Winsome Planet is a personal website. Reading it asks nothing of you, and I collect as little as I can. This page sets out exactly what that is.
1. Who is responsible
The data controller for winsomeplanet.com is:
- Name: Winsome Planet
- Email: compliance@winsomeplanet.com
- Address: Limerick, Ireland
2. What is collected, and why
- Analytics, only if you allow it. Which pages are read, roughly where from, and on what kind of device, counted in aggregate. It tells me which pieces people read. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
- Messages you send. If you write through the contact form, your name, email address and message arrive as an email to my inbox and are used only to reply. They are not stored in the site's database. Legal basis: legitimate interest in answering you (Art. 6(1)(f)).
- Abuse protection. To stop the contact form being flooded, the site keeps a count of recent messages per IP address. Each count deletes itself within two days. Legal basis: legitimate interest in keeping the site working (Art. 6(1)(f)).
- Server logs. The hosting provider keeps standard request logs (time, page requested, IP address, browser) to operate and secure the site.
- Accounts. Sign-in exists so the site can be administered; there is no reader sign-up. Accounts created for the former trip planner are kept, with what they saved, until their owner deletes them (see section 6). Legal basis: performance of a contract (Art. 6(1)(b)).
No payment details are collected; nothing here is for sale. Nothing is used for advertising.
3. Cookies
Strictly necessary cookies keep the site working. Analytics cookies are set only with your consent in Europe, and you can change your choice at any time from the footer. The Cookie Policy has the details.
4. Who helps run the site
- Amazon Web Services, in its Dublin region: hosting, the database, media storage, sign-in (Cognito) and email delivery for contact messages (SES).
- Cloudflare Turnstile: the check that a contact message comes from a person, not a bot.
- Google (Tag Manager and Analytics 4) and Microsoft Clarity: analytics, only with your consent in Europe.
Where any of these process data outside the European Economic Area, they do so under safeguards approved by the European Commission.
5. How long it is kept
- Contact messages: as long as the conversation needs, then deleted.
- Abuse-protection counts: no more than two days.
- Analytics: as set in Google Analytics, currently two months for user-level data.
- Accounts: until deleted.
6. Your rights
Under the GDPR you can ask to access, correct, erase, restrict or move your personal data, object to its use, and withdraw consent at any time. If you have an account you can download or delete it yourself on your account page. For anything else, see how to make a GDPR request. You can also complain to Ireland's Data Protection Commission.
7. Changes
If this policy changes, the date at the top changes with it.