Privacy notice, GDPR and cookies
Applies to UKMLA Forum (https://ukmlaforum.org). Written for the UK GDPR and the Data Protection Act 2018, and for the Privacy and Electronic Communications Regulations (cookies). Last updated 27 October 2026.
Who is responsible for your data
UKMLA Forum and is the “controller” of the personal data described here. Contact for every privacy request: admin [at] ukmlaforum [dot] org. We have not appointed a Data Protection Officer because the law does not require one for a service of this kind.
How this website earns money
This website earns income from sponsors and from affiliate links. Sponsored messages are labelled “Sponsored”. Some links to books and other products are affiliate links: if you buy after clicking one, we may receive a commission at no extra cost to you. Income never changes what the guide says, and sponsors and retailers do not receive your name, email address or account details from us. The sections below explain exactly what is shared when you load or click these items.
What we collect, why, and on what legal basis
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| Reading the guide | No account is needed. We do not ask who you are. | n/a | n/a |
| Account (optional): a sign-in identifier from the service you choose, optionally an email address, and a random public name such as “member-12345” | To let you save progress across devices | Contract (providing the account you asked for) | Until you delete the account, or 730 days after you last sign in, when an unused account is deleted automatically |
| Progress: the guide steps you mark as done | To show your progress | Contract | Until you delete the account. Signed-out ticks stay in your browser only. |
| Community posts (optional, signed-in members only): the discussions and replies you write, shown publicly beside your public username once a moderator approves them; any reports you send | To run a moderated community and keep it safe | Contract (the account and features you asked for) and legitimate interests (keeping the community safe) | Until you delete your account, which deletes your posts. Records of posts rejected for breaking the rules: 180 days after the decision. Reports: until resolved or you delete your account. |
| Contact messages: name, email, message | To reply to you | Your request / legitimate interests | 365 days |
| Server logs: IP address, time, page, status, browser type, referring page (secrets in web addresses are removed) | Security, preventing abuse, diagnosing faults | Legitimate interests | Crawler requests only, 14 days; error logs 30 days; proxy access logs 180 days; database backups 7 days |
| Sponsored-message counting: a short-lived keyed code derived from your IP address (not the address itself, and not stored with the totals) | To avoid counting a reload or a repeated click twice, and to ignore automated traffic | Legitimate interests | Up to 1 hour |
| Cookie choice | To remember your cookie preference | Strictly necessary | 12 months |
| Analytics (only if you allow it): pages viewed, approximate location, device type | To understand which pages help and which do not | Consent | Set in the analytics service; 14 months or less |
We do not ask for your real name, date of birth, nationality, medical-registration number, health information or payment details, and we ask you not to put them in contact messages. We do not build advertising profiles. In the community, automated checks hold back posts that break the published rules (for example links or images); a moderator reviews every post, and a person decides whether an account that repeatedly breaks the rules stays paused. You can contact us to challenge any decision.
Cookies and similar technologies
- Strictly necessary (no consent needed): a session cookie when you sign in (up to 14 days), a security (CSRF) cookie, and a cookie that remembers your cookie choice. Your progress ticks use your browser’s local storage if you are signed out.
- Analytics (only after you press “Allow analytics”): cookies whose names begin with
_ga. Nothing is sent to the analytics service before you agree. Ad personalisation and cross-site signals are switched off, and pressing “Essential only”, or “Cookie settings” in the footer, withdraws consent and deletes these cookies. Withdrawing is as easy as agreeing. - Sponsored messages and affiliate links do not set cookies on this website. See the next two sections for what happens when they load or are clicked.
Sponsored messages
Sponsored messages are chosen and delivered by this website: your browser does not contact the service that supplies them, and that service receives nothing about you. We count how often each message is shown and clicked, in aggregate, and send the sponsor-facing totals to that service. To avoid counting a reload or a repeated click twice, we keep a short-lived, keyed (irreversible) code derived from your IP address for up to an hour; it is not stored with the totals. Sponsored messages set no cookies and use no advertising or visitor tracking. Our legal basis is legitimate interests (funding a free guide); you can object using the contact address above, and you can block sponsored messages with a browser setting or extension; the guide still works.
Affiliate links
If you click an affiliate link (for example, a book on the Resources page) you leave this website and the retailer’s own privacy notice applies. The link carries an identifier showing that you came from us so that the retailer can credit our commission; it does not contain your name, email address or account details. We do not learn what you buy.
Where your data comes from, and whether you must provide it
We collect data from you directly (forms, posts, ticks) and from the sign-in service you choose, which tells us only a stable identifier and, if you allow it, an email address. We discard names and profile pictures that the service sends. You are never required to give personal data to read the guide. Creating an account, posting or contacting us is optional, but we cannot provide those features without the data described above.
We do not use automated decision-making that has legal or similarly significant effects on you. Automated checks may hold back a post for a moderator; a person makes any decision that affects your account, and you can ask us to review it.
Who receives your data
We share personal data only with these categories of recipients, each bound by contract to protect it and to use it only on our instructions: hosting and database providers; cloud storage providers (server logs); an email service (contact messages and notifications); an analytics provider (only if you consent); the sign-in service you choose (Google, Meta or Apple, each an independent controller under its own notice; when you create or use an account, it tells us who you are and we tell it that you are signing in); a sponsored-message delivery service (aggregate view and click totals only, no personal data, as described above); and monitoring services (a job-status ping that contains no personal data, and an uptime check of a public address that returns only “ok”). Search-engine ownership tags in our pages carry no personal data, and we set no cookies for them. We may disclose data where the law requires it. We never sell personal data.
Some providers process data outside the UK. We rely on UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, or equivalent safeguards. Ask us at the address above for a copy of the safeguards.
Young people
This guide is written for students from about 16 and for adults. You must be at least 13 to create an account (the age of digital consent in the UK). We do not knowingly profile or advertise to children, we do not use their data for marketing, and our default is to collect as little as possible. If you are under 18 and believe we hold data you would like removed, tell us and we will delete it.
Your rights
You may ask to access, correct, erase or restrict your data, to receive it in a portable format, and to object to processing based on legitimate interests. Signed-in members can download or delete their data themselves. Where processing is based on consent you may withdraw it at any time. We respond within one month. If you are unhappy, please talk to us first; you also have the right to complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113).
Security
Traffic is encrypted in transit, staff access uses two-factor authentication, secrets are not stored in the source code, personal data in logs is minimised, and we keep data only for the periods above. If a breach is likely to harm you, we will tell you and the regulator as the law requires.
We may update this notice; the date above shows the latest version. Material changes are announced on this page.