Privacy Policy

01 — Controller

Who is responsible for your information?

For the purposes of the EU General Data Protection Regulation (“GDPR”), the data controller for this website is:

Questions, privacy requests, and objections relating to the processing described in this policy may be sent to the address above.

02 — Information collected

What information may be collected?

You are not required to provide personal information simply to read the public pages of this website.

03 — Purposes and legal bases

Why is information used?

Newsletter delivery

Your email address is used to send the dispatches, publication news, essays, fragments, and related updates that you requested. The legal basis is your consent.

Responding to communications

Information submitted by email is used to respond to your enquiry, manage correspondence, and take steps requested by you. Depending on the context, the legal basis is consent, steps taken at your request, or the legitimate interest in handling genuine correspondence.

Security and abuse prevention

Limited technical information may be used to protect the website, prevent automated abuse, diagnose errors, maintain service integrity, and establish or defend legal claims. The legal basis is the legitimate interest in operating a secure and reliable website.

Personal information is not sold. Newsletter information is not used for third-party advertising or unrelated profiling.

04 — Newsletter

How newsletter subscriptions work

Subscription is voluntary. By submitting the newsletter form, you ask to receive occasional email communications from Lucian Grey.

• You may withdraw consent at any time.
• Withdrawing consent does not affect processing that occurred before withdrawal.
• Every production newsletter should include a working unsubscribe method.
• You may also unsubscribe by writing to the privacy contact address.
• Your email address will not be added again after withdrawal unless you actively resubscribe.

Subscription records may include evidence of when and how consent was obtained. This helps demonstrate that communications were requested and protects both subscribers and the website from unauthorised sign-ups.

05 — Cookies and similar technologies

Does the website use cookies?

The website does not currently use advertising cookies or behavioural analytics cookies.

When you submit the newsletter form, the server may create a short-lived, strictly necessary session cookie used to limit repeated submissions and protect the form against abuse. This cookie is not used for advertising, cross-site tracking, or audience profiling.

Essential cookies may be used without consent where they are strictly necessary to provide a service requested by the user. Should optional analytics, advertising, or personalisation technologies be introduced, this policy and the website’s consent mechanism will be updated before they are activated where required.

06 — Service providers and recipients

Who may process information?

Personal information may be processed by carefully selected service providers only where necessary to operate the website and newsletter. These categories may include:

• web-hosting, database, security, and backup providers;
• email-delivery providers used to transmit newsletter messages;
• technical contractors acting under appropriate confidentiality obligations;
• professional advisers or authorities where disclosure is legally required.

Providers acting on behalf of the controller are expected to process information only under documented instructions and to apply appropriate technical and organisational safeguards.

Google Fonts

This website currently requests font files from Google Fonts. When your browser makes that request, Google may receive technical information such as your IP address, browser information, and the page making the request. Google processes that information under its own terms and privacy notices.

Retailer links

Links to Amazon, Foyles, Bol, IBS, Saxo, Google Books, or other external services take you to websites controlled by third parties. Their privacy practices are separate from this policy.

07 — International transfers

May information leave the European Economic Area?

Some technology or email service providers may process information outside the European Economic Area. Where a transfer is subject to the GDPR, it should rely on a recognised safeguard, such as an adequacy decision, approved standard contractual clauses, or another lawful transfer mechanism.

External services reached through retailer links operate independently and may process information in countries identified in their own privacy documentation.

08 — Retention

How long is information kept?

• Active newsletter subscriptions: for as long as you remain subscribed.
• Unsubscribed records: a minimal suppression and consent record may be retained for up to three years after withdrawal to respect your preference, demonstrate compliance, and resolve disputes. It will then be deleted or irreversibly anonymised unless a longer period is legally necessary.
• Correspondence: generally for no longer than three years after the last meaningful interaction, unless needed for an ongoing matter or legal obligation.
• Security and server logs: generally for a short period, normally no longer than twelve months, unless a security investigation requires longer retention.

Retention periods may be shortened where the information is no longer necessary or extended where required by law, litigation, fraud prevention, or a documented security incident.

09 — Your rights

What choices and rights do you have?

Subject to applicable law, you may have the right to:

• request access to personal information held about you;
• request correction of inaccurate or incomplete information;
• request deletion of your information;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive certain information in a portable format;
• withdraw consent at any time;
• object at any time to the use of your information for direct marketing;
• lodge a complaint with a competent supervisory authority.

In Italy, the competent authority is the Garante per la protezione dei dati personali. You may also contact the supervisory authority in the EU or EEA country where you live, work, or believe an infringement occurred.

To protect your information, reasonable verification may be requested before fulfilling a privacy request. Responses are normally provided within the period required by applicable law.

10 — Security

How is information protected?

Reasonable technical and organisational safeguards are used to protect personal information, including encrypted HTTPS connections, restricted database access, prepared database queries, anti-abuse controls, and minimisation of information collected.

No online system can be guaranteed completely secure. You should avoid sending sensitive or confidential information through ordinary email unless an appropriate secure method has been arranged.

11 — Children

Information relating to children

This website and newsletter are intended for a general adult readership and are not knowingly directed at children. Personal information from a child will be deleted where it is discovered that it was collected without the consent or other authorisation required by applicable law.

12 — Changes to this policy

How will updates be communicated?

This policy may be updated to reflect changes to the website, newsletter infrastructure, service providers, or applicable law. The effective date at the top of the page will be revised when material changes are made.

Where appropriate, significant changes may also be communicated through the website or newsletter before they take effect.

13 — Contact

Privacy questions and requests

For privacy requests, newsletter withdrawals, or questions about this policy, contact:

This policy is designed to describe the website configuration in place on its effective date. Operational practices, database retention, mailing software, and consent records must remain consistent with this notice.