Privacy Notice (UK GDPR & EU GDPR)
Who we are
Nineteen Stone Ninjas Limited (company number 16309054), registered in England & Wales, is the “data controller” for this website.
Registered office: Unit C, Blackett Street, Manchester, United Kingdom, M12 6AE
Contact for privacy matters: here
What this notice covers
This notice explains what personal data we collect via this website, why we collect it, how long we keep it, who we share it with, international transfers, and your rights.
Data we collect and why (lawful bases)
| Purpose | Data | Lawful basis |
|---|---|---|
| Site operation & security | Web server logs, IP address, user-agent, pages viewed, timestamps | Legitimate interests (running a secure, functional site) |
| Contacting us | Name, email, message content (when you submit a form or email us) | Consent (when you opt in) or Legitimate interests (replying to your message) |
| Comments / accounts (if enabled) | Account credentials (hashed), login status, comment details | Contract (providing the account) & Legitimate interests |
| Analytics (Google Analytics 4) | Pseudonymous identifiers, device/interaction data | Consent (non-essential; set only after opt-in) |
Who we share data with (processors)
- Hosting / infrastructure: Quicklaunch Ltd. (site hosting and security; access to logs as needed).
- Analytics: Google Ireland Limited / Google LLC (Google Analytics 4).
International transfers
Where personal data is transferred outside the UK/EEA (e.g., to Google LLC in the USA), we rely – where available – on the UK Extension to the EU-US Data Privacy Framework for certified recipients. If/when that doesn’t apply, we use the UK International Data Transfer Addendum to the EU Standard Contractual Clauses and implement appropriate safeguards (and transfer risk assessments).
How long we keep data
- Server logs: up to 90 days (security & troubleshooting).
- Contact enquiries: up to 12 months after closure.
- GA4 analytics events: up to 14 months (as configured in GA4 property settings).
- Cookies: see Cookie Policy below for lifetimes.
Your rights
You can request access, rectification, erasure, restriction, objection (including to profiling), and data portability. Where we process data based on consent, you can withdraw consent at any time (this won’t affect past processing). To exercise rights, contact us here. You can also complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.
Children
This site isn’t intended for children under 16. We don’t knowingly collect their data.
Changes to this notice
We may update this notice from time to time. Last updated: 10 September 2025 (UK).