Privacy Policy

The data controller for this website is Istora Review, an editorial publication based at 61 Laystall Street, London London EC1R 4PB, United Kingdom, London, United Kingdom. For data protection enquiries, contact us at [email protected].

We are registered as a data controller in the United Kingdom. Where we process personal data, we do so only for the purposes described in this policy and only to the extent necessary for those purposes.

We collect personal data only when it is voluntarily provided by users or when it arises automatically from the use of the website. The categories of data we may collect are as follows:

• Contact form data: name, email address, subject, and message content submitted via the contact form on this website.
• Usage data: IP address, browser type, operating system, referring URLs, pages visited, and time spent on pages. This data is collected automatically by server logs and, if consented to, by analytics services.
• Cookie data: data stored in browser cookies as described in our Cookie Policy.
• Correspondence data: any personal information contained in letters or emails sent to the editorial address.

We do not collect sensitive personal data (also referred to as special category data under UK GDPR), including data relating to health, ethnic origin, religious beliefs, or political opinions.

Personal data collected through this website is used solely for the following purposes:

• Responding to contact form submissions and correspondence
• Monitoring and improving website performance and editorial content
• Complying with applicable legal obligations
• Analysing aggregate usage patterns to understand readership (analytics only when consent is given)

We do not use personal data for automated decision-making or profiling. We do not sell, rent, or otherwise transfer personal data to third parties for marketing purposes.

Under UK GDPR, we are required to identify a lawful basis for each category of personal data processing. The bases we rely on are:

• Consent (Article 6(1)(a)): for the placing of non-essential cookies and for analytics processing. Consent may be withdrawn at any time via the Cookie Settings link in the footer.
• Legitimate interests (Article 6(1)(f)): for server log data used to maintain website security and identify technical issues, where those interests are not overridden by your rights and freedoms.
• Performance of a contract or pre-contractual steps (Article 6(1)(b)): for processing contact form submissions in order to respond to enquiries.
• Legal obligation (Article 6(1)(c)): where processing is required to comply with UK law.

This website uses a limited number of third-party services. Where those services involve the handling of personal data, we have ensured that appropriate data processing arrangements are in place. Third-party services currently in use include:

• Google Maps: an embedded map on the contact page. Google Maps may set cookies and collect usage data in accordance with Google's Privacy Policy. The map is loaded only with standard referrer policy restrictions applied.
• Google Fonts: used to load web fonts from Google's servers. This involves a request to Google that may include your IP address. Fonts are loaded via standard Google Fonts CDN.
• CDN-delivered scripts: certain JavaScript libraries are loaded from content delivery networks (jsDelivr, Cloudflare CDN, unpkg). These requests may involve the transmission of your IP address to those networks.

We do not share personal data from contact forms or correspondence with any third party except where required to do so by law.

Personal data is retained only for as long as is necessary for the purpose for which it was collected, or as required by applicable law:

• Contact form submissions: retained for up to 12 months from the date of receipt, unless the correspondence relates to an ongoing editorial matter, in which case it may be retained for the duration of that matter plus 12 months.
• Server log data: retained for up to 90 days, after which it is deleted or anonymised.
• Cookie data: session cookies are deleted when the browser is closed; persistent cookies have varying retention periods as described in the Cookie Policy.

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access: you may request a copy of the personal data we hold about you.
• Right to rectification: you may request that inaccurate data be corrected or incomplete data be completed.
• Right to erasure: you may request deletion of personal data where there is no compelling reason for its continued retention.
• Right to restrict processing: you may request that we limit the processing of your data in certain circumstances.
• Right to object: you may object to processing based on legitimate interests.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us using the details in Section 08 below. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

For all data protection enquiries, requests to exercise your rights, or questions about this Privacy Policy, please contact the editorial office:

This Privacy Policy was last updated on 14 March 2026. We reserve the right to update this policy at any time. Material changes will be noted at the top of this page with a revised date.