Privacy Policy

1. Data Controller Identification

This Privacy Policy outlines how Flats Above Main (“we”, “our”, or “the Publication”), operating under the laws of England and Wales, processes and safeguards personal data collected across flatsabovemain.com. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Flats Above Main acts as the legal Data Controller responsible for your personal information.

2. UK GDPR Statutory Scope

Our privacy regime is structured in strict alignment with domestic UK data protection legislation, including the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR). This policy applies to all prospective and current readers, newsletter recipients, and corporate correspondents accessing our digital publications.

3. Core Data Protection Principles

Under Article 5 of the UK GDPR, we adhere to the foundational principles of data stewardship: lawfulness, fairness, and transparency; purpose limitation; data minimisation; accuracy; storage limitation; and integrity and confidentiality. We only collect the minimal personal data required to deliver high-quality editorial content.

4. Categories of Data Collected

We restrict our data intake to strictly necessary categories: Identity and Contact Data (name and email address when voluntarily supplied); Technical Data (anonymised IP address, browser type, device operating system); and Usage Data (pages accessed, interaction durations, and referring publication links).

5. Automated Technical Telemetry

When connecting to our web servers, standard server logs automatically ingest technical telemetry to maintain connection resilience and defeat distributed denial-of-service (DDoS) attempts. These logs capture timestamps, HTTP request headers, and user-agent strings. All IP addresses are truncated to ensure no direct personal attribution can occur.

6. Voluntarily Submitted Information

Where you choose to register for our curated editorial newsletter (“Resort inspiration, delivered occasionally”) or transmit enquiries to our editorial desk, we store your email address and message contents. Submission is entirely voluntary, and subscription forms feature explicit unbundled consent mechanisms.

7. Lawful Processing Bases (Article 6)

In accordance with Article 6(1) of the UK GDPR, our processing activities rest on defined lawful bases:

• Consent (Art. 6(1)(a)): For delivery of email editorial dispatches and the activation of optional analytical cookies.
• Legitimate Interests (Art. 6(1)(f)): For monitoring site stability, protecting server infrastructure, diagnosing technical latency, and understanding overall readership trends.
• Legal Obligation (Art. 6(1)(c)): Where compliance with statutory disclosure obligations or regulatory investigations in England and Wales is required.

8. Explicit Purposes of Processing

We process personal data solely for legitimate, pre-notified purposes: serving our editorial hotel and resort reviews; administering reader feedback and journalistic corrections; verifying compliance with our 18+ editorial mandate; optimizing mobile and desktop interface rendering; and preventing cyber security threats.

9. Absolute Ban on Data Commercialisation

Flats Above Main maintains an uncompromising commercial standard: we do not sell, rent, monetise, lease, or trade personal data to any third party, including advertising exchanges, gambling operators, marketing agencies, or data brokers. Your reading habits remain private.

10. Editorial Independence & Affiliates

Flats Above Main operates as an independent review publication. When our guides feature links to luxury hotel booking desks or resort operators, outbound tracking tokens do not transmit any personal data collected on our site. Commercial relationships never grant external partners access to our subscriber registries.

11. Technical Sub-processors & Hosting

We engage vetted cloud hosting providers, content delivery networks (CDNs), and transactional email dispatchers that act strictly as Data Processors under binding Article 28 data processing agreements. These processors are contractually bound to treat your information confidentially and process it exclusively under our instructions.

12. Cross-Border Data Transfers

Our primary server clusters are situated within the United Kingdom and EEA jurisdictions with established adequacy regulations. Where technical sub-processors operate facilities in third countries, transfers are safeguarded via the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (SCCs).

13. Data Retention & Secure Disposal

We hold personal information only for as long as strictly required to fulfill the purposes for which it was gathered. Newsletter subscriber credentials are retained until unsubscription or 24 months of total inactivity, after which they are permanently expunged. Server log archives undergo automated cryptographic purging on a rolling 90-day schedule.

14. Technical & Organisational Security

We employ rigorous defence-in-depth security architectures, including mandatory HTTPS/TLS 1.3 encryption across all transport routes, Web Application Firewalls (WAF), least-privilege administrative access policies, multi-factor authentication for editorial staff, and continuous vulnerability scanning.

15. Your Statutory Rights (Articles 15–22)

As a data subject in the United Kingdom, you possess extensive enforceable statutory rights:

• Right of Access (Art. 15): Obtain confirmation of processing and a complimentary copy of your personal data.
• Right to Rectification (Art. 16): Require immediate amendment of inaccurate or incomplete biographical records.
• Right to Erasure (Art. 17): Demand permanent deletion (“right to be forgotten”) where statutory grounds apply.
• Right to Restriction (Art. 18): Restrict the scope of processing under specific evidentiary dispute circumstances.
• Right to Data Portability (Art. 20): Receive your submitted data in a structured, commonly used, machine-readable format.
• Right to Object (Art. 21): Object to any processing founded on our legitimate interests or direct communications.

16. Child Privacy (18+) & ICO Recourse

Flats Above Main features editorial coverage of destinations containing licensed adult entertainment and casino facilities. Consequently, our service is strictly designated for individuals aged 18 and older. We do not knowingly harvest data from minors. If you believe a minor has supplied data to us, contact us immediately for swift expunction.