Identity of the Data Controller
OxfordWin Editorial operates this website and acts as data controller in respect of the personal data described in this notice. The editorial office is registered in England and Wales (company number on file; available on request). If you have a data-protection query, write to us via the contact page or email [email protected].
ICO registration number is on file and available on request. Our data-protection lead monitors the information-rights obligations described below.
What Data We Collect
OxfordWin collects the following categories of personal data:
- Server logs — IP address, browser type, referring URL, pages visited and timestamps. Retained for 90 days for security and diagnostic purposes.
- Contact form submissions — name, email address and the content of your message. Retained for 12 months unless you ask us to delete them earlier.
- Cookie data — analytics identifiers (where you have consented) and a session cookie for the age gate. See our Cookies policy for the complete breakdown.
- Affiliate referral data — when you click a sponsored link, the destination operator receives a referral identifier. OxfordWin does not receive personal data from operators about individual referrals.
Legal Basis for Processing
We process personal data under the following lawful bases set out in Article 6 of UK GDPR:
- Legitimate interests (Art. 6(1)(f)) — server log retention for site security and abuse prevention; affiliate referral tracking.
- Contract performance (Art. 6(1)(b)) — processing contact form data to respond to your enquiry.
- Consent (Art. 6(1)(a)) — analytics and marketing cookies, where you have clicked "Accept all" or individually toggled those categories on.
Your Rights as a Data Subject
Under UK GDPR and the Data Protection Act 2018, you have the following rights:
- Access — you may request a copy of the personal data we hold about you.
- Erasure — you may request deletion of your data where there is no longer a lawful basis for retention.
- Rectification — you may ask us to correct inaccurate personal data.
- Portability — you may request your data in a machine-readable format where processing is by automated means and based on consent or contract.
- Objection — you may object to processing based on legitimate interests; we will stop unless we can demonstrate compelling grounds.
- Restriction — you may ask us to restrict processing while a dispute is resolved.
To exercise any of these rights, contact us via the contact page. We will respond within 30 days. If you believe your rights have been infringed, you may lodge a complaint with the Information Commissioner's Office.
Retention Periods
Server logs: 90 days. Contact form data: 12 months unless earlier erasure is requested. Consent preferences (stored in localStorage on your device): until you clear your browser data. Analytics data processed by third-party tools: per the third party's retention policy (Google Analytics default is 14 months).
Sub-processors and Third Parties
Where consented, we use Google Analytics to collect anonymous browsing data. Google processes this data as a data processor under a data-processing agreement. No personal data is sold to or shared with other third parties. Affiliate referral identifiers are passed to operators when you click a sponsored link — this is a direct request from your browser, not a data transfer by OxfordWin.
International Transfers
Where personal data is processed by sub-processors with infrastructure outside the UK (for example, Google Analytics data centres in the USA), transfer is governed by appropriate safeguards including Standard Contractual Clauses. We do not otherwise transfer personal data outside the UK or European Economic Area.
Automated Decision-Making
OxfordWin does not make automated decisions that have a significant effect on individuals. Our editorial scoring process is carried out by human analysts; no automated profiling of readers takes place.
Adults Only — Under-18s
This site is intended exclusively for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has provided personal data to OxfordWin, contact us immediately and we will delete it.
How We Update This Notice
When material changes are made to this notice, the "updated" date in the page header changes. We do not provide individual notifications of minor updates. The current version is always accessible at this URL. Continued use of the site after a material change constitutes acknowledgement of the updated notice.
Last reviewed: May 2026.