, or set preferences, and you can update your choices at any time via the same link in the footer/banner. Essential cookies run to make the Site work; non-essential cookies only run with your consent, unless a lawful exemption applies under PECR as amended. For details of specific cookies, retention and vendors, please see our cookie policy or the details surfaced via the consent interface.

7) Sharing your data

We share personal data where necessary with:

  • Service providers / processors, under contract, such as:
    • Website hosting and security: Cogio LTD
    • Analytics: Google
  • Advertising/embedded content providers (only if enabled and consented), e.g., ad networks such as Google or embedded media (Google maps, Youtube videos, social media platforms).
  • Professional advisers (legal/accounting) and authorities where required by law.

We do not sell your personal data.

8) International transfers

Some providers may be outside the UK (or outside the UK/EEA). Where we transfer data internationally, we put in place appropriate safeguards, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, plus any additional measures recommended by the ICO.

9) How long we keep data (retention)

We keep personal data only as long as needed for the purposes set out above, and as required by law. Typical periods are:

  • Enquiries (contact form): 12 months
  • Directory accounts/listings: for as long as the account/listing is active, then 24 months after closure for record-keeping and dispute handling
  • Server logs and security records: up to 12 months
  • Analytics data: 24 months
  • Marketing lists: until you unsubscribe or your address bounces, plus 6 months in suppression lists

10) Your rights

Under UK data protection law, you have rights to:

  • Access your personal data
  • Rectify inaccurate or incomplete data
  • Erase data (in certain cases)
  • Restrict or object to processing (including any direct marketing)
  • Portability (receive your data in a structured, commonly used format)
  • Withdraw consent at any time (where processing is based on consent)
  • Lodge a complaint with the Information Commissioner’s Office (ICO): ico.org.uk, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

To exercise your rights, please contact dataprotection@cogio.co.uk. We may need to verify your identity before responding.

11) Children

Our Site is aimed at a general audience. We do not knowingly collect personal data from children without appropriate consent. If you believe a child has provided us with personal data without consent, please contact us and we will delete it.

12) Security

We use technical and organisational measures appropriate to the risk, including secure hosting, access controls, encryption in transit (HTTPS), and logging/monitoring to maintain the confidentiality, integrity and availability of personal data.

13) Editorial and user content

If you submit stories, comments, or directory listings, you are responsible for ensuring the content does not include personal data you do not wish to be public. Business directory details you choose to publish may be visible to the public on the Site and discoverable via search engines. You can edit or remove your listing by logging in to your account or by contacting us.

14) Third-party links and embedded content

Our articles may link to third-party websites or include embedded content (e.g., videos, maps, social media posts). Those sites may collect data about you, use cookies, or monitor your interaction in line with their own privacy policies. Please review their privacy information before engaging.

15) Direct marketing

If we offer newsletters or similar updates, we will only send electronic marketing with your consent (or under the soft opt-in where permitted). You can unsubscribe at any time. The DUAA recognises certain examples of legitimate interests (including direct marketing) in UK GDPR; we will follow current ICO/GOV.UK guidance and PECR rules when relying on any such provisions.

16) Automated decision-making / profiling

We do not carry out decisions producing legal or similarly significant effects based solely on automated processing. If we ever introduce such features, we will provide clear information and your rights.

17) How to manage cookies

You can review or change your cookie choices at any time via “Manage Cookie Consent” in the Site footer/banner. You can also control cookies in your browser settings. For full details of cookie types, purposes and retention, see our cookie policy or the consent tool’s vendor list/details.

18) Changes to this policy

We may update this policy to reflect changes in our processing, the Site, or the law (including DUAA commencement schedules). Significant changes will be highlighted on this page with an updated “Last updated” date. For government timing on DUAA commencement and scope, see GOV.UK/ICO materials.

19) Contact us

Questions about this policy or your data?
Email: dataprotection@cogio.co.uk